From 90f5248156ae4152f629186604d9e9d79b381c97 Mon Sep 17 00:00:00 2001
From: Nathan Klick <nathan@swirldslabs.com>
Date: Wed, 15 Jul 2026 16:51:29 -0500
Subject: [PATCH] fix: pin and checksum-verify semver install

The Setup Semver step downloaded the semver-tool script from the mutable
'master' branch with no integrity check, then installed it with sudo. A
compromise (or repointing) of that upstream ref would execute arbitrary
code on the runner.

Pin the download to the immutable commit 837ad91 (tag 3.4.0) and verify
its SHA-256 before install, failing closed on mismatch. This mirrors the
existing jq and gomplate hardening in this action. Also drop the
unnecessary sudo on curl; only install needs root.

Signed-off-by: Nathan Klick <nathan@swirldslabs.com>
---
 action.yml | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/action.yml b/action.yml
index 3d1408e..892008d 100644
--- a/action.yml
+++ b/action.yml
@@ -566,16 +566,29 @@ runs:
       id: setup-semver
       if: ${{ inputs.setup-semver == 'true' }}
       shell: bash
+      env:
+        # Pinned to fsaintjacques/semver-tool tag 3.4.0 (immutable commit).
+        # To bump: change both SEMVER_COMMIT and SEMVER_SHA256 together, e.g.
+        #   curl -sSL https://raw.githubusercontent.com/fsaintjacques/semver-tool/<commit>/src/semver | shasum -a 256
+        SEMVER_COMMIT: '837ad91179c4126e3b7ff73c35091d5ef561d9a3'
+        SEMVER_SHA256: '1ff4a97e4d1e389f6f034f7464ac4365f1be2d900e2dc2121e24a6dc239e8991'
       run: |
+        SEMVER_URL="https://raw.githubusercontent.com/fsaintjacques/semver-tool/${SEMVER_COMMIT}/src/semver"
+
         echo "::group::Download SemVer Binary"
-        sudo curl -sSfL https://raw.githubusercontent.com/fsaintjacques/semver-tool/master/src/semver \
+        curl -sSfL "${SEMVER_URL}" \
           -o /tmp/semver || { echo "Failed to download semver binary"; exit 1; }
         echo "::endgroup::"
-        
+
+        echo "::group::Verify SemVer Checksum"
+        echo "${SEMVER_SHA256}  /tmp/semver" | shasum -a 256 -c - \
+          || { echo "semver checksum verification failed"; exit 1; }
+        echo "::endgroup::"
+
         echo "::group::Change SemVer Binary Permissions"
         sudo install -m 755 /tmp/semver /usr/local/bin/semver
         echo "::endgroup::"
-        
+
         echo "::group::Show SemVer Binary Version Info"
         VERSION="$(/usr/local/bin/semver --version | tr -d '\n')"
         echo "semver version: ${VERSION}"