| name | updating-checksums |
| description | Syncs SHA-256 checksums from GitHub releases to bundle-tools.json. Triggers when user mentions "update checksums", "sync checksums", or after releasing new tool versions.
|
| user-invocable | true |
| allowed-tools | Bash, Read, Edit |
updating-checksums
Your task is to sync SHA-256 checksums from GitHub releases to the embedded `bundle-tools.json` file, ensuring SEA builds have up-to-date integrity verification.
- Network access required to fetch from GitHub API.
- Only `github-release` type tools are synced (not npm or pypi).
- Never modify checksums manually; always fetch from releases.
- Verify JSON validity after sync.
- Review changes before committing.
Phases
- Check Current State - Review current checksums and tool versions in
packages/cli/bundle-tools.json.
- Sync Checksums - Run
node packages/cli/scripts/sync-checksums.mjs. Tries checksums.txt from the release first; falls back to downloading assets and computing SHA-256.
- Verify Changes -
git diff packages/cli/bundle-tools.json; validate JSON syntax.
- Commit Changes - If updated, commit
packages/cli/bundle-tools.json.
Commands
node packages/cli/scripts/sync-checksums.mjs
node packages/cli/scripts/sync-checksums.mjs --tool=opengrep
node packages/cli/scripts/sync-checksums.mjs --dry-run
node packages/cli/scripts/sync-checksums.mjs --force
