[David Gamero (davidgamero)]

Summary

• verify freshly downloaded Helm archives against their published SHA-256 checksums before extraction
• preserve compatibility with endpoints and custom mirrors that do not publish checksum files by warning and continuing under the default auto policy
• provide required, if-available, and disabled checksum policies for explicit control
• add an optional downloadBaseURLFallback mirror for version resolution, download, and verification failures
• document the checksum and fallback behavior and credit the fallback use case proposed by Marcus Vinicius Tavares (@mvtavares) in Providing a new optional input to fallback to an alternative url in case the default fails #227

Checksum behavior

checksum-policy defaults to auto:

Policy	Missing checksum	Invalid or mismatched checksum
auto	Warn and continue	Fail
required	Fail	Fail
if-available	Warn and continue	Fail
disabled	Do not request	Do not verify

A checksum is considered missing only when its request returns HTTP 404 or 410. Timeouts, server errors, and other unexpected failures still fail closed. Selecting disabled emits a warning.

The same policy applies independently to primary and fallback downloads. Existing tool-cache entries continue to be reused without downloading or re-verifying the archive.

Checksums come from the same base URL as their archive. Verification detects corruption or incomplete mirror synchronization, but it does not protect against a mirror compromised together with its checksum files.

Validation

• npm test (70 passing)
• npm run typecheck
• npm run format-check
• npm run build
• git diff --check

actionlint still reports the repository's existing missing lib/index.js source-tree warning and deprecated integration-test token input; neither is introduced by this change.

[Suneha Bose (bosesuneha)]

Documenting that this changes v5 behavior: fresh downloads require matching .sha256 files. Archive-only custom mirrors must add them.

[David Gamero (davidgamero)]

Documenting that this changes v5 behavior: fresh downloads require matching .sha256 files. Archive-only custom mirrors must add them.

thanks for catching that. we can start with using the checksum when available without making this a breaking change for custom mirrors since they may not have sums. adding a policy option with default auto where we use checksums on official helm, but allow custom endpoints without and warn on missing checksums for custom mirrors

[Suneha Bose (bosesuneha)]

lgtm