From cb2bb5bc148ed4e1d729ad71d445cb13dc871272 Mon Sep 17 00:00:00 2001 From: Eli Mallon Date: Wed, 23 Sep 2026 13:49:40 -0700 Subject: [PATCH] ci: check the Maestro download before running it Fetch the pinned 2.6.1 release zip and verify its SHA-256 instead of piping get.maestro.mobile.dev into bash. The hash matches the copy we've been running locally since July. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/build.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 2f2b24e6..6650c508 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -150,8 +150,11 @@ jobs: echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules sudo udevadm control --reload-rules sudo udevadm trigger --name-match=kvm - curl -fsSL "https://get.maestro.mobile.dev" | MAESTRO_VERSION=2.6.1 bash - echo "$HOME/.maestro/bin" >> $GITHUB_PATH + # a pinned release, checked before anything in it runs + curl -fsSL -o /tmp/maestro.zip https://github.com/mobile-dev-inc/maestro/releases/download/cli-2.6.1/maestro.zip + echo "3440825f514f537c6a96bcf5de995780c2a4a7f83a43208fdc95d4f1fecfad3b /tmp/maestro.zip" | sha256sum -c - + unzip -q /tmp/maestro.zip -d "$HOME/.maestro-dist" + echo "$HOME/.maestro-dist/maestro/bin" >> $GITHUB_PATH - uses: actions/cache@v4 id: avd-cache -- 2.51.2