[ci] Download fnm directly from GitHub releases and validate checksum

Author: bgw

.github/workflows/build_reusable.yml

@@ -172,24 +172,38 @@ jobs:
           git config --global core.eol lf
         shell: bash
 
-      - name: Check if fnm is installed
-        id: check-fnm
-        run: |
-          if [ -x "$(command -v fnm)" ]; then
-            echo "fnm found."
-            echo "found=true" >> $GITHUB_OUTPUT
-          else
-            echo "fnm not found."
-            echo "found=false" >> $GITHUB_OUTPUT
-          fi
-
       - name: Install fnm
-        if: steps.check-fnm.outputs.found != 'true'
         run: |
-          export FNM_DIR="${HOME}/.local/share/fnm"
-          curl -fsSL https://fnm.vercel.app/install | bash
+          FNM_VERSION=v1.39.0
+          FNM_DIR="$HOME/.local/share/fnm"
+
+          case "$RUNNER_OS" in
+            Linux)
+              FNM_ASSET=fnm-linux.zip
+              FNM_SHA256=7807664f39d39fc518da1c35ba0181e4b3267603c4b1dedeb4b5fc6ae440a224
+              FNM_EXE=fnm
+              ;;
+            Windows)
+              FNM_ASSET=fnm-windows.zip
+              FNM_SHA256=8183bed4348cb78fdfd8abb3d1247fbeab7b2082f941363929c61e747c001e10
+              FNM_EXE=fnm.exe
+              ;;
+            *)
+              echo "::error::Unsupported RUNNER_OS: $RUNNER_OS"
+              exit 1
+              ;;
+          esac
+          FNM_BIN="$FNM_DIR/$FNM_EXE"
           export PATH="$FNM_DIR:$PATH"
           echo "$FNM_DIR" >> $GITHUB_PATH
+
+          curl -L --fail --retry 3 -o /tmp/fnm.zip \
+            "https://github.com/Schniz/fnm/releases/download/$FNM_VERSION/$FNM_ASSET"
+          echo "$FNM_SHA256  /tmp/fnm.zip" | sha256sum --check --status
+          unzip /tmp/fnm.zip "$FNM_EXE" -d "$FNM_DIR"
+          rm /tmp/fnm.zip
+          chmod +x "$FNM_BIN"
+
           fnm env --json | jq -r 'to_entries|map("\(.key)=\(.value|tostring)")|.[]' | xargs -I {} echo "{}" >> $GITHUB_ENV
 
       - name: Normalize input step names into path key