What the check does
Flags any inlinerun: script that fetches a binary or archive with curl or wget but does not perform an integrity check in the same step. The check looks at the entire script text for the download command and then for any of:
sha256sum,sha512sum,shasumopenssl dgstgpg --verifycosign verify,cosign verify-blob,cosign verify-attestationslsa-verifier verifygh attestation verifyminisign -V,signify -V
.tar, .tar.gz, .tgz, .zip, .deb, .rpm, .pkg, .msi, .exe, .jar, .war, .whl, .gem, .apk, .so, .dll, .dylib, .bin, .run, .sh, .7z). Fetching JSON/text or piping straight to a shell are handled by other rules (the latter is BEST-PRAC-1).
Why it matters
A workflow that downloadstool.tar.gz and immediately extracts and runs it trusts:
- That the upstream server hasn’t been compromised since the workflow author last looked.
- That the TLS chain hasn’t been MITM’d on the runner.
- That a typo or unicode lookalike in the URL hasn’t redirected to an attacker’s CDN.
GITHUB_TOKEN and every secret in scope — a textbook supply-chain compromise.
A checksum or signature checked in the same step catches all three: the bytes the runner extracted have to match a value the workflow author wrote down.