fix: verify ORAS download checksum - #4

Merged

gpapakyriakopoulos merged 1 commit into

mainfrom

codex/pin-oras-checksum

Jul 9, 2026

gpapakyriakopoulos commented Jul 9, 2026

Contributor

Summary

pin the ORAS v1.2.3 linux_amd64 release tarball SHA-256
verify the downloaded ORAS archive before extracting and adding it to PATH
rebuild dist/main for the JavaScript action bundle

Verification

npm ci --cache /private/tmp/npm-cache-oras-pin
git diff --check


          fix: verify ORAS download checksum

2235a34

gpapakyriakopoulos merged commit 52950e4 into main

2 checks passed

gpapakyriakopoulos deleted the codex/pin-oras-checksum branch

July 9, 2026 09:55

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet