It May Be a Good Idea to Verify CLI Binaries Used in GitHub Actions with Both SHA256 Checksums and Attestations
In masutaka/actions , which I introduced in [2026-02-23-1] , CLI binaries such as jactionlint are downloaded from each tool’s GitHub Releases. The downloaded binaries are verified with both a SHA256 checksum and gh attestation verify. In this post, I’ll explain how and why. Verifying with SHA256 Checksums and Attestations Here’s how masutaka/actions verifies jactionlint: 🔗 .github/workflows/gh_action_lint.yml - name: Install jactionlint env: GH_TOKEN: ${{ github.token }} REPO: jdx/jactionlint ASSET: "*_linux_amd64.tar.gz" TAG: v2.0.2 ASSET_SHA256: 026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b SIGNER_WORKFLOW: jdx/jactionlint/.github/workflows/release.yaml EXECUTABLE: jactionlint run: | gh release download "$TAG" \ --repo "$REPO" \ --pattern "$ASSET" \ --output asset.tar.gz # 正規の release workflow がそのタグからビルドした成果物であることを検証する gh attestation verify asset.tar.gz \ --repo "$REPO" \ --signer-workflow "$SIGNER_WORKFLOW" \ --source-ref "refs/tags/$TAG" # ピンした時点から中身が変わっていないことを検証する echo "${ASSET_SHA256} asset.tar.gz" | sha256sum -c - tar -xzf asset.tar.gz "$EXECUTABLE" It downloads the asset from GitHub Releases and uses it only if it passes both gh attestation verify and sha256sum -c. ...