ci: download Gitea tool binaries

.gitea/workflows/supply-chain.yml

@@ -16,8 +16,9 @@ permissions:
 
 env:
   ACTIONLINT_VERSION: 1.7.7
-  # Match the version embedded in the replaced cargo-deny Docker action.
   CARGO_DENY_VERSION: 0.20.2
+  CARGO_DENY_SHA256: 9f12ed4c49936e09b48bf862b595cde2fe64fcbd9d74dfacac6131ca824c8d5f
+  ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
 
 jobs:
   cargo-deny:
@@ -47,7 +48,17 @@ jobs:
           persist-credentials: false
 
       - name: Install cargo-deny
-        run: cargo install cargo-deny --locked --version "${CARGO_DENY_VERSION}"
+        run: |
+          set -euo pipefail
+          archive="cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+          curl --fail --show-error --location --retry 3 \
+            "https://github.com/EmbarkStudios/cargo-deny/releases/download/${CARGO_DENY_VERSION}/${archive}" \
+            --output "$archive"
+          echo "${CARGO_DENY_SHA256}  ${archive}" | sha256sum --check --status -
+          tar -xzf "$archive" --strip-components=1 \
+            "cargo-deny-${CARGO_DENY_VERSION}-x86_64-unknown-linux-musl/cargo-deny"
+          install -Dm755 cargo-deny "${RUNNER_TEMP}/bin/cargo-deny"
+          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"
 
       - name: Run cargo-deny
         run: >-
@@ -66,14 +77,23 @@ jobs:
           persist-credentials: false
 
       - name: Install actionlint
-        run: go install github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION}
+        run: |
+          set -euo pipefail
+          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          curl --fail --show-error --location --retry 3 \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}" \
+            --output "$archive"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum --check --status -
+          tar -xzf "$archive" actionlint
+          install -Dm755 actionlint "${RUNNER_TEMP}/bin/actionlint"
+          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"
 
       - name: actionlint handwritten workflows
         # actionlint validates GitHub Actions syntax. It cannot parse Gitea's
         # required absolute action URL in interop-netem.yml, so that workflow
         # is checked by the Gitea runner instead.
         run: |
-          "$(go env GOPATH)/bin/actionlint" \
+          actionlint \
             .gitea/workflows/ci.yml \
             .gitea/workflows/docker-publish.yml \
             .gitea/workflows/fuzz.yml \
@@ -86,5 +106,4 @@ jobs:
 
       - name: actionlint generated release workflow
         run: >-
-          "$(go env GOPATH)/bin/actionlint" -shellcheck=
-          .github/workflows/irtt-rs-release.yml
+          actionlint -shellcheck= .github/workflows/irtt-rs-release.yml