Can't be used concurrently

[nazar-pc]

GitHub supports parallel steps since recently. Trying to install different tools (I do it so I can reuse installation of one of the tools in another job with Yaml anchors) results in broken binaries and failed checksum verification.

Looking at this the reason is obvious:

install-action/main.sh

Lines 60 to 80 in 6a1bd70

	download_and_checksum() {
	local url="$1"
	local checksum="$2"
	if [[ -z "${enable_checksum}" ]]; then
	checksum=''
	fi
	info "downloading ${url}"
	retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 -o tmp "${url}"
	if [[ -n "${checksum}" ]]; then
	info "verifying sha256 checksum for $(basename -- "${url}")"
	if type -P sha256sum >/dev/null; then
	sha256sum -c - >/dev/null <<<"${checksum} *tmp"
	elif type -P shasum >/dev/null; then
	# GitHub-hosted macOS runner does not install GNU Coreutils by default.
	# https://github.com/actions/runner-images/issues/90
	shasum -a 256 -c - >/dev/null <<<"${checksum} *tmp"
	else
	bail "checksum requires 'sha256sum' or 'shasum' command; consider installing one of them or setting 'checksum' input option to 'false'"
	fi
	fi
	}

It writes to the same tmp file, which will obviously break when done concurrently. I'm now wondering why it doesn't write to the file with the eventual name from the start 🤔

[taiki-e]

Thanks for the report!

I'm now wondering why it doesn't write to the file with the eventual name from the start 🤔

I believe the appropriate solution here is to use a unique temporary directory. For example, if we use the fallback in parallel, cargo-binstall will be installed first, but in this case, even if you use cargo-binstall instead of tmp, the archive may still become corrupted.

[nazar-pc]

Well, locking could be implemented too. mkdir is atomic for example and can be used with deterministic name. Though the complexity may not be worth it.