Keisuke Maeda 8ca9579834 Add support for pinning tools to a checksum (#1098) ...

Tools in the tools input can now be pinned to a checksum using the
tool:version@sha256:<hash> or tool:version@sha512:<hash> syntax.
The downloaded tool is verified against the checksum on all platforms,
including when it is served from the tools cache, and it is removed
along with its cache entry if the verification fails.

Checksum verification is supported for tools downloaded as phar
archives. Specifying a checksum for tools set up using composer
packages or custom package scripts results in an error.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-07-23 18:15:59 +05:30

..

configs

Fix support for install krb5 on linux using PECL

2026-07-21 01:50:08 +05:30

scripts

Add support for pinning tools to a checksum (#1098)

2026-07-23 18:15:59 +05:30

config.ts

GHSA-pqwm-q9pv-ph8r - Fix CWE-78 [skip ci]

2026-05-14 08:58:36 +05:30

core.ts

Reduce bundle size

2026-01-20 07:47:23 +05:30

coverage.ts

Fix extension logs

2023-01-18 09:00:28 +05:30

extensions.ts

Add support for ionCube for PHP 8.5 [skip ci]

2026-03-13 22:21:20 +05:30

fetch.ts

Refactor to use ES2024+ features for Node 24

2026-01-20 06:46:28 +05:30

install.ts

GHSA-pqwm-q9pv-ph8r - Fix CWE-78 [skip ci]

2026-05-14 08:58:36 +05:30

packagist.ts

Add support to fetch tool versions from packagist

2023-06-12 15:27:46 +05:30

tools.ts

Add support for pinning tools to a checksum (#1098)

2026-07-23 18:15:59 +05:30

utils.ts

Harden environment lookup

2026-05-18 00:56:40 +05:30