webgrip/infrastructure
5
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases 102 Packages Wiki Activity Actions

fix(act-runner): pin act and verify the download #108

Merged
ryangr0 merged 1 commit from fix/act-runner-pin-act into main 2026-08-08 13:16:46 +00:00
Conversation 0 Commits 1 Files changed 1 +15 -6
ryangr0 commented 2026-08-08 06:32:12 +00:00
Owner
Copy link

ACT_VERSION=latest meant the image contents were decided by whenever the build happened to run, and curl | bash of master's install.sh trusted the CDN and whatever commit was HEAD that day — for a binary whose job is executing workflows.

Now: pinned release artifact (v0.2.89, what latest resolves to today), published checksum verified before install — same pattern as ci-runner's helm/yq (#88). Renovate moves the version; a bump without its checksum fails the build rather than shipping unverified.

Generated with Claude Code

ACT_VERSION=latest meant the image contents were decided by whenever the build happened to run, and `curl | bash` of master's install.sh trusted the CDN and whatever commit was HEAD that day — for a binary whose job is executing workflows. Now: pinned release artifact (v0.2.89, what latest resolves to today), published checksum verified before install — same pattern as ci-runner's helm/yq (#88). Renovate moves the version; a bump without its checksum fails the build rather than shipping unverified. Generated with [Claude Code](https://claude.com/claude-code)
fix(act-runner): pin act and verify the download
All checks were successful
[Workflow] On Source Change / Guard: per-image .releaserc.cjs present (push) Successful in 3s
Details
[Workflow] On Source Change / Determine Changed Directories (push) Successful in 1m10s
Details
[Workflow] On Source Change / Determine changed images (push) Successful in 0s
Details
[Workflow] On Source Change / Resolve release matrix (push) Successful in 1m17s
Details
[Workflow] On Source Change / Build check (act-runner, ops/docker/act-runner) (push) Successful in 1m57s
Details
[Workflow] On Source Change / Release (act-runner, ops/docker/act-runner) (push) Has been skipped
Details
5c2d1d0677 
ACT_VERSION=latest meant the image contents were decided by whenever the build
happened to run, and 'curl | bash' of master's install.sh trusted the CDN and
whatever commit was HEAD that day — for a binary whose job is executing
workflows. Now: pinned release artifact, published checksum verified before
install, same pattern as ci-runner's helm/yq (#88). Renovate moves the
version; a bump without its checksum fails the build rather than shipping
unverified.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

  
released
No labels
pull-request
released
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/infrastructure!108
No description provided.