fix(ci): verify yq checksum and DRY up install into shared script

The workflow was downloading yq from GitHub releases without any
integrity check (a supply-chain risk, however small, on CI runners).
We now download the upstream checksums file alongside the binary and
verify the SHA256 before installing.

While we're at it, the identical 8-line install block was copy-pasted
across all three jobs. Extracted into .github/scripts/install-yq.sh
so there's exactly one place to update the version or change the
verification logic.

Author: cds-amal

.github/scripts/install-yq.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+#
+# Installs yq (mikefarah/yq) into ~/.local/bin with SHA256 verification.
+# Intended for CI runners (Linux amd64).
+
+set -euo pipefail
+
+YQ_VERSION="${YQ_VERSION:-v4.52.4}"
+INSTALL_DIR="$HOME/.local/bin"
+BASE_URL="https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}"
+
+mkdir -p "$INSTALL_DIR"
+
+wget -qO "$INSTALL_DIR/yq_linux_amd64" "${BASE_URL}/yq_linux_amd64"
+wget -qO "$INSTALL_DIR/checksums"       "${BASE_URL}/checksums"
+
+(
+    cd "$INSTALL_DIR"
+    grep 'yq_linux_amd64$' checksums | sha256sum -c -
+    mv yq_linux_amd64 yq
+    rm -f checksums
+    chmod +x yq
+)
+
+echo "$INSTALL_DIR" >> "${GITHUB_PATH:-/dev/null}"

.github/workflows/test.yml

@@ -23,14 +23,7 @@ jobs:
           submodules: recursive
 
       - name: Install yq
-        run: |
-          set -euo pipefail
-          YQ_VERSION="v4.52.4"
-          mkdir -p "$HOME/.local/bin"
-          wget -qO "$HOME/.local/bin/yq" \
-            "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
-          chmod +x "$HOME/.local/bin/yq"
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+        run: .github/scripts/install-yq.sh
 
       - name: 'Read nightly channel from rust-toolchain.toml'
         id: toolchain-meta
@@ -88,14 +81,7 @@ jobs:
           submodules: recursive
 
       - name: Install yq
-        run: |
-          set -euo pipefail
-          YQ_VERSION="v4.52.4"
-          mkdir -p "$HOME/.local/bin"
-          wget -qO "$HOME/.local/bin/yq" \
-            "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
-          chmod +x "$HOME/.local/bin/yq"
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+        run: .github/scripts/install-yq.sh
 
       - name: 'Read nightly channel from rust-toolchain.toml'
         id: toolchain-meta
@@ -142,14 +128,7 @@ jobs:
           submodules: recursive
 
       - name: Install yq
-        run: |
-          set -euo pipefail
-          YQ_VERSION="v4.52.4"
-          mkdir -p "$HOME/.local/bin"
-          wget -qO "$HOME/.local/bin/yq" \
-            "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
-          chmod +x "$HOME/.local/bin/yq"
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+        run: .github/scripts/install-yq.sh
 
       - name: 'Read nightly channel from rust-toolchain.toml'
         id: toolchain-meta