From 0f1874702b5e32eb384e98e10c24016900d841ce Mon Sep 17 00:00:00 2001 From: Matt Johnson-Pint Date: Tue, 1 Sep 2026 08:09:21 -0700 Subject: [PATCH] CI: fail incomplete action pin validation The validation loop runs in a pipeline subshell, so pin mismatches do not affect the final status. Enable lastpipe so status updates remain in the current shell. Empty or invalid GitHub API responses also produce an empty eval command that succeeds. Require successful curl and jq validation instead. --- .ci.ghactions.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.ci.ghactions.sh b/.ci.ghactions.sh index 5ef43ab1e..1fdb96256 100755 --- a/.ci.ghactions.sh +++ b/.ci.ghactions.sh @@ -28,6 +28,9 @@ set -euo pipefail +# Keep the pipeline's while loop in this shell so status updates survive. +shopt -s lastpipe + declare -A seen status=0 @@ -41,8 +44,8 @@ do fi seen["$action-$hash-$tag"]=1 - if eval "$( curl -s -H "Accept: application/vnd.github+json" \ - "https://api.github.com/repos/$action/commits/$tag" | jq -r '.sha == "'"$hash"'"' )" + if curl --fail --silent --show-error -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/$action/commits/$tag" | jq -e --arg hash "$hash" '.sha == $hash' >/dev/null then printf "\e[1;32m%s: %s@%s == %s\e[m\n" "$w" "$action" "$tag" "$hash" else