The validate job checks configs but never executes install.sh, which is what actually rots (apt repo URLs, GPG fingerprints, pinned checksums). New job runs the complete install plus --unlink as a normal user in a pristine ubuntu:24.04 container. Dependabot keeps the pinned GitHub Actions current monthly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| validate.yml | ||