From a4be737f17b7c6a771d1fb2c0af4dae1cdaf5c08 Mon Sep 17 00:00:00 2001 From: "K. Isom" Date: Thu, 22 Oct 2026 11:44:20 -0700 Subject: [PATCH] ci: pin cargo-semver-checks by version and checksum Download the v0.51.0 release binary directly and verify its SHA-256 instead of installing whatever cargo-binstall and cargo-semver-checks are latest, matching the SHA-pinned actions elsewhere in the workflows. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dc7ed3e1..9eede90c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -44,11 +44,17 @@ jobs: # The semver gate in scripts/ci.sh compares tines-core against the # published 1.0.0; a prebuilt binary keeps this fast (a from-source - # install would dominate the job). + # install would dominate the job). Pinned by version and SHA-256, like + # the actions above; bump both together. - name: Install cargo-semver-checks + env: + CSC_VERSION: v0.51.0 + CSC_SHA256: cacadafaa5cd27ae6d05a74a103266917ebab4c5e43c898360e177d4fbf06a65 run: | - curl -LsSf https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | tar xzf - -C "$HOME/.cargo/bin" - cargo binstall --no-confirm cargo-semver-checks + curl -fsSLo csc.tar.gz "https://github.com/obi1kenobi/cargo-semver-checks/releases/download/${CSC_VERSION}/cargo-semver-checks-x86_64-unknown-linux-gnu.tar.gz" + echo "${CSC_SHA256} csc.tar.gz" | sha256sum -c - + tar xzf csc.tar.gz -C "$HOME/.cargo/bin" cargo-semver-checks + rm csc.tar.gz - name: Run CI gate run: sh scripts/ci.sh