fix: make checksum validation mandatory, clean up ecosystem docs

Author: jdalton

README.md

@@ -113,7 +113,6 @@ Add a cooldown period if you want an extra buffer before newly published action
 
 | Input                 | Description                                                      | Required | Default              |
 | --------------------- | ---------------------------------------------------------------- | -------- | -------------------- |
-| `checksum-validation` | Verify SHA256 checksum of downloaded binaries                    | No       | `true`               |
 | `firewall-version`    | Specify the firewall version number                              | No       | `latest`             |
 | `github-token`        | GitHub API Token used for downloading binaries                   | No       | `${{ github.token}}` |
 | `job-summary`         | Create a [job summary][job-summary] (`all`, `errors`, or `none`) | No       | `all`                |
@@ -211,7 +210,6 @@ Add a cooldown period if you want an extra buffer before newly published action
 
 | Input                 | Description                                                      | Required | Default              |
 | --------------------- | ---------------------------------------------------------------- | -------- | -------------------- |
-| `checksum-validation` | Verify SHA256 checksum of downloaded binaries                    | No       | `true`               |
 | `firewall-version`    | Specify the firewall version number                              | No       | `latest`             |
 | `github-token`        | GitHub API Token used for downloading binaries                   | No       | `${{ github.token}}` |
 | `job-summary`         | Create a [job summary][job-summary] (`all`, `errors`, or `none`) | No       | `all`                |
@@ -228,26 +226,37 @@ Add a cooldown period if you want an extra buffer before newly published action
 
 ### Supported Ecosystems
 
-The following package managers are supported and will have shims created automatically (when `shims` is `true`):
+When `shims` is `true` (the default), the action creates shims so package manager commands are automatically routed through sfw. The supported ecosystems depend on the edition.
 
-| Package Manager | Ecosystem         | Command         |
-| --------------- | ----------------- | --------------- |
-| `npm`           | JavaScript/Node   | `npm install`   |
-| `pnpm`          | JavaScript/Node   | `pnpm install`  |
-| `yarn`          | JavaScript/Node   | `yarn install`  |
-| `pip`           | Python            | `pip install`   |
-| `pip3`          | Python            | `pip3 install`  |
-| `cargo`         | Rust              | `cargo fetch`   |
+#### Free + Enterprise
 
-### Checksum Validation
+Available in both [sfw-free][sfw-free-ecosystems] and [sfw-enterprise][sfw-enterprise-ecosystems]:
 
-By default the action validates the SHA256 checksum of the downloaded firewall binary against the checksum file published alongside each release. This helps make sure the binary was not tampered with during download. You can disable this if needed:
+| Ecosystem           | Package Manager |
+| ------------------- | --------------- |
+| JavaScript/Node     | `npm`           |
+| JavaScript/Node     | `pnpm`          |
+| JavaScript/Node     | `yarn`          |
+| Python              | `pip`           |
+| Python              | `uv`            |
+| Rust                | `cargo`         |
 
-```yaml
-- uses: SocketDev/action@v1.3.1
-  with:
-    mode: firewall-free
-    checksum-validation: 'false'
-```
+#### Enterprise only
+
+Additional ecosystems available with [sfw-enterprise][sfw-enterprise-ecosystems]:
+
+| Ecosystem           | Package Manager | Note         |
+| ------------------- | --------------- | ------------ |
+| .NET                | `nuget`         |              |
+| Go                  | `go`            | Linux only   |
+| Ruby                | `bundler`       |              |
+| Ruby                | `gem`           |              |
+
+[sfw-free-ecosystems]: https://github.com/SocketDev/sfw-free?tab=readme-ov-file#supported-package-managers
+[sfw-enterprise-ecosystems]: https://github.com/SocketDev/firewall-release/wiki#support-matrix
+
+### Checksum Validation
+
+The action validates the SHA256 checksum of the downloaded firewall binary against the checksum file published alongside each release. This ensures the binary was not tampered with during download.
 
 [job-summary]: https://github.blog/news-insights/product-news/supercharging-github-actions-with-job-summaries

action.yml

@@ -9,10 +9,6 @@ branding:
   color: purple
 
 inputs:
-  checksum-validation:
-    description: Verify SHA256 checksum of downloaded binaries
-    default: 'true'
-
   firewall-version:
     description: Specify the firewall version number
     default: latest

dist/main.js

@@ -18,7 +18,6 @@ process.on('unhandledRejection', errorHandler)
 process.on('uncaughtException', errorHandler)
 
 const inputs = {
-  checksumValidation: core.getBooleanInput('checksum-validation'),
   jobSummary: core.getInput('job-summary', { required: false }).toLowerCase(),
   mode: core.getInput('mode', { required: true }).toLowerCase(),
   patchCwd: core.getInput('patch-cwd'),

src/main.js

@@ -179,11 +179,9 @@ export default async function download ({ edition = 'free', ...inputs }) {
       // download the binary
       const pathDownload = await tool.downloadTool(url)
 
-      // if checksum validation is turned on, verify the download
-      if (inputs.checksumValidation) {
-        const checksumUrl = `${url}.sha256`
-        await validateChecksum(pathDownload, checksumUrl)
-      }
+      // always validate the checksum to make sure the binary wasnt tampered with
+      const checksumUrl = `${url}.sha256`
+      await validateChecksum(pathDownload, checksumUrl)
 
       // cache it so we dont have to download again next time
       pathCache = await tool.cacheFile(pathDownload, nameExec, ...cacheOptions)