Add a setting to specify what to do on hash mismatch and default it to error

[danwkennedy]

Description

This'll go in after the unzip PR.

Adds a new digest-mismatch setting to specify what to do if the hashes are mismatched. We're going to default this to error.

Breaking Changes

• Downloads that fail the hash check will fail now. We believe this is a sensible default to increase security. If this is not acceptable, set the digest-mismatch setting to warn to change it back to the previous behavior.

[Copilot]

Pull request overview

This PR introduces a new digest-mismatch input parameter that allows users to control the behavior when downloaded artifacts fail digest validation. The default behavior is changed from warning to error, making the action more secure by default. This is a breaking change that improves security by failing when artifact integrity cannot be verified.

Changes:

• Added a new digest-mismatch input with four options: ignore, info, warn, and error (default)
• Modified digest validation logic to collect all mismatches and handle them according to the configured behavior
• Added comprehensive test coverage for all four behavior options
• Updated documentation to explain the breaking change

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/constants.ts	Added DigestMismatch input enum and DigestMismatchBehavior enum defining the four behavior options
src/download-artifact.ts	Implemented input validation and digest mismatch handling logic with switch statement for different behaviors
dist/index.js	Compiled distribution file reflecting the source code changes
action.yml	Added digest-mismatch input definition with description and default value of 'error'
tests/download.test.ts	Added tests for default error behavior and all three alternative behaviors (warn, info, ignore)
README.md	Documented the breaking change and new parameter in the v8 "What's new" section

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Missing test coverage for invalid digest-mismatch input values. The validation logic in the implementation (lines 37-43 of src/download-artifact.ts) throws an error for invalid values like 'invalid-option', but there's no test verifying this behavior. Consider adding a test case that verifies an error is thrown when an invalid value is provided for the digest-mismatch input.

[Copilot]

Missing test coverage for multiple artifacts with digest mismatches. The implementation collects all artifacts with digest mismatches and reports them together in the error message, but there's no test verifying this behavior when multiple artifacts fail digest validation. Consider adding a test case that downloads multiple artifacts where more than one has a digest mismatch to verify the error message correctly lists all affected artifacts.

Suggested change

	test('fails with aggregated message when multiple artifacts have digest mismatches', async () => {
	const mockArtifacts = [
	{
	id: 101,
	name: 'corrupted-artifact-1',
	size: 2048,
	digest: 'hash-1'
	},
	{
	id: 102,
	name: 'corrupted-artifact-2',
	size: 4096,
	digest: 'hash-2'
	}
	]
	// Configure inputs so that digest mismatches cause the action to fail.
	// If 'fail' is the default, this keeps behavior explicit without changing it.
	mockInputs({
	[Inputs.DigestMismatch]: 'fail'
	})
	jest
	.spyOn(artifact.default, 'listArtifacts')
	.mockImplementation(() =>
	Promise.resolve({
	artifacts: mockArtifacts
	})
	)
	jest
	.spyOn(artifact.default, 'downloadArtifact')
	.mockImplementation(() =>
	Promise.resolve({
	digestMismatch: true
	})
	)
	await run()
	expect(core.setFailed).toHaveBeenCalledTimes(1)
	const failureMessage = (core.setFailed as jest.Mock).mock.calls[0][0]
	expect(failureMessage).toEqual(
	expect.stringContaining('corrupted-artifact-1')
	)
	expect(failureMessage).toEqual(
	expect.stringContaining('corrupted-artifact-2')
	)
	})