From 20d2753bea0e49116592c4d69677b4447394f711 Mon Sep 17 00:00:00 2001 From: Alex Chapin Date: Tue, 13 Oct 2026 22:32:08 -0400 Subject: [PATCH 1/2] ci: pin IFW 4.3.0 installer SHA-256, add workflow_dispatch for full package builds (#341) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/build_pat.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_pat.yaml b/.github/workflows/build_pat.yaml index 765fe3cf..4515ab47 100755 --- a/.github/workflows/build_pat.yaml +++ b/.github/workflows/build_pat.yaml @@ -1,6 +1,7 @@ name: Build_PAT on: + workflow_dispatch: pull_request: types: - opened @@ -72,7 +73,8 @@ jobs: sudo apt install cmake elif [ "$RUNNER_OS" == "macOS" ]; then if [ "$GITHUB_EVENT_NAME" != "pull_request" ]; then - curl -L -O https://download.qt.io/archive/qt-installer-framework/4.3.0/QtInstallerFramework-macOS-x64-4.3.0.dmg + curl -fL -O https://download.qt.io/archive/qt-installer-framework/4.3.0/QtInstallerFramework-macOS-x64-4.3.0.dmg + echo "8c72d42414071d4f2c60825613f90fd52cd42a63e72a76b0c391fdd13d9ed0be QtInstallerFramework-macOS-x64-4.3.0.dmg" | shasum -a 256 -c - hdiutil attach -mountpoint ./qtfiw_installer QtInstallerFramework-macOS-x64-4.3.0.dmg echo "ls ./qtfiw_installer" sudo ./qtfiw_installer/QtInstallerFramework-macOS-x64-4.3.0.app/Contents/MacOS/QtInstallerFramework-macOS-x64-4.3.0 --verbose --script ./ci/install_script_qtifw.qs @@ -83,7 +85,8 @@ jobs: # echo CMAKE_MACOSX_DEPLOYMENT_TARGET='-DCMAKE_OSX_DEPLOYMENT_TARGET=$MACOSX_DEPLOYMENT_TARGET' >> $GITHUB_ENV elif [ "$RUNNER_OS" == "Windows" ]; then if [ "$GITHUB_EVENT_NAME" != "pull_request" ]; then - curl -L -O https://download.qt.io/archive/qt-installer-framework/4.3.0/QtInstallerFramework-windows-x86-4.3.0.exe + curl -fL -O https://download.qt.io/archive/qt-installer-framework/4.3.0/QtInstallerFramework-windows-x86-4.3.0.exe + echo "b8857048b2bb9eb0b390c78d99e858a036d671fa83c6a8c58c66548decde6bc7 QtInstallerFramework-windows-x86-4.3.0.exe" | sha256sum -c - ./QtInstallerFramework-windows-x86-4.3.0.exe --verbose --script ./ci/install_script_qtifw.qs dir "C:/Qt/" echo "C:/Qt/QtIFW-4.3.0/bin" >> $GITHUB_PATH From 9c0c4dd49b15b1810b4437a6e330606ed8fd599e Mon Sep 17 00:00:00 2001 From: Alex Chapin Date: Tue, 13 Oct 2026 22:33:36 -0400 Subject: [PATCH 2/2] ci: least-privilege token permissions for Build_PAT --- .github/workflows/build_pat.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build_pat.yaml b/.github/workflows/build_pat.yaml index 4515ab47..6376119e 100755 --- a/.github/workflows/build_pat.yaml +++ b/.github/workflows/build_pat.yaml @@ -19,6 +19,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.run_id }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} +permissions: + contents: read + jobs: pat_build: name: Build ${{ matrix.name }}