[peter-cg]

Overview

The action now asks for gzip when it downloads endorctl and decodes the response stream. When the server sends gzip, the transfer is about 4x smaller. When it does not, nothing changes. The sha256 check now runs on the installed file itself, and that file must be a regular file.

Changes

• src/download.ts: new downloadDecoded. It sends Accept-Encoding: gzip, decodes when the response has Content-Encoding: gzip, and keeps the old retry behavior (3 attempts on 5xx, 408, 429 and network errors). A corrupt gzip response gets one retry without compression.
• src/utils.ts: the binary is copied byte by byte to ./endorctl, then that copy is hashed and checked, then made executable. A pre-existing ./endorctl symlink is replaced, and its target is not written.
• @actions/tool-cache is no longer used, so it is removed from package.json, the lockfile and .licenses. dist/ is rebuilt; most of its line deletions are that bundled package.

Testing

• yarn lint, yarn format, yarn test (24 passed, 3 skipped, as before) and yarn package.
• New tests use a local HTTP server: a gzip body, a raw body, a wrong checksum after decoding, corrupt gzip with and without recovery, no retry on 404, a retry on 503, and the symlink case. The symlink test was checked to fail with the old copy code.
• Not run: licensed (not installed locally); CI runs it.

---

🥷 harness v1.7.1256-12-g4ee17afdcd · opus-5-5 · default · @main · /gh-signed-commits