curl/.github/workflows/binarycheck.yml
Daniel Stenberg e3240db0a7
GHA: scan git repository and detect unvetted binary files
The only binary-looking files that are accepted in the git repository
need to match the checksums in the sha256sum file
".github/scripts/binarycheck.sums".

This is done to make sure that no one has planted any hidden (encrypted)
potentially dangerous payload in the tree.

Closes #14333
2024-08-01 12:30:36 +02:00

24 lines
426 B
YAML

# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
#
# SPDX-License-Identifier: curl
name: bincheck
on:
push:
branches:
- master
pull_request:
branches:
- master
permissions: {}
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
- name: Check for binary files
run: ./.github/scripts/binarycheck.pl