[dennisklein]

Updates the action for sind's release attestations, the --wait flag of sind create cluster and the release-tied default node image. There is one commit per change, plus a hardening fix to the attestation check. sind's newest release is still v0.10.0, so "after v0.10.0" below means the next release (planned as v0.11.0).

Behaviour changes

• Binary verification is on by default (feat: verify the sind binary before installing it, hardened by fix: pin the attestation signer exactly and require gh 2.93.0).
  • install.sh now downloads into a temp dir and installs into ~/.local/bin only after the binary passes verification, so no unverified binary is ever run.
  • For sind v0.10.0 and later:
    • The binary's sha256 must match the release's checksums.txt. This check always runs.
    • With verify: true (the new default), gh attestation verify must pass, with --repo GSI-HPC/sind --cert-identity https://github.com/GSI-HPC/sind/.github/workflows/release.yml@refs/tags/<version> --source-ref refs/tags/<version> --deny-self-hosted-runners.
  • The exact --cert-identity replaces --signer-workflow. gh before 2.102.0, which the runners ship today (2.101.0), matches --signer-workflow only as a prefix and compares --source-ref case-insensitively (GHSA-wjmr-j3rp-mh2g, GHSA-4mq3-hpgx-9cx8). The exact identity pins the workflow and the tag together. It assumes sind's release.yml keeps running on the tag push; if it becomes a reusable workflow, verification fails closed.
  • The check needs gh 2.93.0 or later, which fixes a token leak to TUF mirrors (GHSA-8xvp-7hj6-mcj9). The install step sets GH_HOST: github.com.
  • v0.8.0 and v0.9.0 have neither checksums nor attestations, so they install with a ::notice::. MIN_VERSION stays v0.8.0.
  • Runners without gh 2.93.0 or later now fail with an ::error:: that names verify: false, unless they set it. GitHub-hosted runners have gh, but self-hosted runners may not. Maintainer decision: is this a minor or a major release?
• New inputs:
  • verify (default 'true'): turns the attestation check off. The checksum is still checked.
  • token (default ${{ github.token }}): passed as GH_TOKEN to the install step only.
  • wait (default '', meaning sind's default): passed as sind create cluster --wait on sind releases after v0.10.0, decided from sind version --json. Older sind gets a ::warning:: and the input is ignored. sind validates the value. When the limit expires, sind removes the partly created cluster and the step fails with the existing ::error::.
• README:
  • The gh requirement (2.93.0 or later), the hosts gh contacts, and the github.com token needed on GitHub Enterprise Server.
  • Rootful Docker (not rootless or userns-remap) on unified cgroup v2.
  • The new inputs, which match action.yml.
  • Releases after v0.10.0 default to sind-node:vX.Y.Z, so pinning version also pins Slurm.
  • The moving <YY>.<MM> and fixed vX.Y.Z-<YY>.<MM> tags, and that pull: true fetches the current image behind a moving tag.
  • No fixed image tags exist yet: v0.10.0's image workflow has no tag trigger. So the copy-paste matrix example keeps <YY>.<MM> and says that it moves. The reproducible form is shown with a vX.Y.Z placeholder and can become the main example once the next release is out.

Test plan

• shellcheck scripts/*.sh and actionlint are clean.
• install.sh run locally against stub curl and gh:
  • Passes: a good binary, with gh 2.101.0 and 2.93.0.
  • Fails, and installs nothing: a wrong checksum (with verify on and off), a failed attestation, missing gh, gh 2.92.0, gh 2.45.0, an unparsable gh --version, a missing checksums.txt, a checksums.txt without the asset, and an invalid verify value.
  • Installs with a notice: v0.9.0 and 0.8.0 (unverified), missing or old gh with verify: false, and a newer release resolved via latest.
• create.sh run locally against a stub sind at 0.8.0, 0.9.0, 0.10.0, 0.10.1-next and 0.11.0, with and without wait. It warns up to 0.10.0 and passes --wait 10m after it. An invalid value surfaces as the existing ::error::.
• The new CI step was run locally against a fake release. It passes, and it fails when the checksum check is removed from install.sh.
• e2e is green on all three matrix entries, with wait: 10m. Every entry shows the warning path for now: sind v0.8.0, and v0.10.0 as latest.
• On latest (x64 and ARM64, gh 2.101.0), the real attestation check passes with the exact --cert-identity and github.token under permissions: contents: read. The step "Check that a modified binary is rejected" passes: with one byte of the binary changed, the checksum check rejects it with verify: false, and with checksums.txt rewritten to match, the real gh attestation verify rejects it.
• After the next sind release: e2e on latest passes the real --wait 10m.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vjm6Tjihdc6veGRDr47bTw