I've been reviewing the changeset between v3.6.1...v4.0.0 in preparation for moving sphinx-doc/sphinx#14395 out of draft pull request status and into ready status.
A significant chunk of the changes seem related to checksum/integrity checking, and I think those generally follow good practices.
One thing I did notice is that although @actions/tool-cache, used as a dependency to download artifacts, doesn't itself support checksum-verification yet, there is a feature request open to add that -- and I thought it'd be worth letting you know in case that might allow simplifying the code here in future: actions/toolkit#427
I've been reviewing the changeset between
v3.6.1...v4.0.0in preparation for moving sphinx-doc/sphinx#14395 out of draft pull request status and into ready status.A significant chunk of the changes seem related to checksum/integrity checking, and I think those generally follow good practices.
One thing I did notice is that although
@actions/tool-cache, used as a dependency to download artifacts, doesn't itself support checksum-verification yet, there is a feature request open to add that -- and I thought it'd be worth letting you know in case that might allow simplifying the code here in future: actions/toolkit#427