@@ -24,13 +24,12 @@ This GitHub Action provides faster version of the `cargo install` command.
24
24
## How does it work?
25
25
26
26
Before calling your usual ` cargo install ` command, this Action
27
- attempts to download pre-build binary crate file from the binary crates cache.\
27
+ attempts to download pre-build binary crate file from the binary crates cache.
28
28
See [ Security considerations] ( #security-considerations ) to read more
29
29
about potential caveats and usage policy.
30
30
31
31
If requested crate does not exist in the crates cache storage,
32
- this Action will fall back to the usual ` cargo install ` .
33
-
32
+ this Action will fall back to the usual ` cargo install ` .\
34
33
As soon as [ actions-rs/meta #21 ] ( https://github.com/actions-rs/meta/issues/21 ) will be implemented,
35
34
this Action will also cache compiled binary in the GitHub cache.
36
35
48
47
runs-on : ubuntu-latest
49
48
steps :
50
49
- uses : actions/checkout@v2
51
- - uses : actions-rs/install@master
50
+ - uses : actions-rs/install@v0.1
52
51
with :
53
52
crate : cargo-audit
54
53
version : latest
@@ -66,29 +65,30 @@ jobs:
66
65
# # Tool cache
67
66
68
67
As it was mentioned in [How does it work?](#how-does-it-work) section,
69
- this Action can use external cache with the pre-compiled crates in it .
68
+ this Action can use external pre-compiled crates cache .
70
69
71
- In order to use it , you need to **explicitly** enable `use-tool-cache` input :
70
+ In order to enable this functionaliy , you need to **explicitly** enable `use-tool-cache` input :
72
71
73
72
` ` ` yaml
74
- - uses: actions-rs/install@master
73
+ - uses: actions-rs/install@v0.1
75
74
with:
76
75
crate: cargo-audit
77
76
version: latest
78
77
use-tool-cache: true
79
78
` ` `
80
79
81
80
Before enabling this input, you should acknowledge security risks
82
- of executing pre- compiled binaries in your CI workflows.
81
+ of executing binaries compiled for you by a third party in your CI workflows.
83
82
84
83
# ## Security considerations
85
84
86
85
Check the [`tool-cache`](https://github.com/actions-rs/tool-cache/) repo
87
- to under understand how binary crates are built, signed and uploaded to the external cache.
86
+ to understand how binary crates are built, signed and uploaded into the external cache.
88
87
89
- This Action downloads both binary file and its signature.\
90
- Signature validation is proceeded by `openssl` and public key (`public.pem`)
91
- of the same certificate used for signing files at `tool-cache` repo.
88
+ This Action downloads both binary file and its signature.
89
+ Signature validation is proceeded by `openssl` by using public key
90
+ of the same certificate used for signing files at `tool-cache` repo.\
91
+ Public key is stored in this repository at `public.pem`.
92
92
93
93
If signature validation fails, binary file is removed immediately,
94
94
warning issued and fall back to the `cargo install` call happens.
0 commit comments