Add checksum verification input

README.md

@@ -38,6 +38,7 @@ You can configure `buf-setup-action` with these parameters:
 | Parameter      | Description                                        | Default            |
 |:---------------|:---------------------------------------------------|:-------------------|
 | `version`      | The version of the [`buf` CLI][buf-cli] to install | [`v1.50.0`][version] |
+| `checksum`     | Expected SHA256 checksum of the downloaded buf archive or executable | |
 | `github_token` | The GitHub token to use when making API requests   |                    |
 | `buf_user`     | The username to use for logging into Buf Schema registry.                                               |                    |
 | `buf_api_token` | The API token to use for logging into Buf Schema registry.                                                                                                            |                    |

action.yml

@@ -12,6 +12,9 @@ inputs:
   github_token:
     description: The GitHub token to use when making API requests.
     required: false
+  checksum:
+    description: Expected SHA256 checksum of the downloaded buf archive or executable.
+    required: false
   buf_user:
     description: The username to use for logging into Buf Schema registry.
     required: false

src/buf.ts

@@ -14,6 +14,8 @@
 
 import * as os from "os";
 import * as path from "path";
+import * as crypto from "crypto";
+import * as fs from "fs";
 import * as core from "@actions/core";
 import * as tc from "@actions/tool-cache";
 import { Octokit } from "@octokit/core";
@@ -27,6 +29,7 @@ const versionPrefix = "v";
 export async function getBuf(
   version: string,
   githubToken: string,
+  checksum?: string,
 ): Promise<string | Error> {
   const binaryPath = tc.find("buf", version, os.arch());
   if (binaryPath !== "") {
@@ -44,6 +47,7 @@ export async function getBuf(
   core.info(`Downloading buf version "${version}" from ${downloadURL}`);
   if (downloadURL.endsWith(".tar.gz")) {
     const downloadPath = await tc.downloadTool(downloadURL);
+    verifyChecksum(downloadPath, checksum);
     core.info(
       `Successfully downloaded buf version "${version}" from ${downloadURL}`,
     );
@@ -66,6 +70,7 @@ export async function getBuf(
       downloadURL,
       "C:\\Users\\runneradmin\\buf-download\\buf.exe",
     );
+    verifyChecksum(downloadPath, checksum);
     core.info(
       `Successfully downloaded buf version "${version}" from ${downloadURL} to ${downloadPath}`,
     );
@@ -82,6 +87,29 @@ export async function getBuf(
   return cacheDir;
 }
 
+function verifyChecksum(path: string, expectedChecksum?: string): void {
+  if (!expectedChecksum) {
+    return;
+  }
+
+  const normalizedExpected = expectedChecksum.trim().toLowerCase();
+  if (!/^[a-f0-9]{64}$/.test(normalizedExpected)) {
+    throw new globalThis.Error(
+      "The checksum input must be a SHA256 hex digest.",
+    );
+  }
+
+  const actualChecksum = crypto
+    .createHash("sha256")
+    .update(fs.readFileSync(path))
+    .digest("hex");
+  if (actualChecksum !== normalizedExpected) {
+    throw new globalThis.Error(
+      `Downloaded buf archive checksum mismatch. Expected ${normalizedExpected}, got ${actualChecksum}.`,
+    );
+  }
+}
+
 // getDownloadURL resolves Buf's Github download URL for the
 // current architecture and platform.
 async function getDownloadURL(

src/run.ts

@@ -55,9 +55,10 @@ async function runSetup(): Promise<null | Error> {
       "No github_token supplied, API requests will be subject to stricter rate limiting",
     );
   }
+  const checksum = core.getInput("checksum");
 
   core.info(`Setting up buf version "${version}"`);
-  const installDir = await getBuf(version, githubToken);
+  const installDir = await getBuf(version, githubToken, checksum || undefined);
   if (isError(installDir)) {
     return installDir;
   }