Skip to content

feat: add gitignore-version input for binary version override#103

Open
kitsuyui wants to merge 1 commit into
mainfrom
fix/audit-action-surface-inconsistent-and-undocumented-001
Open

feat: add gitignore-version input for binary version override#103
kitsuyui wants to merge 1 commit into
mainfrom
fix/audit-action-surface-inconsistent-and-undocumented-001

Conversation

@kitsuyui

Copy link
Copy Markdown
Member

Summary

Previously the gitignore-in binary version was hardcoded inside the shell
step with no way for callers to override it. Users who wanted to test a
different binary version had to fork the action or pin to a specific SHA.

This PR adds a gitignore-version input (default: v0.2.1) that allows
callers to specify which binary release to download. When the value matches
the bundled version, SHA-256 integrity is verified as before using
bundled-binary.sha256. For any other value a GitHub Actions warning is
emitted and verification is skipped (intentional trade-off for pre-release
testing).

Changes

  • action.yml: add gitignore-version input; pass version through an env:
    variable to avoid expression injection; add conditional SHA-256 check
  • README.md: document the new input; add a naming-convention note explaining
    the current snake_case / kebab-case split between existing inputs and
    outputs, pointing to planned normalisation in a future major release

Verification

  • actionlint: no findings
  • Collateral check: clean (no gha-inline-script, version-shrink, or
    too-many-files violations)
  • No existing callers are affected; the default value preserves current behaviour

Previously the bundled gitignore-in binary version was hardcoded in the
shell step with no way for callers to override it. This prevented testing
pre-release binaries without forking the action.

Add a gitignore-version input (kebab-case, aligning with existing outputs)
with default v0.2.1. When the value matches the bundled version, SHA-256
integrity is verified as before. For any other value a GitHub Actions
warning is emitted and verification is skipped.

The README inputs table is extended with the new input and a naming-
convention note explaining the snake_case / kebab-case split between
existing inputs and outputs, with a pointer to the planned normalisation
in a future major release.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant