rasterstate/sccache-action
2
0
Fork 0
Code Issues 4 Pull requests Releases 1 Activity Actions

Download hardening: sha256 pin + mirror base URL + Forgejo namespace note #7

Merged
stephen merged 1 commit from feat/download-hardening into main 2026-06-23 21:00:03 +00:00
Conversation 0 Commits 1 Files changed 5 +173 -27
stephen commented 2026-06-23 20:47:21 +00:00
Owner
Copy link

Closes #5, #6, #3.

Why: sccache-action trusted the run-time-fetched sidecar and hardcoded the GitHub release origin, blocking air-gapped runners and weakening reproducibility.

  • Optional sha256 input: when set, the downloaded tarball is compared against it and fails closed on mismatch (#6). Unset keeps sidecar-verified behavior.
  • Optional download-base-url input: fetch tarball + .sha256 sidecar from an internal mirror, checksum still enforced (#5). Unset keeps the GitHub origin.
  • README note: self-test actions/checkout@v6 needs the Forgejo actions/ namespace mirror or the full-URL form (#3). Consumers unaffected.
  • SECURITY.md updated.

Testing: tests/run.sh (incl. digest-mismatch path). Defaults preserve current behavior.

DO NOT MERGE: lead/operator review.

Closes #5, #6, #3. Why: sccache-action trusted the run-time-fetched sidecar and hardcoded the GitHub release origin, blocking air-gapped runners and weakening reproducibility. - Optional `sha256` input: when set, the downloaded tarball is compared against it and fails closed on mismatch (#6). Unset keeps sidecar-verified behavior. - Optional `download-base-url` input: fetch tarball + .sha256 sidecar from an internal mirror, checksum still enforced (#5). Unset keeps the GitHub origin. - README note: self-test `actions/checkout@v6` needs the Forgejo actions/ namespace mirror or the full-URL form (#3). Consumers unaffected. - SECURITY.md updated. Testing: tests/run.sh (incl. digest-mismatch path). Defaults preserve current behavior. DO NOT MERGE: lead/operator review.
Harden sccache downloads
All checks were successful
test / integration (pull_request) Successful in 26s
Details
test / unit (pull_request) Successful in 29s
Details
test / install (v0.14.0) (pull_request) Successful in 6s
Details
test / install (v0.15.0) (pull_request) Successful in 5s
Details
test / install-without-v-prefix (pull_request) Successful in 5s
Details
test / reinstall-on-version-change (pull_request) Successful in 6s
Details
d0b2814bde
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
blocked:upstream
Waiting on upstream sccache

  
ci
Test workflow / runners

  
converted
Converted into tracked work

  
docs
Documentation

  
enhancement
New feature or input

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

  
security
Supply-chain / verification

No labels
backlog
blocked
blocked:upstream
ci
converted
docs
enhancement
opportunity
p1
p2
p3
parked
security
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rasterstate/sccache-action!7
No description provided.