From my comment in #488 (comment).
install-action verifies checksums & signatures, to detect edits to old releases. The readme explains this, but it doesnt clearly describe what happens if that verification fails. What if I am installing 4 tools using this action, and one fails verification? Does/Should it fall back to a prior release, if it can find one which does pass verification?
Currently, it simply fails, but I think a fallback to the older version would be better. I think this could be implemented by extracting some of the #182 implementation.
FYI, #167 (comment) is an actual case where the maintainer has edited the release in the past. In this case I tracked the maintainer's activity and determined that it was ok, so I created a new release with the updated hash. Now it is a bit more automated and the hash updates are automated, but the release itself is still something I do manually.
The correct solution is likely to be a pinning version to an old one in most cases. And there is a risk that confused users might manually disable checksums and install compromised binaries.
As for cases where the tool version is fully specified, I think it's fine as is.
From my comment in #488 (comment).
The correct solution is likely to be a pinning version to an old one in most cases. And there is a risk that confused users might manually disable checksums and install compromised binaries.
As for cases where the tool version is fully specified, I think it's fine as is.