Skip to content

fix: install pinned tools into a runner-writable path #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rldyourmnd merged 2 commits into from
Aug 1, 2026
Merged

fix: install pinned tools into a runner-writable path #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eb7c334
fix: install pinned tools into a runner-writable path
rldyourmnd Aug 1, 2026
cacca98
chore(catalog): re-prove actionlint runtime coverage after the instal…
rldyourmnd Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions .github/workflows/actionlint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,8 +80,13 @@ jobs:
"https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
echo "${ACTIONLINT_SHA256} /tmp/actionlint.tar.gz" | sha256sum -c -
tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint
install -m 0755 /tmp/actionlint /usr/local/bin/actionlint
actionlint --version
# Install into a runner-writable directory rather than /usr/local/bin:
# GitHub-hosted runners let the job user write there, self-hosted ones
# normally do not, and a correctly isolated self-hosted runner must not.
mkdir -p "${RUNNER_TEMP}/bin"
install -m 0755 /tmp/actionlint "${RUNNER_TEMP}/bin/actionlint"
echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"
"${RUNNER_TEMP}/bin/actionlint" --version

- name: Run actionlint
run: actionlint -color
Expand Down
9 changes: 7 additions & 2 deletions .github/workflows/osv-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,8 +59,13 @@ jobs:
curl -fsSL -o /tmp/osv-scanner \
"https://github.com/google/osv-scanner/releases/download/v${OSV_VERSION}/osv-scanner_linux_amd64"
echo "${OSV_SHA256} /tmp/osv-scanner" | sha256sum -c -
install -m 0755 /tmp/osv-scanner /usr/local/bin/osv-scanner
osv-scanner --version
# Install into a runner-writable directory rather than /usr/local/bin:
# GitHub-hosted runners let the job user write there, self-hosted ones
# normally do not, and a correctly isolated self-hosted runner must not.
mkdir -p "${RUNNER_TEMP}/bin"
install -m 0755 /tmp/osv-scanner "${RUNNER_TEMP}/bin/osv-scanner"
echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"
"${RUNNER_TEMP}/bin/osv-scanner" --version

- name: OSV scan
env:
Expand Down
4 changes: 2 additions & 2 deletions catalog/runtime-coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ entries:
- workflow: .github/workflows/actionlint.yml
status: runtime-proven
evidence: "Called by this repo's ci.yml on every run; Linux X64 default-input lane executed live."
last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/30243258297
proven_digest: 116c4af8c18861a7c94000e277c3a4e9f1d158bcfbda02a7e6510dfc9d9cf8ff
last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/30701697106
proven_digest: f946862cfe522cb62920aa104716b331b9f35210a9181ce5954879ccb48ce1df
waiver: null
- workflow: .github/workflows/benchmark-compare.yml
status: static-only
Expand Down
Loading