Repository navigation
ci: direct download tools with SHA256 verification - #5
Merged
Merged
Conversation
Replace install-action + cargo-binstall with direct downloads of cargo-nextest and cargo-audit from their GitHub releases. Each archive is verified against a pinned SHA256 checksum before extraction. Eliminates install-action and cargo-binstall from the CI supply chain. Trust chain: GitHub release artifact → SHA256 verify → extract to PATH. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update release.yml template with: - Shared ci-gate job that waits for CI before publishing - publish-binaries job template using upload-rust-binary-action - Quiet gh run watch (stdout suppressed) - All commented out as TODOs for project customization Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add --strip-components=1 to cargo-audit tar extraction. The release tarball has a nested directory structure, so without this flag the binary lands in a subdirectory instead of on PATH. - Change cancel-in-progress to only cancel PR runs. Pushes to main must run to completion or release.yml's ci-gate will fail to find a passing CI run for the release commit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add --event=push to ci-gate gh run list to avoid matching PR runs - Add fail-fast: false to publish-binaries matrix template Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Upgrade action to main@8bb7a2ed (release-please 17.3.0) for force-tag-creation support - Add draft: true and force-tag-creation: true to config - Add issues: write permission for label operations - Add publish-release job template (undrafts after asset uploads) - Update TODO comments to explain the draft release flow The draft flow is required for repos with immutable release rules: draft release → upload assets → publish. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
butterflysky
approved these changes
Mar 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
taiki-e/install-action+cargo-binstallwith directcurldownloads of cargo-nextest and cargo-audit from their GitHub releasesTrust chain: GitHub release artifact → SHA256 verify → extract to PATH.
Ports the same approach from butterflyskies/pali#21.
Tool versions pinned
Test plan
🤖 Generated with Claude Code