feat : add checksum verification input#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vmaerten merged 1 commit into from
Aug 3, 2026
Merged

feat : add checksum verification input #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -35,6 +35,10 @@ Can be an exact version (e.g., `3.4.2`) or a version range (e.g., `3.x`).

**Default**: [`GITHUB_TOKEN`](https://docs.github.com/actions/security-guides/automatic-token-authentication)

### `checksum`

Expected SHA256 checksum of the downloaded Task archive.

## Usage

To get the action's default version of Task just add this step:
Expand Down
3 changes: 3 additions & 0 deletions action.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -17,6 +17,9 @@ inputs:
description: "Maximum number of retry attempts for HTTP requests"
required: false
default: "3"
checksum:
description: "Expected SHA256 checksum of the downloaded Task archive"
required: false

runs:
using: "node24"
Expand Down
35 changes: 29 additions & 6 deletions dist/index.js
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -33714,6 +33714,10 @@ const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import
const external_node_path_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
// EXTERNAL MODULE: external "node:util"
var external_node_util_ = __nccwpck_require__(7975);
// EXTERNAL MODULE: external "node:crypto"
var external_node_crypto_ = __nccwpck_require__(7598);
;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs");
// EXTERNAL MODULE: ./node_modules/semver/index.js
var node_modules_semver = __nccwpck_require__(2088);
;// CONCATENATED MODULE: ./node_modules/@actions/tool-cache/lib/manifest.js
Expand DownExpand Up@@ -34534,6 +34538,8 @@ function _unique(values) {





const osPlat = (0,external_node_os_namespaceObject.platform)();
const osArch = (0,external_node_os_namespaceObject.arch)();
// Retrieve a list of versions scraping tags from the Github API
Expand DownExpand Up@@ -34623,11 +34629,26 @@ function getFileName() {
const filename = (0,external_node_util_.format)("task_%s_%s.%s", taskPlatform, taskArch, ext);
return filename;
}
async function downloadRelease(version) {
function verifyChecksum(path, expectedChecksum) {
if (!expectedChecksum) {
return;
}
const normalizedExpected = expectedChecksum.trim().toLowerCase();
if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
throw new Error("The checksum input must be a SHA256 hex digest.");
}
const actualChecksum = (0,external_node_crypto_.createHash)("sha256")
.update((0,external_node_fs_namespaceObject.readFileSync)(path))
.digest("hex");
if (actualChecksum !== normalizedExpected) {
throw new Error(`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`);
}
}
async function downloadRelease(version, checksum) {
// Download
const fileName = getFileName();
const downloadUrl = (0,external_node_util_.format)("https://github.com/go-task/task/releases/download/%s/%s", version, fileName);
let downloadPath = null;
let downloadPath = "";
try {
downloadPath = await downloadTool(downloadUrl);
}
Expand All@@ -34637,8 +34658,9 @@ async function downloadRelease(version) {
}
throw new Error(`Failed to download version ${version}: ${error}`);
}
verifyChecksum(downloadPath, checksum);
// Extract
let extPath = null;
let extPath = "";
if (osPlat === "win32") {
extPath = await extractZip(downloadPath);
// Create a bin/ folder and move `task` there
Expand All@@ -34654,15 +34676,15 @@ async function downloadRelease(version) {
// Install into the local tool cache - node extracts with a root folder that matches the fileName downloaded
return cacheDir(extPath, "task", version);
}
async function getTask(version, repoToken, maxRetries = 3) {
async function getTask(version, repoToken, maxRetries = 3, checksum) {
// resolve the version number
const targetVersion = await computeVersion(version, repoToken, maxRetries);
// look if the binary is cached
let toolPath;
toolPath = find("task", targetVersion);
// if not: download, extract and cache
if (!toolPath) {
toolPath = await downloadRelease(targetVersion);
toolPath = await downloadRelease(targetVersion, checksum);
core_debug(`Task cached under ${toolPath}`);
}
toolPath = (0,external_node_path_namespaceObject.join)(toolPath, "bin");
Expand All@@ -34689,7 +34711,8 @@ async function run() {
const version = getInput("version", { required: true });
const repoToken = getInput("repo-token");
const maxRetries = parseInt(getInput("max-retries") || "3", 10);
await getTask(version, repoToken, maxRetries);
const checksum = getInput("checksum");
await getTask(version, repoToken, maxRetries, checksum || undefined);
}
catch (error) {
if (error instanceof Error) {
Expand Down
41 changes: 36 additions & 5 deletions src/installer.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,8 @@
import { arch, platform } from "node:os";
import { join } from "node:path";
import { format } from "node:util";
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { HttpClient } from "@actions/http-client";
import { rcompare, valid } from "semver";
import { addPath, debug, info } from "@actions/core";
Expand DownExpand Up@@ -142,15 +144,38 @@ function getFileName() {
return filename;
}

async function downloadRelease(version: string): Promise<string> {
function verifyChecksum(path: string, expectedChecksum?: string): void {
if (!expectedChecksum) {
return;
}

const normalizedExpected = expectedChecksum.trim().toLowerCase();
if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
throw new Error("The checksum input must be a SHA256 hex digest.");
}

const actualChecksum = createHash("sha256")
.update(readFileSync(path))
.digest("hex");
if (actualChecksum !== normalizedExpected) {
throw new Error(
`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
);
}
}

async function downloadRelease(
version: string,
checksum?: string,
): Promise<string> {
// Download
const fileName: string = getFileName();
const downloadUrl: string = format(
"https://github.com/go-task/task/releases/download/%s/%s",
version,
fileName,
);
let downloadPath: string | null = null;
let downloadPath = "";
try {
downloadPath = await downloadTool(downloadUrl);
} catch (error) {
Expand All@@ -159,9 +184,10 @@ async function downloadRelease(version: string): Promise<string> {
}
throw new Error(`Failed to download version ${version}: ${error}`);
}
verifyChecksum(downloadPath, checksum);

// Extract
let extPath: string | null = null;
let extPath = "";
if (osPlat === "win32") {
extPath = await extractZip(downloadPath);
// Create a bin/ folder and move `task` there
Expand All@@ -178,7 +204,12 @@ async function downloadRelease(version: string): Promise<string> {
return cacheDir(extPath, "task", version);
}

export async function getTask(version: string, repoToken: string, maxRetries: number = 3) {
export async function getTask(
version: string,
repoToken: string,
maxRetries: number = 3,
checksum?: string,
) {
// resolve the version number
const targetVersion = await computeVersion(version, repoToken, maxRetries);

Expand All@@ -188,7 +219,7 @@ export async function getTask(version: string, repoToken: string, maxRetries: nu

// if not: download, extract and cache
if (!toolPath) {
toolPath = await downloadRelease(targetVersion);
toolPath = await downloadRelease(targetVersion, checksum);
debug(`Task cached under ${toolPath}`);
}

Expand Down
3 changes: 2 additions & 1 deletion src/main.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,9 @@ async function run() {
const version = getInput("version", { required: true });
const repoToken = getInput("repo-token");
const maxRetries = parseInt(getInput("max-retries") || "3", 10);
const checksum = getInput("checksum");

await getTask(version, repoToken, maxRetries);
await getTask(version, repoToken, maxRetries, checksum || undefined);
} catch (error) {
if (error instanceof Error) {
setFailed(error.message);
Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat : add checksum verification input#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

vmaerten
merged 1 commit into

from

Aug 3, 2026
 Merged


feat : add checksum verification input
#16
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,6 +35,10 @@ Can be an exact version (e.g., `3.4.2`) or a version range (e.g., `3.x`).

**Default**: [`GITHUB_TOKEN`](https://docs.github.com/actions/security-guides/automatic-token-authentication)

### `checksum`

Expected SHA256 checksum of the downloaded Task archive.

## Usage

To get the action's default version of Task just add this step:
Expand Down

3 changes: 3 additions & 0 deletions
action.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -17,6 +17,9 @@ inputs:
 description: "Maximum number of retry attempts for HTTP requests"
 required: false
 default: "3"
 checksum:
 description: "Expected SHA256 checksum of the downloaded Task archive"
 required: false

runs:
 using: "node24"
Expand Down

35 changes: 29 additions & 6 deletions
dist/index.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33714,6 +33714,10 @@ const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import
const external_node_path_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
// EXTERNAL MODULE: external "node:util"
var external_node_util_ = __nccwpck_require__(7975);
// EXTERNAL MODULE: external "node:crypto"
var external_node_crypto_ = __nccwpck_require__(7598);
;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs");
// EXTERNAL MODULE: ./node_modules/semver/index.js
var node_modules_semver = __nccwpck_require__(2088);
;// CONCATENATED MODULE: ./node_modules/@actions/tool-cache/lib/manifest.js
Expand DownExpand Up@@ -34534,6 +34538,8 @@ function _unique(values) {





const osPlat = (0,external_node_os_namespaceObject.platform)();
const osArch = (0,external_node_os_namespaceObject.arch)();
// Retrieve a list of versions scraping tags from the Github API
Expand DownExpand Up@@ -34623,11 +34629,26 @@ function getFileName() {
 const filename = (0,external_node_util_.format)("task_%s_%s.%s", taskPlatform, taskArch, ext);
 return filename;
}
async function downloadRelease(version) {
function verifyChecksum(path, expectedChecksum) {
 if (!expectedChecksum) {
 return;
 }
 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }
 const actualChecksum = (0,external_node_crypto_.createHash)("sha256")
 .update((0,external_node_fs_namespaceObject.readFileSync)(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`);
 }
}
async function downloadRelease(version, checksum) {
 // Download
 const fileName = getFileName();
 const downloadUrl = (0,external_node_util_.format)("https://github.com/go-task/task/releases/download/%s/%s", version, fileName);
 let downloadPath = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 }
Expand All@@ -34637,8 +34658,9 @@ async function downloadRelease(version) {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);
 // Extract
 let extPath = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -34654,15 +34676,15 @@ async function downloadRelease(version) {
 // Install into the local tool cache - node extracts with a root folder that matches the fileName downloaded
 return cacheDir(extPath, "task", version);
}
async function getTask(version, repoToken, maxRetries = 3) {
async function getTask(version, repoToken, maxRetries = 3, checksum) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);
 // look if the binary is cached
 let toolPath;
 toolPath = find("task", targetVersion);
 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 core_debug(`Task cached under ${toolPath}`);
 }
 toolPath = (0,external_node_path_namespaceObject.join)(toolPath, "bin");
Expand All@@ -34689,7 +34711,8 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 await getTask(version, repoToken, maxRetries);
 const checksum = getInput("checksum");
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 }
 catch (error) {
 if (error instanceof Error) {
Expand Down

41 changes: 36 additions & 5 deletions
src/installer.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,8 @@
import { arch, platform } from "node:os";
import { join } from "node:path";
import { format } from "node:util";
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { HttpClient } from "@actions/http-client";
import { rcompare, valid } from "semver";
import { addPath, debug, info } from "@actions/core";
Expand DownExpand Up@@ -142,15 +144,38 @@ function getFileName() {
 return filename;
}

async function downloadRelease(version: string): Promise<string> {
function verifyChecksum(path: string, expectedChecksum?: string): void {
 if (!expectedChecksum) {
 return;
 }

 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }

 const actualChecksum = createHash("sha256")
 .update(readFileSync(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(
 `Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
 );
 }
}

async function downloadRelease(
 version: string,
 checksum?: string,
): Promise<string> {
 // Download
 const fileName: string = getFileName();
 const downloadUrl: string = format(
 "https://github.com/go-task/task/releases/download/%s/%s",
 version,
 fileName,
 );
 let downloadPath: string | null = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 } catch (error) {
Expand All@@ -159,9 +184,10 @@ async function downloadRelease(version: string): Promise<string> {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);

 // Extract
 let extPath: string | null = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -178,7 +204,12 @@ async function downloadRelease(version: string): Promise<string> {
 return cacheDir(extPath, "task", version);
}

export async function getTask(version: string, repoToken: string, maxRetries: number = 3) {
export async function getTask(
 version: string,
 repoToken: string,
 maxRetries: number = 3,
 checksum?: string,
) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);

Expand All@@ -188,7 +219,7 @@ export async function getTask(version: string, repoToken: string, maxRetries: nu

 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 debug(`Task cached under ${toolPath}`);
 }

Expand Down

3 changes: 2 additions & 1 deletion
src/main.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,9 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 const checksum = getInput("checksum");

 await getTask(version, repoToken, maxRetries);
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 } catch (error) {
 if (error instanceof Error) {
 setFailed(error.message);
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat : add checksum verification input#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

vmaerten
merged 1 commit into

from

Aug 3, 2026
 Merged


feat : add checksum verification input
#16
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,6 +35,10 @@ Can be an exact version (e.g., `3.4.2`) or a version range (e.g., `3.x`).

**Default**: [`GITHUB_TOKEN`](https://docs.github.com/actions/security-guides/automatic-token-authentication)

### `checksum`

Expected SHA256 checksum of the downloaded Task archive.

## Usage

To get the action's default version of Task just add this step:
Expand Down

3 changes: 3 additions & 0 deletions
action.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -17,6 +17,9 @@ inputs:
 description: "Maximum number of retry attempts for HTTP requests"
 required: false
 default: "3"
 checksum:
 description: "Expected SHA256 checksum of the downloaded Task archive"
 required: false

runs:
 using: "node24"
Expand Down

35 changes: 29 additions & 6 deletions
dist/index.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33714,6 +33714,10 @@ const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import
const external_node_path_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
// EXTERNAL MODULE: external "node:util"
var external_node_util_ = __nccwpck_require__(7975);
// EXTERNAL MODULE: external "node:crypto"
var external_node_crypto_ = __nccwpck_require__(7598);
;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs");
// EXTERNAL MODULE: ./node_modules/semver/index.js
var node_modules_semver = __nccwpck_require__(2088);
;// CONCATENATED MODULE: ./node_modules/@actions/tool-cache/lib/manifest.js
Expand DownExpand Up@@ -34534,6 +34538,8 @@ function _unique(values) {





const osPlat = (0,external_node_os_namespaceObject.platform)();
const osArch = (0,external_node_os_namespaceObject.arch)();
// Retrieve a list of versions scraping tags from the Github API
Expand DownExpand Up@@ -34623,11 +34629,26 @@ function getFileName() {
 const filename = (0,external_node_util_.format)("task_%s_%s.%s", taskPlatform, taskArch, ext);
 return filename;
}
async function downloadRelease(version) {
function verifyChecksum(path, expectedChecksum) {
 if (!expectedChecksum) {
 return;
 }
 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }
 const actualChecksum = (0,external_node_crypto_.createHash)("sha256")
 .update((0,external_node_fs_namespaceObject.readFileSync)(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`);
 }
}
async function downloadRelease(version, checksum) {
 // Download
 const fileName = getFileName();
 const downloadUrl = (0,external_node_util_.format)("https://github.com/go-task/task/releases/download/%s/%s", version, fileName);
 let downloadPath = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 }
Expand All@@ -34637,8 +34658,9 @@ async function downloadRelease(version) {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);
 // Extract
 let extPath = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -34654,15 +34676,15 @@ async function downloadRelease(version) {
 // Install into the local tool cache - node extracts with a root folder that matches the fileName downloaded
 return cacheDir(extPath, "task", version);
}
async function getTask(version, repoToken, maxRetries = 3) {
async function getTask(version, repoToken, maxRetries = 3, checksum) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);
 // look if the binary is cached
 let toolPath;
 toolPath = find("task", targetVersion);
 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 core_debug(`Task cached under ${toolPath}`);
 }
 toolPath = (0,external_node_path_namespaceObject.join)(toolPath, "bin");
Expand All@@ -34689,7 +34711,8 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 await getTask(version, repoToken, maxRetries);
 const checksum = getInput("checksum");
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 }
 catch (error) {
 if (error instanceof Error) {
Expand Down

41 changes: 36 additions & 5 deletions
src/installer.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,8 @@
import { arch, platform } from "node:os";
import { join } from "node:path";
import { format } from "node:util";
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { HttpClient } from "@actions/http-client";
import { rcompare, valid } from "semver";
import { addPath, debug, info } from "@actions/core";
Expand DownExpand Up@@ -142,15 +144,38 @@ function getFileName() {
 return filename;
}

async function downloadRelease(version: string): Promise<string> {
function verifyChecksum(path: string, expectedChecksum?: string): void {
 if (!expectedChecksum) {
 return;
 }

 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }

 const actualChecksum = createHash("sha256")
 .update(readFileSync(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(
 `Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
 );
 }
}

async function downloadRelease(
 version: string,
 checksum?: string,
): Promise<string> {
 // Download
 const fileName: string = getFileName();
 const downloadUrl: string = format(
 "https://github.com/go-task/task/releases/download/%s/%s",
 version,
 fileName,
 );
 let downloadPath: string | null = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 } catch (error) {
Expand All@@ -159,9 +184,10 @@ async function downloadRelease(version: string): Promise<string> {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);

 // Extract
 let extPath: string | null = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -178,7 +204,12 @@ async function downloadRelease(version: string): Promise<string> {
 return cacheDir(extPath, "task", version);
}

export async function getTask(version: string, repoToken: string, maxRetries: number = 3) {
export async function getTask(
 version: string,
 repoToken: string,
 maxRetries: number = 3,
 checksum?: string,
) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);

Expand All@@ -188,7 +219,7 @@ export async function getTask(version: string, repoToken: string, maxRetries: nu

 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 debug(`Task cached under ${toolPath}`);
 }

Expand Down

3 changes: 2 additions & 1 deletion
src/main.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,9 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 const checksum = getInput("checksum");

 await getTask(version, repoToken, maxRetries);
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 } catch (error) {
 if (error instanceof Error) {
 setFailed(error.message);
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat : add checksum verification input#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

vmaerten
merged 1 commit into

from

Aug 3, 2026
 Merged


feat : add checksum verification input
#16
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,6 +35,10 @@ Can be an exact version (e.g., `3.4.2`) or a version range (e.g., `3.x`).

**Default**: [`GITHUB_TOKEN`](https://docs.github.com/actions/security-guides/automatic-token-authentication)

### `checksum`

Expected SHA256 checksum of the downloaded Task archive.

## Usage

To get the action's default version of Task just add this step:
Expand Down

3 changes: 3 additions & 0 deletions
action.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -17,6 +17,9 @@ inputs:
 description: "Maximum number of retry attempts for HTTP requests"
 required: false
 default: "3"
 checksum:
 description: "Expected SHA256 checksum of the downloaded Task archive"
 required: false

runs:
 using: "node24"
Expand Down

35 changes: 29 additions & 6 deletions
dist/index.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33714,6 +33714,10 @@ const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import
const external_node_path_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
// EXTERNAL MODULE: external "node:util"
var external_node_util_ = __nccwpck_require__(7975);
// EXTERNAL MODULE: external "node:crypto"
var external_node_crypto_ = __nccwpck_require__(7598);
;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs");
// EXTERNAL MODULE: ./node_modules/semver/index.js
var node_modules_semver = __nccwpck_require__(2088);
;// CONCATENATED MODULE: ./node_modules/@actions/tool-cache/lib/manifest.js
Expand DownExpand Up@@ -34534,6 +34538,8 @@ function _unique(values) {





const osPlat = (0,external_node_os_namespaceObject.platform)();
const osArch = (0,external_node_os_namespaceObject.arch)();
// Retrieve a list of versions scraping tags from the Github API
Expand DownExpand Up@@ -34623,11 +34629,26 @@ function getFileName() {
 const filename = (0,external_node_util_.format)("task_%s_%s.%s", taskPlatform, taskArch, ext);
 return filename;
}
async function downloadRelease(version) {
function verifyChecksum(path, expectedChecksum) {
 if (!expectedChecksum) {
 return;
 }
 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }
 const actualChecksum = (0,external_node_crypto_.createHash)("sha256")
 .update((0,external_node_fs_namespaceObject.readFileSync)(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`);
 }
}
async function downloadRelease(version, checksum) {
 // Download
 const fileName = getFileName();
 const downloadUrl = (0,external_node_util_.format)("https://github.com/go-task/task/releases/download/%s/%s", version, fileName);
 let downloadPath = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 }
Expand All@@ -34637,8 +34658,9 @@ async function downloadRelease(version) {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);
 // Extract
 let extPath = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -34654,15 +34676,15 @@ async function downloadRelease(version) {
 // Install into the local tool cache - node extracts with a root folder that matches the fileName downloaded
 return cacheDir(extPath, "task", version);
}
async function getTask(version, repoToken, maxRetries = 3) {
async function getTask(version, repoToken, maxRetries = 3, checksum) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);
 // look if the binary is cached
 let toolPath;
 toolPath = find("task", targetVersion);
 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 core_debug(`Task cached under ${toolPath}`);
 }
 toolPath = (0,external_node_path_namespaceObject.join)(toolPath, "bin");
Expand All@@ -34689,7 +34711,8 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 await getTask(version, repoToken, maxRetries);
 const checksum = getInput("checksum");
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 }
 catch (error) {
 if (error instanceof Error) {
Expand Down

41 changes: 36 additions & 5 deletions
src/installer.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,8 @@
import { arch, platform } from "node:os";
import { join } from "node:path";
import { format } from "node:util";
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { HttpClient } from "@actions/http-client";
import { rcompare, valid } from "semver";
import { addPath, debug, info } from "@actions/core";
Expand DownExpand Up@@ -142,15 +144,38 @@ function getFileName() {
 return filename;
}

async function downloadRelease(version: string): Promise<string> {
function verifyChecksum(path: string, expectedChecksum?: string): void {
 if (!expectedChecksum) {
 return;
 }

 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }

 const actualChecksum = createHash("sha256")
 .update(readFileSync(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(
 `Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
 );
 }
}

async function downloadRelease(
 version: string,
 checksum?: string,
): Promise<string> {
 // Download
 const fileName: string = getFileName();
 const downloadUrl: string = format(
 "https://github.com/go-task/task/releases/download/%s/%s",
 version,
 fileName,
 );
 let downloadPath: string | null = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 } catch (error) {
Expand All@@ -159,9 +184,10 @@ async function downloadRelease(version: string): Promise<string> {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);

 // Extract
 let extPath: string | null = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -178,7 +204,12 @@ async function downloadRelease(version: string): Promise<string> {
 return cacheDir(extPath, "task", version);
}

export async function getTask(version: string, repoToken: string, maxRetries: number = 3) {
export async function getTask(
 version: string,
 repoToken: string,
 maxRetries: number = 3,
 checksum?: string,
) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);

Expand All@@ -188,7 +219,7 @@ export async function getTask(version: string, repoToken: string, maxRetries: nu

 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 debug(`Task cached under ${toolPath}`);
 }

Expand Down

3 changes: 2 additions & 1 deletion
src/main.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,9 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 const checksum = getInput("checksum");

 await getTask(version, repoToken, maxRetries);
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 } catch (error) {
 if (error instanceof Error) {
 setFailed(error.message);
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat : add checksum verification input#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

vmaerten
merged 1 commit into

from

Aug 3, 2026
 Merged


feat : add checksum verification input
#16
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,6 +35,10 @@ Can be an exact version (e.g., `3.4.2`) or a version range (e.g., `3.x`).

**Default**: [`GITHUB_TOKEN`](https://docs.github.com/actions/security-guides/automatic-token-authentication)

### `checksum`

Expected SHA256 checksum of the downloaded Task archive.

## Usage

To get the action's default version of Task just add this step:
Expand Down

3 changes: 3 additions & 0 deletions
action.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -17,6 +17,9 @@ inputs:
 description: "Maximum number of retry attempts for HTTP requests"
 required: false
 default: "3"
 checksum:
 description: "Expected SHA256 checksum of the downloaded Task archive"
 required: false

runs:
 using: "node24"
Expand Down

35 changes: 29 additions & 6 deletions
dist/index.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33714,6 +33714,10 @@ const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import
const external_node_path_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
// EXTERNAL MODULE: external "node:util"
var external_node_util_ = __nccwpck_require__(7975);
// EXTERNAL MODULE: external "node:crypto"
var external_node_crypto_ = __nccwpck_require__(7598);
;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs");
// EXTERNAL MODULE: ./node_modules/semver/index.js
var node_modules_semver = __nccwpck_require__(2088);
;// CONCATENATED MODULE: ./node_modules/@actions/tool-cache/lib/manifest.js
Expand DownExpand Up@@ -34534,6 +34538,8 @@ function _unique(values) {





const osPlat = (0,external_node_os_namespaceObject.platform)();
const osArch = (0,external_node_os_namespaceObject.arch)();
// Retrieve a list of versions scraping tags from the Github API
Expand DownExpand Up@@ -34623,11 +34629,26 @@ function getFileName() {
 const filename = (0,external_node_util_.format)("task_%s_%s.%s", taskPlatform, taskArch, ext);
 return filename;
}
async function downloadRelease(version) {
function verifyChecksum(path, expectedChecksum) {
 if (!expectedChecksum) {
 return;
 }
 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }
 const actualChecksum = (0,external_node_crypto_.createHash)("sha256")
 .update((0,external_node_fs_namespaceObject.readFileSync)(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`);
 }
}
async function downloadRelease(version, checksum) {
 // Download
 const fileName = getFileName();
 const downloadUrl = (0,external_node_util_.format)("https://github.com/go-task/task/releases/download/%s/%s", version, fileName);
 let downloadPath = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 }
Expand All@@ -34637,8 +34658,9 @@ async function downloadRelease(version) {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);
 // Extract
 let extPath = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -34654,15 +34676,15 @@ async function downloadRelease(version) {
 // Install into the local tool cache - node extracts with a root folder that matches the fileName downloaded
 return cacheDir(extPath, "task", version);
}
async function getTask(version, repoToken, maxRetries = 3) {
async function getTask(version, repoToken, maxRetries = 3, checksum) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);
 // look if the binary is cached
 let toolPath;
 toolPath = find("task", targetVersion);
 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 core_debug(`Task cached under ${toolPath}`);
 }
 toolPath = (0,external_node_path_namespaceObject.join)(toolPath, "bin");
Expand All@@ -34689,7 +34711,8 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 await getTask(version, repoToken, maxRetries);
 const checksum = getInput("checksum");
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 }
 catch (error) {
 if (error instanceof Error) {
Expand Down

41 changes: 36 additions & 5 deletions
src/installer.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,8 @@
import { arch, platform } from "node:os";
import { join } from "node:path";
import { format } from "node:util";
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { HttpClient } from "@actions/http-client";
import { rcompare, valid } from "semver";
import { addPath, debug, info } from "@actions/core";
Expand DownExpand Up@@ -142,15 +144,38 @@ function getFileName() {
 return filename;
}

async function downloadRelease(version: string): Promise<string> {
function verifyChecksum(path: string, expectedChecksum?: string): void {
 if (!expectedChecksum) {
 return;
 }

 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }

 const actualChecksum = createHash("sha256")
 .update(readFileSync(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(
 `Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
 );
 }
}

async function downloadRelease(
 version: string,
 checksum?: string,
): Promise<string> {
 // Download
 const fileName: string = getFileName();
 const downloadUrl: string = format(
 "https://github.com/go-task/task/releases/download/%s/%s",
 version,
 fileName,
 );
 let downloadPath: string | null = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 } catch (error) {
Expand All@@ -159,9 +184,10 @@ async function downloadRelease(version: string): Promise<string> {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);

 // Extract
 let extPath: string | null = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -178,7 +204,12 @@ async function downloadRelease(version: string): Promise<string> {
 return cacheDir(extPath, "task", version);
}

export async function getTask(version: string, repoToken: string, maxRetries: number = 3) {
export async function getTask(
 version: string,
 repoToken: string,
 maxRetries: number = 3,
 checksum?: string,
) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);

Expand All@@ -188,7 +219,7 @@ export async function getTask(version: string, repoToken: string, maxRetries: nu

 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 debug(`Task cached under ${toolPath}`);
 }

Expand Down

3 changes: 2 additions & 1 deletion
src/main.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,9 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 const checksum = getInput("checksum");

 await getTask(version, repoToken, maxRetries);
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 } catch (error) {
 if (error instanceof Error) {
 setFailed(error.message);
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat : add checksum verification input#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

vmaerten
merged 1 commit into

from

Aug 3, 2026
 Merged


feat : add checksum verification input
#16
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,6 +35,10 @@ Can be an exact version (e.g., `3.4.2`) or a version range (e.g., `3.x`).

**Default**: [`GITHUB_TOKEN`](https://docs.github.com/actions/security-guides/automatic-token-authentication)

### `checksum`

Expected SHA256 checksum of the downloaded Task archive.

## Usage

To get the action's default version of Task just add this step:
Expand Down

3 changes: 3 additions & 0 deletions
action.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -17,6 +17,9 @@ inputs:
 description: "Maximum number of retry attempts for HTTP requests"
 required: false
 default: "3"
 checksum:
 description: "Expected SHA256 checksum of the downloaded Task archive"
 required: false

runs:
 using: "node24"
Expand Down

35 changes: 29 additions & 6 deletions
dist/index.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33714,6 +33714,10 @@ const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import
const external_node_path_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
// EXTERNAL MODULE: external "node:util"
var external_node_util_ = __nccwpck_require__(7975);
// EXTERNAL MODULE: external "node:crypto"
var external_node_crypto_ = __nccwpck_require__(7598);
;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs");
// EXTERNAL MODULE: ./node_modules/semver/index.js
var node_modules_semver = __nccwpck_require__(2088);
;// CONCATENATED MODULE: ./node_modules/@actions/tool-cache/lib/manifest.js
Expand DownExpand Up@@ -34534,6 +34538,8 @@ function _unique(values) {





const osPlat = (0,external_node_os_namespaceObject.platform)();
const osArch = (0,external_node_os_namespaceObject.arch)();
// Retrieve a list of versions scraping tags from the Github API
Expand DownExpand Up@@ -34623,11 +34629,26 @@ function getFileName() {
 const filename = (0,external_node_util_.format)("task_%s_%s.%s", taskPlatform, taskArch, ext);
 return filename;
}
async function downloadRelease(version) {
function verifyChecksum(path, expectedChecksum) {
 if (!expectedChecksum) {
 return;
 }
 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }
 const actualChecksum = (0,external_node_crypto_.createHash)("sha256")
 .update((0,external_node_fs_namespaceObject.readFileSync)(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`);
 }
}
async function downloadRelease(version, checksum) {
 // Download
 const fileName = getFileName();
 const downloadUrl = (0,external_node_util_.format)("https://github.com/go-task/task/releases/download/%s/%s", version, fileName);
 let downloadPath = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 }
Expand All@@ -34637,8 +34658,9 @@ async function downloadRelease(version) {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);
 // Extract
 let extPath = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -34654,15 +34676,15 @@ async function downloadRelease(version) {
 // Install into the local tool cache - node extracts with a root folder that matches the fileName downloaded
 return cacheDir(extPath, "task", version);
}
async function getTask(version, repoToken, maxRetries = 3) {
async function getTask(version, repoToken, maxRetries = 3, checksum) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);
 // look if the binary is cached
 let toolPath;
 toolPath = find("task", targetVersion);
 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 core_debug(`Task cached under ${toolPath}`);
 }
 toolPath = (0,external_node_path_namespaceObject.join)(toolPath, "bin");
Expand All@@ -34689,7 +34711,8 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 await getTask(version, repoToken, maxRetries);
 const checksum = getInput("checksum");
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 }
 catch (error) {
 if (error instanceof Error) {
Expand Down

41 changes: 36 additions & 5 deletions
src/installer.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,8 @@
import { arch, platform } from "node:os";
import { join } from "node:path";
import { format } from "node:util";
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { HttpClient } from "@actions/http-client";
import { rcompare, valid } from "semver";
import { addPath, debug, info } from "@actions/core";
Expand DownExpand Up@@ -142,15 +144,38 @@ function getFileName() {
 return filename;
}

async function downloadRelease(version: string): Promise<string> {
function verifyChecksum(path: string, expectedChecksum?: string): void {
 if (!expectedChecksum) {
 return;
 }

 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }

 const actualChecksum = createHash("sha256")
 .update(readFileSync(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(
 `Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
 );
 }
}

async function downloadRelease(
 version: string,
 checksum?: string,
): Promise<string> {
 // Download
 const fileName: string = getFileName();
 const downloadUrl: string = format(
 "https://github.com/go-task/task/releases/download/%s/%s",
 version,
 fileName,
 );
 let downloadPath: string | null = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 } catch (error) {
Expand All@@ -159,9 +184,10 @@ async function downloadRelease(version: string): Promise<string> {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);

 // Extract
 let extPath: string | null = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -178,7 +204,12 @@ async function downloadRelease(version: string): Promise<string> {
 return cacheDir(extPath, "task", version);
}

export async function getTask(version: string, repoToken: string, maxRetries: number = 3) {
export async function getTask(
 version: string,
 repoToken: string,
 maxRetries: number = 3,
 checksum?: string,
) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);

Expand All@@ -188,7 +219,7 @@ export async function getTask(version: string, repoToken: string, maxRetries: nu

 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 debug(`Task cached under ${toolPath}`);
 }

Expand Down

3 changes: 2 additions & 1 deletion
src/main.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,9 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 const checksum = getInput("checksum");

 await getTask(version, repoToken, maxRetries);
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 } catch (error) {
 if (error instanceof Error) {
 setFailed(error.message);
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat : add checksum verification input#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

vmaerten
merged 1 commit into

from

Aug 3, 2026
 Merged


feat : add checksum verification input
#16
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,6 +35,10 @@ Can be an exact version (e.g., `3.4.2`) or a version range (e.g., `3.x`).

**Default**: [`GITHUB_TOKEN`](https://docs.github.com/actions/security-guides/automatic-token-authentication)

### `checksum`

Expected SHA256 checksum of the downloaded Task archive.

## Usage

To get the action's default version of Task just add this step:
Expand Down

3 changes: 3 additions & 0 deletions
action.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -17,6 +17,9 @@ inputs:
 description: "Maximum number of retry attempts for HTTP requests"
 required: false
 default: "3"
 checksum:
 description: "Expected SHA256 checksum of the downloaded Task archive"
 required: false

runs:
 using: "node24"
Expand Down

35 changes: 29 additions & 6 deletions
dist/index.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33714,6 +33714,10 @@ const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import
const external_node_path_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
// EXTERNAL MODULE: external "node:util"
var external_node_util_ = __nccwpck_require__(7975);
// EXTERNAL MODULE: external "node:crypto"
var external_node_crypto_ = __nccwpck_require__(7598);
;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs");
// EXTERNAL MODULE: ./node_modules/semver/index.js
var node_modules_semver = __nccwpck_require__(2088);
;// CONCATENATED MODULE: ./node_modules/@actions/tool-cache/lib/manifest.js
Expand DownExpand Up@@ -34534,6 +34538,8 @@ function _unique(values) {





const osPlat = (0,external_node_os_namespaceObject.platform)();
const osArch = (0,external_node_os_namespaceObject.arch)();
// Retrieve a list of versions scraping tags from the Github API
Expand DownExpand Up@@ -34623,11 +34629,26 @@ function getFileName() {
 const filename = (0,external_node_util_.format)("task_%s_%s.%s", taskPlatform, taskArch, ext);
 return filename;
}
async function downloadRelease(version) {
function verifyChecksum(path, expectedChecksum) {
 if (!expectedChecksum) {
 return;
 }
 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }
 const actualChecksum = (0,external_node_crypto_.createHash)("sha256")
 .update((0,external_node_fs_namespaceObject.readFileSync)(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`);
 }
}
async function downloadRelease(version, checksum) {
 // Download
 const fileName = getFileName();
 const downloadUrl = (0,external_node_util_.format)("https://github.com/go-task/task/releases/download/%s/%s", version, fileName);
 let downloadPath = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 }
Expand All@@ -34637,8 +34658,9 @@ async function downloadRelease(version) {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);
 // Extract
 let extPath = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -34654,15 +34676,15 @@ async function downloadRelease(version) {
 // Install into the local tool cache - node extracts with a root folder that matches the fileName downloaded
 return cacheDir(extPath, "task", version);
}
async function getTask(version, repoToken, maxRetries = 3) {
async function getTask(version, repoToken, maxRetries = 3, checksum) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);
 // look if the binary is cached
 let toolPath;
 toolPath = find("task", targetVersion);
 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 core_debug(`Task cached under ${toolPath}`);
 }
 toolPath = (0,external_node_path_namespaceObject.join)(toolPath, "bin");
Expand All@@ -34689,7 +34711,8 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 await getTask(version, repoToken, maxRetries);
 const checksum = getInput("checksum");
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 }
 catch (error) {
 if (error instanceof Error) {
Expand Down

41 changes: 36 additions & 5 deletions
src/installer.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,8 @@
import { arch, platform } from "node:os";
import { join } from "node:path";
import { format } from "node:util";
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { HttpClient } from "@actions/http-client";
import { rcompare, valid } from "semver";
import { addPath, debug, info } from "@actions/core";
Expand DownExpand Up@@ -142,15 +144,38 @@ function getFileName() {
 return filename;
}

async function downloadRelease(version: string): Promise<string> {
function verifyChecksum(path: string, expectedChecksum?: string): void {
 if (!expectedChecksum) {
 return;
 }

 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }

 const actualChecksum = createHash("sha256")
 .update(readFileSync(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(
 `Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
 );
 }
}

async function downloadRelease(
 version: string,
 checksum?: string,
): Promise<string> {
 // Download
 const fileName: string = getFileName();
 const downloadUrl: string = format(
 "https://github.com/go-task/task/releases/download/%s/%s",
 version,
 fileName,
 );
 let downloadPath: string | null = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 } catch (error) {
Expand All@@ -159,9 +184,10 @@ async function downloadRelease(version: string): Promise<string> {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);

 // Extract
 let extPath: string | null = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -178,7 +204,12 @@ async function downloadRelease(version: string): Promise<string> {
 return cacheDir(extPath, "task", version);
}

export async function getTask(version: string, repoToken: string, maxRetries: number = 3) {
export async function getTask(
 version: string,
 repoToken: string,
 maxRetries: number = 3,
 checksum?: string,
) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);

Expand All@@ -188,7 +219,7 @@ export async function getTask(version: string, repoToken: string, maxRetries: nu

 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 debug(`Task cached under ${toolPath}`);
 }

Expand Down

3 changes: 2 additions & 1 deletion
src/main.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,9 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 const checksum = getInput("checksum");

 await getTask(version, repoToken, maxRetries);
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 } catch (error) {
 if (error instanceof Error) {
 setFailed(error.message);
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat : add checksum verification input#16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

vmaerten
merged 1 commit into

from

Aug 3, 2026
 Merged


feat : add checksum verification input
#16
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,6 +35,10 @@ Can be an exact version (e.g., `3.4.2`) or a version range (e.g., `3.x`).

**Default**: [`GITHUB_TOKEN`](https://docs.github.com/actions/security-guides/automatic-token-authentication)

### `checksum`

Expected SHA256 checksum of the downloaded Task archive.

## Usage

To get the action's default version of Task just add this step:
Expand Down

3 changes: 3 additions & 0 deletions
action.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -17,6 +17,9 @@ inputs:
 description: "Maximum number of retry attempts for HTTP requests"
 required: false
 default: "3"
 checksum:
 description: "Expected SHA256 checksum of the downloaded Task archive"
 required: false

runs:
 using: "node24"
Expand Down

35 changes: 29 additions & 6 deletions
dist/index.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -33714,6 +33714,10 @@ const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import
const external_node_path_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:path");
// EXTERNAL MODULE: external "node:util"
var external_node_util_ = __nccwpck_require__(7975);
// EXTERNAL MODULE: external "node:crypto"
var external_node_crypto_ = __nccwpck_require__(7598);
;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs");
// EXTERNAL MODULE: ./node_modules/semver/index.js
var node_modules_semver = __nccwpck_require__(2088);
;// CONCATENATED MODULE: ./node_modules/@actions/tool-cache/lib/manifest.js
Expand DownExpand Up@@ -34534,6 +34538,8 @@ function _unique(values) {





const osPlat = (0,external_node_os_namespaceObject.platform)();
const osArch = (0,external_node_os_namespaceObject.arch)();
// Retrieve a list of versions scraping tags from the Github API
Expand DownExpand Up@@ -34623,11 +34629,26 @@ function getFileName() {
 const filename = (0,external_node_util_.format)("task_%s_%s.%s", taskPlatform, taskArch, ext);
 return filename;
}
async function downloadRelease(version) {
function verifyChecksum(path, expectedChecksum) {
 if (!expectedChecksum) {
 return;
 }
 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }
 const actualChecksum = (0,external_node_crypto_.createHash)("sha256")
 .update((0,external_node_fs_namespaceObject.readFileSync)(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(`Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`);
 }
}
async function downloadRelease(version, checksum) {
 // Download
 const fileName = getFileName();
 const downloadUrl = (0,external_node_util_.format)("https://github.com/go-task/task/releases/download/%s/%s", version, fileName);
 let downloadPath = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 }
Expand All@@ -34637,8 +34658,9 @@ async function downloadRelease(version) {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);
 // Extract
 let extPath = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -34654,15 +34676,15 @@ async function downloadRelease(version) {
 // Install into the local tool cache - node extracts with a root folder that matches the fileName downloaded
 return cacheDir(extPath, "task", version);
}
async function getTask(version, repoToken, maxRetries = 3) {
async function getTask(version, repoToken, maxRetries = 3, checksum) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);
 // look if the binary is cached
 let toolPath;
 toolPath = find("task", targetVersion);
 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 core_debug(`Task cached under ${toolPath}`);
 }
 toolPath = (0,external_node_path_namespaceObject.join)(toolPath, "bin");
Expand All@@ -34689,7 +34711,8 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 await getTask(version, repoToken, maxRetries);
 const checksum = getInput("checksum");
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 }
 catch (error) {
 if (error instanceof Error) {
Expand Down

41 changes: 36 additions & 5 deletions
src/installer.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,8 @@
import { arch, platform } from "node:os";
import { join } from "node:path";
import { format } from "node:util";
import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { HttpClient } from "@actions/http-client";
import { rcompare, valid } from "semver";
import { addPath, debug, info } from "@actions/core";
Expand DownExpand Up@@ -142,15 +144,38 @@ function getFileName() {
 return filename;
}

async function downloadRelease(version: string): Promise<string> {
function verifyChecksum(path: string, expectedChecksum?: string): void {
 if (!expectedChecksum) {
 return;
 }

 const normalizedExpected = expectedChecksum.trim().toLowerCase();
 if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
 throw new Error("The checksum input must be a SHA256 hex digest.");
 }

 const actualChecksum = createHash("sha256")
 .update(readFileSync(path))
 .digest("hex");
 if (actualChecksum !== normalizedExpected) {
 throw new Error(
 `Downloaded Task archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
 );
 }
}

async function downloadRelease(
 version: string,
 checksum?: string,
): Promise<string> {
 // Download
 const fileName: string = getFileName();
 const downloadUrl: string = format(
 "https://github.com/go-task/task/releases/download/%s/%s",
 version,
 fileName,
 );
 let downloadPath: string | null = null;
 let downloadPath = "";
 try {
 downloadPath = await downloadTool(downloadUrl);
 } catch (error) {
Expand All@@ -159,9 +184,10 @@ async function downloadRelease(version: string): Promise<string> {
 }
 throw new Error(`Failed to download version ${version}: ${error}`);
 }
 verifyChecksum(downloadPath, checksum);

 // Extract
 let extPath: string | null = null;
 let extPath = "";
 if (osPlat === "win32") {
 extPath = await extractZip(downloadPath);
 // Create a bin/ folder and move `task` there
Expand All@@ -178,7 +204,12 @@ async function downloadRelease(version: string): Promise<string> {
 return cacheDir(extPath, "task", version);
}

export async function getTask(version: string, repoToken: string, maxRetries: number = 3) {
export async function getTask(
 version: string,
 repoToken: string,
 maxRetries: number = 3,
 checksum?: string,
) {
 // resolve the version number
 const targetVersion = await computeVersion(version, repoToken, maxRetries);

Expand All@@ -188,7 +219,7 @@ export async function getTask(version: string, repoToken: string, maxRetries: nu

 // if not: download, extract and cache
 if (!toolPath) {
 toolPath = await downloadRelease(targetVersion);
 toolPath = await downloadRelease(targetVersion, checksum);
 debug(`Task cached under ${toolPath}`);
 }

Expand Down

3 changes: 2 additions & 1 deletion
src/main.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -18,8 +18,9 @@ async function run() {
 const version = getInput("version", { required: true });
 const repoToken = getInput("repo-token");
 const maxRetries = parseInt(getInput("max-retries") || "3", 10);
 const checksum = getInput("checksum");

 await getTask(version, repoToken, maxRetries);
 await getTask(version, repoToken, maxRetries, checksum || undefined);
 } catch (error) {
 if (error instanceof Error) {
 setFailed(error.message);
Expand Down