Merge pull request #441 from posit-dev/security/binary-checksums

Add checksum verification to composite actions

Author: bschwedler

setup-goss/action.yml

@@ -25,18 +25,34 @@ runs:
         if [ -z "$arch" ]; then
           arch=$(uname -m)
         fi
-        
+
         # Map architecture names to goss naming conventions
         if [ "$arch" = "x86_64" ]; then
             arch="amd64"
         elif [ "$arch" = "aarch64" ]; then
             arch="arm64"
         fi
-        
-        curl -fsSL https://github.com/goss-org/goss/releases/${{ inputs.version }}/download/goss-linux-${arch} -o tools/goss
+
+        release_url="https://github.com/goss-org/goss/releases/${{ inputs.version }}/download"
+        binary="goss-linux-${arch}"
+
+        curl -fsSL "${release_url}/${binary}" -o "tools/${binary}"
+
+        curl -fsSL "${release_url}/${binary}.sha256" -o "tools/${binary}.sha256"
+        (cd tools && sha256sum -c "${binary}.sha256")
+        rm -f "tools/${binary}.sha256"
+
+        mv "tools/${binary}" tools/goss
         chmod +rx tools/goss
     - name: Install dgoss
       shell: bash
       run: |
-        curl -fsSL https://github.com/goss-org/goss/releases/${{ inputs.version }}/download/dgoss -o tools/dgoss
+        release_url="https://github.com/goss-org/goss/releases/${{ inputs.version }}/download"
+
+        curl -fsSL "${release_url}/dgoss" -o tools/dgoss
+
+        curl -fsSL "${release_url}/dgoss.sha256" -o tools/dgoss.sha256
+        (cd tools && sha256sum -c dgoss.sha256)
+        rm -f tools/dgoss.sha256
+
         chmod +rx tools/dgoss

setup-hadolint/action.yml

@@ -37,5 +37,19 @@ runs:
             arch="arm64"
         fi
 
-        curl -fsSL https://github.com/hadolint/hadolint/releases/${{ inputs.version }}/download/hadolint-linux-${arch} -o ${{ inputs.base_path }}/tools/hadolint
-        chmod +rx ${{ inputs.base_path }}/tools/hadolint
+        release_url="https://github.com/hadolint/hadolint/releases/${{ inputs.version }}/download"
+        dest="${{ inputs.base_path }}/tools"
+
+        # v2.13.0+ uses lowercase "linux"; older releases use "Linux"
+        binary="hadolint-linux-${arch}"
+        if ! curl -fsSL "${release_url}/${binary}" -o "${dest}/${binary}" 2>/dev/null; then
+            binary="hadolint-Linux-${arch}"
+            curl -fsSL "${release_url}/${binary}" -o "${dest}/${binary}"
+        fi
+
+        curl -fsSL "${release_url}/${binary}.sha256" -o "${dest}/${binary}.sha256"
+        (cd "${dest}" && sha256sum -c "${binary}.sha256")
+        rm -f "${dest}/${binary}.sha256"
+
+        mv "${dest}/${binary}" "${dest}/hadolint"
+        chmod +rx "${dest}/hadolint"