Add support for pinning tools to a checksum (#1098)

Browse Source

Tools in the tools input can now be pinned to a checksum using the
tool:version@sha256:<hash> or tool:version@sha512:<hash> syntax.
The downloaded tool is verified against the checksum on all platforms,
including when it is served from the tools cache, and it is removed
along with its cache entry if the verification fails.

Checksum verification is supported for tools downloaded as phar
archives. Specifying a checksum for tools set up using composer
packages or custom package scripts results in an error.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

...

This commit is contained in:

Keisuke Maeda

2026-07-23 21:45:09 +09:00

committed by Shivam Mathur

parent b9ef68088b

commit 8ca9579834

7 changed files with 225 additions and 16 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

dist/index.js

Vendored

+1 -1

File diff suppressed because one or more lines are too long