rasterstate/sccache-action
2
0
Fork 0
Code Issues 5 Pull requests Releases 1 Activity Actions

Mirror / override download URL input for air-gapped runners #5

New issue
Open
opened 2026-05-28 02:56:25 +00:00 by stephen · 0 comments
stephen commented 2026-05-28 02:56:25 +00:00
Owner
Copy link

The action hardcodes https://github.com/mozilla/sccache/releases/download/... as the download origin. Air-gapped or egress-restricted runners can't reach GitHub.

Add an input (e.g. download-base-url) so operators can point at an internal mirror that serves the tarball and the .sha256 sidecar with the same filenames. Keep checksum verification on against the mirrored sidecar.

Tracked in SECURITY.md under "What is not done yet".

The action hardcodes `https://github.com/mozilla/sccache/releases/download/...` as the download origin. Air-gapped or egress-restricted runners can't reach GitHub. Add an input (e.g. `download-base-url`) so operators can point at an internal mirror that serves the tarball and the `.sha256` sidecar with the same filenames. Keep checksum verification on against the mirrored sidecar. Tracked in SECURITY.md under "What is not done yet".
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
v1
v1.1.2
v1.1.1
v1.1.0
v1.0.0
Labels
Clear labels   
blocked:upstream
Waiting on upstream sccache

  
ci
Test workflow / runners

  
docs
Documentation

  
enhancement
New feature or input

  
security
Supply-chain / verification

No labels
blocked:upstream
ci
docs
enhancement
security
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rasterstate/sccache-action#5
No description provided.