From 4c7f1aba208700fb2deaa31f597ba7ac3ee5e908 Mon Sep 17 00:00:00 2001 From: mvillmow <4211002+mvillmow@users.noreply.github.com> Date: Sun, 28 Jun 2026 23:01:16 -0700 Subject: [PATCH] fix(ci): install just via pinned setup-just to stop 403 on lint job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The install-build-deps composite action piped just.systems/install.sh into bash. That script's unauthenticated GitHub release download intermittently returns HTTP 403 on CI runners, failing the required 'lint' job at 'Install build dependencies (just + linters)' and turning main red. Switch to extractions/setup-just@v4 (SHA-pinned) — the same authenticated, cached install already used in _required.yml. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: mvillmow <4211002+mvillmow@users.noreply.github.com> --- .github/actions/install-build-deps/action.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/actions/install-build-deps/action.yml b/.github/actions/install-build-deps/action.yml index 91d42031..17d7c144 100644 --- a/.github/actions/install-build-deps/action.yml +++ b/.github/actions/install-build-deps/action.yml @@ -71,9 +71,13 @@ runs: - name: Install just if: inputs.include-just == 'true' - run: | - curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /usr/local/bin - shell: bash + # Use the pinned setup-just action instead of piping just.systems/install.sh + # into bash: the install script's unauthenticated GitHub release download + # intermittently returns HTTP 403 on CI runners, which turned main red on + # the required `lint` job. setup-just downloads via the Actions toolkit + # (authenticated, cached) and is already the canonical pattern used in + # _required.yml. + uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 - name: Set up compiler alternatives run: |