ci: download Gitea tool binaries

.gitea/workflows/fuzz.yml

@@ -16,6 +16,7 @@ env:
   CARGO_TERM_COLOR: always
   # Pinned for reproducibility; bump deliberately alongside `fuzz/Cargo.lock`.
   CARGO_FUZZ_VERSION: 0.13.1
+  CARGO_FUZZ_SHA256: 86edc9b8f20c29ff07c3e5fcd67bc3f0784b3b960a5428635060f20d50555461
 
 jobs:
   fuzz-smoke:
@@ -44,7 +45,16 @@ jobs:
         run: rustup toolchain install nightly --profile minimal --no-self-update
 
       - name: Install cargo-fuzz
-        run: cargo install cargo-fuzz --locked --version "${CARGO_FUZZ_VERSION}"
+        run: |
+          set -euo pipefail
+          archive="cargo-fuzz-${CARGO_FUZZ_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+          curl --fail --show-error --location --retry 3 \
+            "https://github.com/rust-fuzz/cargo-fuzz/releases/download/${CARGO_FUZZ_VERSION}/${archive}" \
+            --output "$archive"
+          echo "${CARGO_FUZZ_SHA256}  ${archive}" | sha256sum --check --status -
+          tar -xzf "$archive" cargo-fuzz
+          install -Dm755 cargo-fuzz "${RUNNER_TEMP}/bin/cargo-fuzz"
+          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"
 
       - name: Build all fuzz targets
         run: cargo +nightly fuzz build

.gitea/workflows/semver.yml

@@ -13,6 +13,10 @@ on:
 permissions:
   contents: read
 
+env:
+  CARGO_SEMVER_CHECKS_VERSION: 0.50.0
+  CARGO_SEMVER_CHECKS_SHA256: 52a65dc88dc53fa8b57d6087954eb52cda149ca03bcfca78ce3fdecd23f893c4
+
 jobs:
   semver:
     name: cargo-semver-checks
@@ -30,11 +34,19 @@ jobs:
         with:
           cache: false
 
-      # The action wrapper downloads through the GitHub API and uses the
-      # GitHub cache service. The underlying CLI is portable and preserves
-      # the existing wrapper's `feature-group: all-features` behavior.
+      # The CLI preserves the previous wrapper's `feature-group: all-features`
+      # behavior without its GitHub API/cache dependency.
       - name: Install cargo-semver-checks
-        run: cargo install cargo-semver-checks --locked
+        run: |
+          set -euo pipefail
+          archive="cargo-semver-checks-x86_64-unknown-linux-gnu.tar.gz"
+          curl --fail --show-error --location --retry 3 \
+            "https://github.com/obi1kenobi/cargo-semver-checks/releases/download/v${CARGO_SEMVER_CHECKS_VERSION}/${archive}" \
+            --output "$archive"
+          echo "${CARGO_SEMVER_CHECKS_SHA256}  ${archive}" | sha256sum --check --status -
+          tar -xzf "$archive" cargo-semver-checks
+          install -Dm755 cargo-semver-checks "${RUNNER_TEMP}/bin/cargo-semver-checks"
+          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"
 
       - name: Check semver compatibility
         run: cargo semver-checks check-release --all-features

.gitea/workflows/supply-chain.yml

@@ -16,8 +16,9 @@ permissions:
 
 env:
   ACTIONLINT_VERSION: 1.7.7
-  # Match the version embedded in the replaced cargo-deny Docker action.
   CARGO_DENY_VERSION: 0.20.2
+  CARGO_DENY_SHA256: 9f12ed4c49936e09b48bf862b595cde2fe64fcbd9d74dfacac6131ca824c8d5f
+  ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
 
 jobs:
   cargo-deny:
@@ -47,7 +48,17 @@ jobs:
           persist-credentials: false
 
       - name: Install cargo-deny
-        run: cargo install cargo-deny --locked --version "${CARGO_DENY_VERSION}"
+        run: |
+          set -euo pipefail
+          archive="cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+          curl --fail --show-error --location --retry 3 \
+            "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/${archive}" \
+            --output "$archive"
+          echo "${CARGO_DENY_SHA256}  ${archive}" | sha256sum --check --status -
+          tar -xzf "$archive" --strip-components=1 \
+            "cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl/cargo-deny"
+          install -Dm755 cargo-deny "${RUNNER_TEMP}/bin/cargo-deny"
+          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"
 
       - name: Run cargo-deny
         run: >-
@@ -66,14 +77,23 @@ jobs:
           persist-credentials: false
 
       - name: Install actionlint
-        run: go install github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION}
+        run: |
+          set -euo pipefail
+          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          curl --fail --show-error --location --retry 3 \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}" \
+            --output "$archive"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum --check --status -
+          tar -xzf "$archive" actionlint
+          install -Dm755 actionlint "${RUNNER_TEMP}/bin/actionlint"
+          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"
 
       - name: actionlint handwritten workflows
         # actionlint validates GitHub Actions syntax. It cannot parse Gitea's
         # required absolute action URL in interop-netem.yml, so that workflow
         # is checked by the Gitea runner instead.
         run: |
-          "$(go env GOPATH)/bin/actionlint" \
+          actionlint \
             .gitea/workflows/ci.yml \
             .gitea/workflows/docker-publish.yml \
             .gitea/workflows/fuzz.yml \
@@ -86,5 +106,4 @@ jobs:
 
       - name: actionlint generated release workflow
         run: >-
-          "$(go env GOPATH)/bin/actionlint" -shellcheck=
-          .github/workflows/irtt-rs-release.yml
+          actionlint -shellcheck= .github/workflows/irtt-rs-release.yml