[aatarasoff]

Updates default version input to v0.17.0 (including pbuf --version verification in CI).

[aatarasoff]

Code Review: chore: bump default pbuf CLI version to v0.17.0

Reviewed as Principal Software Engineer / Security Researcher. Changes are a straightforward default version bump + package version increment + CI assertion. No new logic introduced in this diff.

Findings

• [Severity: High] — Security & Vulnerabilities

  • Location: src/main.js (INSTALL_SCRIPT_URL + exec.exec('/bin/bash', ['-lc', 'curl -fsSL ... | sh ...']) — pre-existing, not introduced here)
  • Problem: The Action always downloads and pipes an unpinned install script from the main branch of pbuf-registry (curl | sh). There is no commit pin, checksum, or signature verification of either the script or the resulting binary. A compromise of the pbuf-registry repository (malicious commit to main, compromised maintainer, or supply-chain attack on the release assets) results in arbitrary code execution on every consumer’s GitHub Actions runner. This is especially concerning for a public Action that may receive a token (pbuf_token) and GitHub token.
  • Fix: Prefer direct download of a versioned, checksummed binary from GitHub Releases (or a pinned commit of the install script). Example sketch:

    // After validating version
    const assetUrl = `https://github.com/pbufio/pbuf-registry/releases/download/${version}/pbuf_${plainVersion}_${os}_${arch}.tar.gz`;
    // Download, verify SHA256 from a known-good source or cosign/sigstore, extract, install.
    // Avoid curl|sh entirely.

    Alternatively, pin the install script to a specific commit SHA and verify the downloaded binary against published checksums.

• [Severity: Low] — Correctness & Edge Cases

  • Location: CI workflow + default in action.yml / README
  • Problem: Default moved to v0.17.0. CI now asserts the exact version string. This is good, but ensure the release assets for v0.17.0 are published and stable before merging (CI currently green, so likely already available).
  • Fix: None required if the release is live; otherwise coordinate the release first.

Other notes (non-blocking)

• Version regex (VERSION_RE) is solid and prevents shell injection into the install path.
• core.setSecret is correctly applied to tokens.
• PR comment upsert logic is reasonably defensive (pagination, timeouts, marker-based sticky comments).

Go / No-Go Verdict: Go for this PR (pure chore, CI green, consistent updates). Recommend a follow-up to eliminate the curl | sh pattern and add binary integrity verification before the next major release of the Action.

Thanks for the clean version bump!