You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iggy.apache.org by hg...@apache.org on 2026/10/23 20:00:00 UTC
(iggy) 03/03: fix(ci): verify the cargo-sort 2.1.4 release checksum
This is an automated email from the ASF dual-hosted git repository.
hubcio pushed a commit to branch perf/miri-under-20-minutes
in repository https://gitbox.apache.org/repos/asf/iggy.git
commit d38127511e3abd99f5e5e2c64be8930f0130f3c9
Author: Hubert Gruszecki <h....@gmail.com>
AuthorDate: Fri Oct 23 21:26:08 2026 +0200
fix(ci): verify the cargo-sort 2.1.4 release checksum
The installer still records an outdated checksum for cargo-sort
2.1.4. Download the pinned release directly and verify its current
SHA-256 before extracting the binary into the Rust tools directory.
---
.github/actions/rust/pre-merge/action.yml | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/.github/actions/rust/pre-merge/action.yml b/.github/actions/rust/pre-merge/action.yml
index 2e4631777..c8ae026c2 100644
--- a/.github/actions/rust/pre-merge/action.yml
+++ b/.github/actions/rust/pre-merge/action.yml
@@ -71,11 +71,17 @@ runs:
- name: Install cargo-sort
if: inputs.task == 'sort'
- uses: taiki-e/install-action@v2
- with:
- # The 2.1.4 release assets were re-uploaded after install-action
- # recorded their checksum, so 2.1.4 fails verification.
- tool: cargo-sort@2.1.3
+ shell: bash
+ env:
+ CARGO_SORT_VERSION: "2.1.4"
+ CARGO_SORT_SHA256: c35c3df1f2e512890ee2ffd6151aa265fbfe06accbea0d9226e0bb14d821845b
+ run: |
+ cargo_sort_archive="${RUNNER_TEMP}/cargo-sort.tar.gz"
+ curl -fsSL --retry 5 --retry-all-errors -o "$cargo_sort_archive" \
+ "https://github.com/DevinR528/cargo-sort/releases/download/v${CARGO_SORT_VERSION}/cargo-sort-x86_64-unknown-linux-gnu.tar.gz"
+ echo "${CARGO_SORT_SHA256} ${cargo_sort_archive}" | sha256sum -c -
+ tar -xzf "$cargo_sort_archive" -C "$HOME/.cargo/bin" cargo-sort
+ cargo sort --version
- name: Install cargo-machete
if: inputs.task == 'machete'