From d9179544c97d018126a1652dac1c91b3d4497ca7 Mon Sep 17 00:00:00 2001 From: Oliver Hamlet Date: Wed, 1 Oct 2025 20:31:07 +0100 Subject: [PATCH] Verify the hash of downloaded Doxygen in CI --- .github/workflows/ci.yml | 7 +++++++ .github/workflows/release.yml | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2796b9e2..f0760be8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -229,6 +229,13 @@ jobs: working-directory: docs run: | curl -sSfLO https://github.com/doxygen/doxygen/releases/download/Release_1_13_2/doxygen-1.13.2.windows.x64.bin.zip + + $hash = Get-FileHash -Algorithm SHA256 doxygen-1.13.2.windows.x64.bin.zip + $expectedHash = 'DEDBCF1D05911AFC003989D33194AB95539E2EF4535CC00143B5917C22614406' + if ($hash.Hash -ne $expectedHash) { + throw 'Unexpected hash: $($hash.Hash)' + } + Expand-Archive doxygen-1.13.2.windows.x64.bin.zip echo "${{ github.workspace }}\doxygen-1.13.2.windows.x64.bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e93b4bf2..7d3f2d0f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -79,6 +79,13 @@ jobs: working-directory: docs run: | curl -sSfLO https://github.com/doxygen/doxygen/releases/download/Release_1_13_2/doxygen-1.13.2.windows.x64.bin.zip + + $hash = Get-FileHash -Algorithm SHA256 doxygen-1.13.2.windows.x64.bin.zip + $expectedHash = 'DEDBCF1D05911AFC003989D33194AB95539E2EF4535CC00143B5917C22614406' + if ($hash.Hash -ne $expectedHash) { + throw 'Unexpected hash: $($hash.Hash)' + } + Expand-Archive doxygen-1.13.2.windows.x64.bin.zip echo "${{ github.workspace }}\doxygen-1.13.2.windows.x64.bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append