install.sh

#!/bin/sh
# Put an isomer binary on disk and prove it is the one we meant to run.
#
# The whole trust story of this action is in this file, so it stays short
# enough to read in one sitting:
#
#   - the version comes from the action ref, not from "latest";
#   - the SHA-256 comes from checksums.txt, committed alongside this script and
#     fixed at release time;
#   - a binary that does not match its recorded checksum is deleted, and the
#     run fails. There is no "continue anyway".
set -eu

: "${ISOMER_VERSION:?}" "${ISOMER_TARGET:?}" "${ISOMER_DIR:?}" "${ACTION_PATH:?}"
BIN="$ISOMER_DIR/isomer"

emit() { printf '%s\n' "$1" >> "$GITHUB_OUTPUT"; }
fail() { printf '::error title=isomer::%s\n' "$1"; exit 1; }

# An operator-supplied binary is used as-is: they chose it, and re-verifying it
# against our checksums would only reject it.
if [ -n "${ISOMER_PATH_INPUT:-}" ]; then
  [ -x "$ISOMER_PATH_INPUT" ] || fail "isomer-path is not executable: $ISOMER_PATH_INPUT"
  printf 'isomer: using %s (%s)\n' "$ISOMER_PATH_INPUT" "$("$ISOMER_PATH_INPUT" --version 2>/dev/null || echo 'unknown version')"
  emit "bin=$ISOMER_PATH_INPUT"
  exit 0
fi

# Restored from cache by the previous step.
if [ -x "$BIN" ]; then
  printf 'isomer: %s restored from cache\n' "$("$BIN" --version 2>/dev/null || echo isomer)"
  emit "bin=$BIN"
  exit 0
fi

ASSET="isomer-$ISOMER_VERSION-$ISOMER_TARGET.tar.gz"
BASE="${ISOMER_DOWNLOAD_BASE:-https://github.com/atomdrift-project/isomer/releases/download/v$ISOMER_VERSION}"
SUMS="$ACTION_PATH/checksums.txt"
[ -f "$SUMS" ] || fail "checksums.txt is missing from the action — refusing to install an unverified binary"

# The expected digest is looked up before anything is downloaded, so an asset
# this action has no checksum for is never even fetched.
EXPECTED=$(awk -v a="$ASSET" '$2 == a || $2 == "*"a {print $1}' "$SUMS" | head -n 1)
[ -n "$EXPECTED" ] || fail "no recorded checksum for $ASSET — this action ref does not support $ISOMER_TARGET"

mkdir -p "$ISOMER_DIR"
printf 'isomer: downloading %s\n' "$ASSET"
curl --fail --silent --show-error --location --retry 3 --retry-delay 2 \
     --max-time 300 --proto '=https' --tlsv1.2 \
     -o "$ISOMER_DIR/$ASSET" "$BASE/$ASSET" \
  || fail "download failed: $BASE/$ASSET"

if command -v sha256sum >/dev/null 2>&1; then
  ACTUAL=$(sha256sum "$ISOMER_DIR/$ASSET" | cut -d' ' -f1)
else
  ACTUAL=$(shasum -a 256 "$ISOMER_DIR/$ASSET" | cut -d' ' -f1)
fi
if [ "$ACTUAL" != "$EXPECTED" ]; then
  rm -f "$ISOMER_DIR/$ASSET"
  fail "checksum mismatch for $ASSET — expected $EXPECTED, got $ACTUAL. The download was NOT what this action pinned; not running it."
fi

tar -xzf "$ISOMER_DIR/$ASSET" -C "$ISOMER_DIR" || fail "could not unpack $ASSET"
rm -f "$ISOMER_DIR/$ASSET"
[ -x "$BIN" ] || fail "archive did not contain an isomer binary"

printf 'isomer: installed %s\n' "$("$BIN" --version 2>/dev/null || echo "$ISOMER_VERSION")"
emit "bin=$BIN"