setup-goose-action

Renovate bot runs weekly and creates PRs for the Goose binary version in action.yml and GitHub Actions digest updates. SECURITY.md defines a 14-day remediation SLA for security issues. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/renovate.json

GitHub Issues used as the primary tracker for bugs, enhancements, and CI fixes. URL: https://github.com/clouatre-labs/setup-goose-action/issues

SECURITY.md 'Reporter Credit' section commits to acknowledging reporters by name (or pseudonym) in the release notes for each fixed vulnerability. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/SECURITY.md

SECURITY.md 'Response Timeline' table defines acknowledgement and remediation targets for critical/high and medium/low severity. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/SECURITY.md

CONTRIBUTING.md documents coding standards: bash POSIX compatibility, explicit error handling, no hardcoded versions outside the renovate-tracked block, conventional commits, and GPG + DCO sign-off. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/CONTRIBUTING.md

Zizmor runs on every PR and is a required CI check, enforcing GitHub Actions security standards. actionlint validates workflow YAML. The CI Result gate blocks merge if any check fails. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/.github/workflows/test.yml

There is no compiled build step. The action uses only standard GitHub Actions environment variables (GITHUB_OUTPUT, GITHUB_PATH, GITHUB_TOKEN) as documented by GitHub. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/action.yml

There is no compiled build step that strips debug info. The action runs bash directly; debug output is preserved via echo "::group::" and echo "::endgroup::" in all install steps. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/action.yml

There is no recursive build process. The action is a single action.yml file with no sub-actions or recursive Make-style invocations. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/action.yml

The action downloads a pinned version of Goose (user-specified via version input). Given the same version and runner platform, the result is deterministic. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/action.yml

uses: clouatre-labs/setup-goose-action@v1 follows the standard GitHub Actions reuse convention. URL: https://github.com/clouatre-labs/setup-goose-action#usage

The action uses only standard GitHub Actions environment variables. No non-standard environment variables are required by callers. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/action.yml

CONTRIBUTING.md Quick Start: clone the repository, edit action.yml or the test workflow, push and let CI run. Three steps from a fresh clone to verified changes. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/CONTRIBUTING.md

action.yml lists all external dependencies explicitly: actions/cache and actions/checkout (both SHA-pinned). Renovate manages digest updates. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/action.yml

Renovate bot runs weekly and creates PRs for GitHub Actions digest updates and Goose binary version bumps in action.yml. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/renovate.json

All external actions are SHA-pinned and tracked by Renovate for automatic update PRs. No vendored or forked dependencies. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/renovate.json

README documents all inputs and outputs with descriptions. action.yml is the authoritative interface definition. Documentation is updated with each release. URL: https://github.com/clouatre-labs/setup-goose-action#inputs

The test workflow contains end-to-end integration tests that exercise all inputs and outputs on real GitHub Actions runners, including cache behavior and version resolution. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/.github/workflows/test.yml

Bug-fix PRs include regression tests. The cache flakiness fix (#93/#95) added a dedicated 'Test caching (install)' job and split cache verification into separate jobs to prevent recurrence. URL: https://github.com/clouatre-labs/setup-goose-action/pull/95

The action has 5 distinct behaviors, all tested: default install, cache miss, cache restore, version pinning, and check-latest. The test suite covers all executable code paths in action.yml. As a bash/YAML action, traditional line coverage tools do not apply; behavioral coverage is 100%. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/.github/workflows/test.yml

The PR template requires a Test Plan section. CI must pass (including all test jobs) before a PR can be merged. Branch protection enforces this via the CI Result required check. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/.github/PULL_REQUEST_TEMPLATE.md

The PR template requires a Test Plan section documenting what was tested. CONTRIBUTING.md covers test requirements. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/.github/PULL_REQUEST_TEMPLATE.md

Zizmor is run with annotations=true and min-severity=high. All flagged issues must be resolved before merge. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/.github/workflows/test.yml

ASSURANCE.md documents the security assurance case: HTTPS-only downloads, no credential handling, minimal permissions, SHA-pinned dependencies, and explicit trust boundary definitions. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/ASSURANCE.md

Not applicable -- the action does not implement cryptography.

Not applicable -- the action does not implement cryptography.

Not applicable -- the action does not handle credentials or cryptographic keys.

Not applicable -- the action does not implement network protocols; HTTPS is provided by curl and the GitHub infrastructure.

Not applicable -- TLS is handled by the curl binary on the runner, not by the action.

Not applicable -- certificate verification is handled by curl. curl with -fsSL defaults to certificate verification.

Not applicable -- the action does not use private keys.

Release tags are GPG-signed annotated tags (e.g., v1.0.6 tag includes a PGP signature in its message). The 'Release Tag Protection' org-level ruleset enforces signed tags. URL: https://github.com/clouatre-labs/setup-goose-action/tags

Every release tag is a GPG-signed annotated tag (verified: v1.0.6 tag object contains a PGP signature block). Tag signing is required by the org-level 'Release Tag Protection' ruleset. URL: https://github.com/clouatre-labs/setup-goose-action/tags

action.yml validates the version input against a semver regex (^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$) before use in both the resolve-version and install steps. Invalid versions produce an explicit error message and fail the step. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/action.yml

action.yml uses explicit bash error handling. All GitHub Actions are SHA-pinned. The workflow uses minimal permissions (contents: read). zizmor enforcement ensures no template injection or dangerous patterns. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/action.yml

ASSURANCE.md is a dedicated security assurance case covering trust boundaries, attack surface, common weaknesses countered, supply chain hardening, and a dated security review. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/ASSURANCE.md

Zizmor specifically checks for GitHub Actions security vulnerabilities (template injection, dangerous permissions, unpinned actions). actionlint validates workflow structure. URL: https://github.com/clouatre-labs/setup-goose-action/blob/main/.github/workflows/test.yml

Not applicable -- the action is written in bash and YAML, not a memory-unsafe language. No unsafe memory operations are possible.