install.sh: compare the checksum directly; the asset name did not match #27

	name: security
	on:
	push:
	branches: [main]
	pull_request:
	schedule:
	- cron: "17 6 * * 1"
	permissions:
	contents: read
	jobs:
	zizmor:
	# Audits the workflows themselves: unpinned actions, credential
	# persistence, template injection, excessive permissions.
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	with:
	persist-credentials: false
	- uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
	with:
	# SARIF upload needs Code Scanning, which private repos lack.
	# Set to true when the repo goes public.
	advanced-security: true
	gitleaks:
	# Secret scan over full history. Runs the MIT-licensed CLI directly;
	# the hosted action needs a license for organization repos.
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	with:
	persist-credentials: false
	fetch-depth: 0
	- run: \|
	docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:v8.30.1 \
	git /repo --no-banner --redact --exit-code 1

Navigation Menu