From c0c9589ec7fe0b2b2bb72bcbaade800d32880c17 Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Fri, 4 Sep 2026 15:46:29 +0200 Subject: [PATCH] ci: Install sentry-cli via action-setup-cli Replace the `curl | bash` install with the shared setup action, which verifies the release asset's sha256 before installing. Fixes VULN-2847 Co-Authored-By: Claude --- .github/workflows/build.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b5ee5632..f1eef7da 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -35,7 +35,9 @@ jobs: # libcurl4-openssl-dev: librdkafka is built from source and links against libcurl, # whose headers are not on the runner by default. sudo apt-get install -y llvm libcurl4-openssl-dev - curl -sL https://sentry.io/get-cli/ | bash + + - name: Install sentry-cli + uses: getsentry/action-setup-cli@70d7e587b84c2e78cf4d37cd33d7b74fb3729c1b # v1 - name: Install Rust Toolchain run: |