Repository navigation
Conversation
The lint-actions workflow ran a script from the actionlint main branch via curl, which then fetched the latest actionlint with no checksum. A mutable branch was executing in CI. Download the v1.7.12 linux_amd64 release tarball, verify its sha256 against the value in the release checksums file and run /tmp/actionlint. Claude-Session: https://claude.ai/code/session_01N9kjTzpfMHvVNLhn8TMxvk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I noticed that lint-actions runs a script from the actionlint
mainbranch via curl, which then fetches the latest actionlint with no checksum.The fix is to download the v1.7.12 linux_amd64 release tarball, verify its sha256 against the release checksums file and run
/tmp/actionlint.Actionlint already reports findings here (unknown runner label ubuntu-20.04 etc.), unchanged by this PR since the old script also fetched the latest version.