fix(action): run bundled install.sh at pinned ref instead of main#118
Merged
Connorrmcd6 merged 1 commit intoJun 14, 2026
Merged
Conversation
A consumer pinning the action by commit SHA still had the composite action
fetch install.sh from raw.githubusercontent.com/.../main, so a change to
main reached every pinned consumer. The action repo is already checked out
at the pinned ref, so install.sh exists locally at ${{ github.action_path }};
run that copy so the installer script is pinned alongside the action.
Connorrmcd6
approved these changes
Jun 14, 2026
Connorrmcd6
left a comment
Connorrmcd6
left a comment
Owner
There was a problem hiding this comment.
Thanks for the contribution! LGTM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The composite
action.ymlinstalledsurfby piping the installer from themainbranch:This PR runs the copy of
install.shbundled at the pinned action ref instead:Why
A consumer who pins the action to an immutable commit SHA for supply-chain reasons —
— still had the installer script fetched from
mainat run time. A change (or compromise) ofmaintherefore reached every pinned consumer, so the SHA pin did not actually pin what runs.(The old line also fetched cross-repo from
Connorrmcd6/surface, decoupling the installer fromthe action ref entirely.)
Because the action repository is already checked out at the pinned ref when the composite action
runs,
install.shexists locally at${{ github.action_path }}. Running that copy pins theinstaller to the same ref as the action.
Behavior
No change for
latestconsumers — the env-drivenSURF_VERSION/SURF_INSTALL_DIRflow isunchanged. This is defense-in-depth:
install.shalready checksum-verifies the download(fail-closed), and this closes the remaining gap by pinning the installer script itself.