Repository navigation
fix(action): pass inputs via env, verify the CLI checksum and fix cli-version docs - #342
Merged
Merged
Conversation
…-version docs Closes #317 Signed-off-by: BryanFRD <bryanferrando59@gmail.com>
![ferrfleet-interne[bot]](https://avatars.githubusercontent.com/in/5311663?s=60&v=4){kind=small}
There was a problem hiding this comment.
Ready to merge. The review approved with no blocking findings. Formal verification failed to run and returned no result, so nothing was verified formally.
The PR passes token, all and names to bash through env instead of ${{ }} interpolation. It verifies the CLI tarball against the .sha256 published next to it. It also extracts only the ferrvault member into a mktemp dir. The cli-version description is corrected.
Findings (none blocking)
- minor,
action/action.yml:111:sha256summay be missing on macOS runners. The action resolvesos=darwinandcli-release.ymlpublishes darwin tarballs. I did not verify whether current GitHub macOS images havesha256sumon PATH. If they don't, every macOS run fails at install. Fix: fall back toshasum -a 256 -c -whensha256sumis absent. - minor,
action/action.yml:90: thelatestprobe does not check that the.sha256asset exists. It picks the highestcli-v*tag with an uploaded tarball. A tag caught between the tarball and checksum uploads, or an older release without checksums, now fails at the secondcurlinstead of falling back to the previous tag. Fix: probe the.tar.gz.sha256URL in the HEAD check too. - suggestion,
action/action.yml:110: the checksum comes from the same release as the binary, so it gives integrity but not authenticity. Anyone who can replace the asset can replace the.sha256. As a follow-up, verify the SLSA attestations thatcli-release.ymlalready produces (gh attestation verify --repo FerrLabs/FerrVault) or pin hashes percli-version.
Formal verification
The step failed and produced no result.
ferrflow Bot
added a commit
that referenced
this pull request
Oct 31, 2026
## [6.1.5] - 2026-10-31 ### Bug Fixes - fix(action): pass inputs via env, verify the CLI checksum and fix cli-version docs (#342)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #317
env:instead of expanding them into the script..sha256before install; extraction happens in a temp dir that is removed on exit.cli-versiondescription now says it defaults to the latestcli-v*release. Pinning the default at release time is left out: it needs a version bump step in the release flow, so say if you want it.