Replace "MrOctopus/download-asset-action" action #664
Description
Describe the request
Replace usage of MrOctopus/download-asset-action action in workflows.
Go module based tools that are currently downloaded via the action should be managed via the Go tools system, as is already done for the yq (#652) and Task (#659) dependencies. These consist of the following:
- editorconfig-checker
- shfmt
Some alternative system should be used for the other tools:
- ClangFormat
- shellcheck
- APT is an officially supported installation method:
https://github.com/koalaman/shellcheck#installing
However, the version in the Ubuntu package repository is outdated (https://launchpad.net/ubuntu/+source/shellcheck) so I think that is an unsuitable method. - The Snap package is another officially supported installation method, and the package is up to date:
https://snapcraft.io/shellcheck
So I think this would be the best alternative to the current release binary download installation method.
- APT is an officially supported installation method:
🙂 The assets and infrastructure will have a reliable mechanism for downloading tools.
🙂 Versioning of Go module-based tools will be managed.
Describe the current behavior
The asset and infrastructure workflows use the MrOctopus/download-asset-action action to download tool dependencies that are distributed in the form of GitHub release assets.
The 1.1 release of the action was fundamentally broken (MrOctopus/download-asset-action#8), in a manner that would have been noticed if the maintainer had performed the most basic check of functionality before making the change that introduced the regression (or at the very least, the release).
The bug was fixed (MrOctopus/download-asset-action@d66a497), however, distribution of the fix was handled by moving the existing 1.1 tag instead of making a new tag.
🙁 These two events make it clear that the action is not maintained in a manner that meets the standards we must hold the assets and infrastructure to.