From e88fd2c49299b08d9f99b5d741ecb10afa56ed15 Mon Sep 17 00:00:00 2001 From: Alexis Lefebvre Date: Tue, 4 Aug 2026 15:25:41 +0200 Subject: [PATCH] ci: verify splitsh-lite checksum before running it The release asset was fetched and executed unverified in the job that holds the GitHub App private key. Release assets are mutable, so pinning the URL alone did not pin the bytes. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 187e44039c9..5cd43df8326 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,8 +35,12 @@ jobs: fetch-depth: 0 - name: Install splitsh + env: + SPLITSH_VERSION: v1.0.1 + SPLITSH_SHA256: 2539301ce5e21d0ca44b689d0dd2c1b20d9f9e996c1fe6c462afb8af4e7141cc run: | - curl -L https://github.com/splitsh/lite/releases/download/v1.0.1/lite_linux_amd64.tar.gz > lite_linux_amd64.tar.gz + curl -fsSL "https://github.com/splitsh/lite/releases/download/$SPLITSH_VERSION/lite_linux_amd64.tar.gz" > lite_linux_amd64.tar.gz + echo "$SPLITSH_SHA256 lite_linux_amd64.tar.gz" | sha256sum --check --strict tar -zxpf lite_linux_amd64.tar.gz chmod +x splitsh-lite echo "$(pwd)" >> $GITHUB_PATH