s0undt3ch/Setup ToolR
Install the ToolR Rust binary from a GitHub release and verify its SLSA build provenance
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | ToolR version to install, with or without a leading `v` (e.g. `0.20.0` or `v0.20.0`). The special value `latest` resolves to the most recent release tag. The default is bumped to the current release version by `toolr version bump` during release prep — so callers who pin the action (by tag OR by SHA) without passing `version:` get the matching binary for the action.yml they checked out. That makes Renovate / Dependabot SHA pins "just work" without any `version:` input. Versions below `0.20.0` are not accepted — the binary-only release format started with that version. | — | 0.26.0 |
| skip-attestation | Set to `true` to skip `gh attestation verify` on the downloaded archive. Defaults to `false`; the action cryptographically verifies the SLSA build provenance the release workflow attaches to every archive. | — | false |
| github-token | Token used by `gh release download` and `gh attestation verify`. Defaults to the workflow's GITHUB_TOKEN. The token needs the `contents: read` permission scope. | — | ${{ github.token }} |
| cache-prefix | Prefix prepended to the actions/cache keys this action manages — both the toolr-binary cache and the in-tree `tools/.venv` cache. Defaults to `setup-toolr`. Bump the prefix in the caller workflow to force a cache miss without changing the toolr version or the pinned dependencies — useful when invalidating after a runner image upgrade or a corrupted cache entry. | — | setup-toolr |
| cache-tools-venv | When `true` (the default), cache the in-tree `tools/.venv` keyed on `tools/pyproject.toml` and `tools/uv.lock`. Set to `false` if you want toolr to rebuild the venv on every run. | — | true |
| sync-args | Extra arguments appended to the `uv sync` invocation the action runs to materialise the tools venv. Whitespace-split shell-style; do not quote each flag. Useful for opting back into a dependency group the default `--no-default-groups` would skip (e.g. `--group lint`). Defaults to empty. | — | "" |
| uv-version | uv version to install via `astral-sh/setup-uv` when uv isn't already on PATH (or when this input is non-empty, in which case setup-uv runs regardless and overrides whatever's on PATH). Accepts anything `astral-sh/setup-uv` accepts — bare semver (`0.5.1`), with leading `v` (`v0.5.1`), or `latest`. Empty (the default) means "no version pin": if uv is missing setup-uv installs its own default; if uv is already on PATH the action leaves it alone. | — | "" |
Outputs
| name | description |
|---|---|
| version | Resolved ToolR version installed (no leading `v`). |
| bin-dir | Directory containing the `toolr` binary (already on PATH). |
| bin-path | Absolute path to the installed `toolr` binary. |