Commit activity
Last 12 weeks · 1 commit
Community health
4 of 6 standards met
75
✓README✓License✓Contributing✓Code of Conduct○Issue Template○PR Template
Recent PRs & issues
Quiet · 3 in progress · Last activity 2mo ago
See all on GitHub →
Summary Add an optional input that defaults to . Resolve pinned installs through the GitHub releases API while preserving the existing latest-release path. Document the release-tag pinning syntax in the README. Fixes #10. Validation YAML parse check confirmed . Resolved release metadata against the real GitHub API: , , expected digest found , expected digest found Downloaded , verified SHA-256 , extracted , and confirmed prints .
Summary: resolve the selected DotSlash release asset's browser_download_url from the GitHub release API response keep using the selected asset metadata for digest verification download the archive from the API-provided asset URL instead of hand-constructing the release download URL Fixes #11 Validation: parsed the latest facebook/dotslash release metadata for linux x64, linux arm64, macOS, and Windows assets downloaded the Windows asset through the resolved browser_download_url and verified its sha256 digest extracted the Windows archive and ran () parsed with Ruby YAML
Fixes #13. This updates the composite action to verify the downloaded dotslash release asset before extracting it: fetches the latest release metadata once during configuration selects the digest for the platform-specific asset from the GitHub Releases API computes the downloaded archive SHA-256 using Node crypto fails before extraction if the expected and actual digests differ Validation: ruby -e 'require "yaml"; YAML.load_file("action.yml"); puts "ok"' git diff --check curl -fsS https://api.github.com/repos/facebook/dotslash/releases/latest
Recent fixes
After we do #11, we should consider validating the digest (which is computed automatically now).
Summary Resolve the selected DotSlash release asset name and GitHub-provided digest from the latest release metadata. Download the resolved asset by name and verify the tarball SHA-256 before extracting it. Keep the verification portable by using when available and falling back to . Fixes #13. Testing Parsed the latest release metadata locally for all action platform names: , , , and . Downloaded and verified it against its GitHub release digest with the new checksum path. Parsed with PyYAML.
This PR addresses #12 by enabling CI testing on ARM64 architectures for Linux and macOS. Added and to the test matrix. I also switched to an strategy to keep the job names cleaner in the dashboard. Tested on my fork: x64 and macOS ARM are passing. Linux ARM is just pending a runner on my personal account, but the config is ready.
Structured data for AI agents
Repository: facebook/install-dotslash. Description: A simple GitHub Action to install a precompiled dotslash binary Stars: 5, Forks: 10. License: MIT. Latest release: v2 (2y ago). Open PRs: 3, open issues: 4. Last activity: 2mo ago. Community health: 75%. Top contributors: bigfootjon, dtolnay, zertosh, WilliamK112, DenisMal00.