A GitHub Action that installs Panache and runs formatting and lint checks for Quarto and other Markdown flavors in CI.
The action installs prebuilt release artifacts and supports GitHub-hosted runners for Linux, macOS, and Windows on both x64 and ARM64. Downloaded binaries are verified against the release's SHA256 checksum manifest and build provenance attestation, and cached between runs.
name: panache
on:
pull_request:
push:
branches: [main]
jobs:
panache:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: jolars/panache-action@v1- uses: jolars/panache-action@v1
with:
version: v2.23.0- uses: jolars/panache-action@v1
with:
lint: "false"- uses: jolars/panache-action@v1
with:
format: "false"- uses: jolars/panache-action@v1
with:
path: docs/- uses: jolars/panache-action@v1
with:
config: .panache.toml| Input | Description | Default |
|---|---|---|
path |
File or directory to check | . |
version |
Panache version to install (latest or vX.Y.Z) |
latest |
format |
Run panache format --check |
true |
quiet |
Suppress the format --check diff (list only) |
false |
lint |
Run panache lint |
true |
config |
Optional path to panache config file | "" |
verify-checksum |
Verify the downloaded archive against its SHA256 | true |
| Output | Description |
|---|---|
version |
Installed panache CLI version |
Every panache release publishes a SHA256SUMS manifest covering its release
assets. When verify-checksum is true (the default), this action verifies
the downloaded archive against that manifest before installing; if a checksum
mismatches, the install fails. Releases that predate the manifest are installed
with a warning.
To verify a download by hand:
# Download the archive and the manifest for your platform/version
curl -fLO https://github.com/jolars/panache/releases/download/v2.23.0/panache-x86_64-unknown-linux-gnu.tar.gz
curl -fLO https://github.com/jolars/panache/releases/download/v2.23.0/SHA256SUMS
# Check just this archive against the manifest
sha256sum --ignore-missing -c SHA256SUMSChecksums guard against corrupted or truncated downloads; they are not a substitute for release signing.
Release archives also carry a build provenance
attestation,
signed via Sigstore and tied to the workflow that built them. Unlike the
checksum manifest, this cannot be forged by an attacker who only controls the
release assets. When the gh CLI is available, this action verifies it before
installing; a failing attestation aborts the install, while a missing one
(older releases) or a missing gh warns and continues.
To verify by hand:
gh attestation verify panache-x86_64-unknown-linux-gnu.tar.gz \
--repo jolars/panacheAdd --signer-workflow jolars/panache/.github/workflows/packages.yml to also
pin the exact workflow that must have produced the artifact.
This action uses semantic versioning based on action API changes:
- Major: breaking changes to action inputs/outputs/behavior
- Minor: backward-compatible features
- Patch: fixes and internal improvements
Use @v1 for stable major updates, or pin exact tags like @v1.2.3.
