|
| 1 | +name: mdsmith |
| 2 | +description: >- |
| 3 | + Install the mdsmith Markdown linter from a checksum-verified GitHub release |
| 4 | + binary for the runner's OS and architecture, put it on PATH, and optionally |
| 5 | + run a mdsmith command. |
| 6 | +author: jeduden |
| 7 | +branding: |
| 8 | + icon: check-square |
| 9 | + color: purple |
| 10 | + |
| 11 | +inputs: |
| 12 | + version: |
| 13 | + description: >- |
| 14 | + mdsmith release to install: a release tag such as "v0.41.0", or "latest" |
| 15 | + to fetch the most recent release. |
| 16 | + required: false |
| 17 | + default: latest |
| 18 | + args: |
| 19 | + description: >- |
| 20 | + Arguments passed to mdsmith after install, split on whitespace |
| 21 | + (for example "check ."). Leave empty to only put mdsmith on PATH. |
| 22 | + required: false |
| 23 | + default: "" |
| 24 | + working-directory: |
| 25 | + description: Directory the mdsmith command runs in when "args" is set. |
| 26 | + required: false |
| 27 | + default: "." |
| 28 | + |
| 29 | +outputs: |
| 30 | + version: |
| 31 | + description: The version string reported by the installed mdsmith binary. |
| 32 | + value: ${{ steps.install.outputs.version }} |
| 33 | + |
| 34 | +runs: |
| 35 | + using: composite |
| 36 | + steps: |
| 37 | + - id: install |
| 38 | + shell: bash |
| 39 | + # Inputs flow in through env, never interpolated into the script body, |
| 40 | + # so a crafted input cannot inject shell commands. |
| 41 | + env: |
| 42 | + MDSMITH_VERSION: ${{ inputs.version }} |
| 43 | + # The binary is downloaded over HTTPS and SHA256-verified against the |
| 44 | + # release checksums.txt before its directory is appended to PATH, so the |
| 45 | + # github-path write is safe to ignore. |
| 46 | + run: | # zizmor: ignore[github-env] |
| 47 | + set -euo pipefail |
| 48 | +
|
| 49 | + # Map the runner OS/arch onto the published release-asset name. |
| 50 | + case "$RUNNER_OS" in |
| 51 | + Linux) os=linux ; ext="" ;; |
| 52 | + macOS) os=darwin ; ext="" ;; |
| 53 | + Windows) os=windows; ext=".exe" ;; |
| 54 | + *) echo "::error::unsupported runner OS: $RUNNER_OS"; exit 1 ;; |
| 55 | + esac |
| 56 | + case "$RUNNER_ARCH" in |
| 57 | + X64) arch=amd64 ;; |
| 58 | + ARM64) arch=arm64 ;; |
| 59 | + *) echo "::error::unsupported runner arch: $RUNNER_ARCH"; exit 1 ;; |
| 60 | + esac |
| 61 | + if [ "$os" = windows ] && [ "$arch" != amd64 ]; then |
| 62 | + echo "::error::mdsmith ships a windows-amd64 build only, not windows-$arch" |
| 63 | + exit 1 |
| 64 | + fi |
| 65 | + asset="mdsmith-${os}-${arch}${ext}" |
| 66 | +
|
| 67 | + if [ "$MDSMITH_VERSION" = latest ]; then |
| 68 | + base="https://github.com/jeduden/mdsmith/releases/latest/download" |
| 69 | + else |
| 70 | + base="https://github.com/jeduden/mdsmith/releases/download/${MDSMITH_VERSION}" |
| 71 | + fi |
| 72 | +
|
| 73 | + # Normalize the runner temp path's backslashes to forward slashes. |
| 74 | + # Windows runners hand back a backslash path, and GNU coreutils |
| 75 | + # escapes a backslash in a checksummed path by prefixing the hash |
| 76 | + # with one — which would break the comparison below. The |
| 77 | + # forward-slash form also resolves cleanly for the PATH write. |
| 78 | + dest="${RUNNER_TEMP//\\//}/mdsmith-bin" |
| 79 | + mkdir -p "$dest" |
| 80 | + curl -fsSL --retry 3 --retry-delay 2 "${base}/${asset}" -o "${dest}/${asset}" |
| 81 | + curl -fsSL --retry 3 --retry-delay 2 "${base}/checksums.txt" -o "${dest}/checksums.txt" |
| 82 | +
|
| 83 | + # Verify the download against the release checksums file. macOS runners |
| 84 | + # have shasum but not GNU sha256sum, so fall back to it. |
| 85 | + # Pull the expected hash for our asset. Match the filename as the last |
| 86 | + # field, tolerating the binary-mode "*" prefix, and stop at the first |
| 87 | + # match. awk exits 0 even on no match, so the empty check below still |
| 88 | + # runs — a grep | head pipeline would trip pipefail + set -e first and |
| 89 | + # skip the friendly error. |
| 90 | + expected="$(awk -v a="$asset" '{n = $NF; sub(/^\*/, "", n); if (n == a) {print $1; exit}}' "${dest}/checksums.txt")" |
| 91 | + if [ -z "$expected" ]; then |
| 92 | + echo "::error::${asset} not listed in checksums.txt" |
| 93 | + exit 1 |
| 94 | + fi |
| 95 | + if command -v sha256sum >/dev/null 2>&1; then |
| 96 | + actual="$(sha256sum "${dest}/${asset}" | awk '{print $1}')" |
| 97 | + else |
| 98 | + actual="$(shasum -a 256 "${dest}/${asset}" | awk '{print $1}')" |
| 99 | + fi |
| 100 | + if [ "$expected" != "$actual" ]; then |
| 101 | + echo "::error::checksum mismatch for ${asset}: expected ${expected}, got ${actual}" |
| 102 | + exit 1 |
| 103 | + fi |
| 104 | +
|
| 105 | + bin="mdsmith${ext}" |
| 106 | + mv "${dest}/${asset}" "${dest}/${bin}" |
| 107 | + chmod +x "${dest}/${bin}" |
| 108 | + echo "$dest" >> "$GITHUB_PATH" |
| 109 | + # Capture first so a non-zero `mdsmith version` aborts here (set -e) |
| 110 | + # rather than leaving a half-written heredoc in GITHUB_OUTPUT. The |
| 111 | + # heredoc keeps the write correct even if version output ever grows |
| 112 | + # past the single line it prints today. |
| 113 | + ver="$("${dest}/${bin}" version)" |
| 114 | + { |
| 115 | + echo "version<<__MDS_EOF__" |
| 116 | + echo "$ver" |
| 117 | + echo "__MDS_EOF__" |
| 118 | + } >> "$GITHUB_OUTPUT" |
| 119 | +
|
| 120 | + - if: ${{ inputs.args != '' }} |
| 121 | + shell: bash |
| 122 | + working-directory: ${{ inputs.working-directory }} |
| 123 | + env: |
| 124 | + MDSMITH_ARGS: ${{ inputs.args }} |
| 125 | + # MDSMITH_ARGS is intentionally unquoted so the shell word-splits it |
| 126 | + # into separate arguments (and expands any globs), e.g. "check .". |
| 127 | + run: mdsmith $MDSMITH_ARGS |
0 commit comments