actions/install-action
1
0
Fork 0
mirror of https://github.com/taiki-e/install-action.git synced 2026-04-23 07:40:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not expose GITHUB_TOKEN to cargo-binstall's subprocess

Browse Source
This commit is contained in:
Taiki Endo
2026-04-10 14:47:32 +09:00
parent 3c299a507e
commit 08a38582e3
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGELOG.md
View File

@@ -10,6 +10,8 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
## [Unreleased] ## [Unreleased]
- Enhance security when cargo-binstall fallback is enabled.
- Update `uv@latest` to 0.11.5. - Update `uv@latest` to 0.11.5.
- Update `syft@latest` to 1.42.4. - Update `syft@latest` to 1.42.4.

10
main.sh
View File

@@ -917,13 +917,15 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
case "${fallback}" in case "${fallback}" in
cargo-binstall) cargo-binstall)
install_cargo_binstall install_cargo_binstall
if [[ -z "${GITHUB_TOKEN:-}" ]] && [[ -n "${DEFAULT_GITHUB_TOKEN:-}" ]]; then
export GITHUB_TOKEN="${DEFAULT_GITHUB_TOKEN}"
fi
# By default, cargo-binstall enforce downloads over secure transports only. # By default, cargo-binstall enforce downloads over secure transports only.
# As a result, http will be disabled, and it will also set # As a result, http will be disabled, and it will also set
# min tls version to be 1.2 # min tls version to be 1.2
cargo-binstall binstall --force --no-confirm --locked "${unsupported_tools[@]}" binstall_args=(--force --no-confirm --locked "${unsupported_tools[@]}")
if [[ -z "${GITHUB_TOKEN:-}" ]] && [[ -n "${DEFAULT_GITHUB_TOKEN:-}" ]]; then
cargo-binstall binstall --github-token "${DEFAULT_GITHUB_TOKEN}" "${binstall_args[@]}"
else
cargo-binstall binstall "${binstall_args[@]}"
fi
if ! type -P cargo >/dev/null; then if ! type -P cargo >/dev/null; then
_bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin") _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")
# TODO: avoid this when already added # TODO: avoid this when already added