From d83101bb6627225dbbaf968e0ed28cf639e4448a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 14 Jun 2026 07:32:39 +0000
Subject: [PATCH] fix(action): run bundled install.sh at pinned ref instead of
 main

A consumer pinning the action by commit SHA still had the composite action
fetch install.sh from raw.githubusercontent.com/.../main, so a change to
main reached every pinned consumer. The action repo is already checked out
at the pinned ref, so install.sh exists locally at ${{ github.action_path }};
run that copy so the installer script is pinned alongside the action.
---
 action.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/action.yml b/action.yml
index 61d245f..dcd14e2 100644
--- a/action.yml
+++ b/action.yml
@@ -29,7 +29,10 @@ runs:
       env:
         SURF_VERSION: ${{ inputs.version }}
         SURF_INSTALL_DIR: ${{ runner.temp }}/surf-bin
-      run: curl --proto '=https' --tlsv1.2 -fsSL https://raw.githubusercontent.com/Connorrmcd6/surface/main/install.sh | sh
+      # Run the installer bundled at the *pinned* action ref rather than the mutable
+      # main branch, so a SHA-pinned `uses:` also pins the installer script
+      # (defense-in-depth; install.sh already checksum-verifies the download).
+      run: sh "${{ github.action_path }}/install.sh"
     - name: Run surf
       shell: bash
       working-directory: ${{ inputs.working-directory }}