From 4b6cd891384fd14faa72b250485949e07e596f20 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Mon, 27 May 2024 12:49:59 +0000
Subject: [PATCH 01/22] feat: support downloading from url

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 action.yml         |  8 +++-
 dist/index.js      | 32 +++++++++++-----
 package-lock.json  | 91 +++++++++++++++++++++++++++++++---------------
 src/lib/release.ts | 10 ++++-
 src/setup.ts       | 23 ++++++++----
 5 files changed, 116 insertions(+), 48 deletions(-)

diff --git a/action.yml b/action.yml
index a75273e..54ccb80 100644
--- a/action.yml
+++ b/action.yml
@@ -18,9 +18,15 @@ branding:
   color: blue
 inputs:
   version:
-    description: Version of ORAS CLI to install
+    description: Version of official ORAS CLI to install
     required: false
     default: 1.1.0
+  url:
+    description: URL of customized ORAS CLI to install
+    required: false
+  checksum:
+    description: SHA256 of the customized ORAS CLI. Required if 'url' is present.
+    required: false
 runs:
   using: node20
   main: dist/index.js
diff --git a/dist/index.js b/dist/index.js
index c47bc41..184798a 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -6691,7 +6691,15 @@ exports.getBinaryExtension = exports.mapArch = exports.mapPlatform = exports.get
 const os = __importStar(__nccwpck_require__(2037));
 const releases_json_1 = __importDefault(__nccwpck_require__(2387));
 // Get release info of a certain verion of ORAS CLI
-function getReleaseInfo(version) {
+function getReleaseInfo(version, url, checksum) {
+    // customized ORAS CLI
+    if (url && checksum) {
+        return {
+            checksum: checksum,
+            url: url
+        };
+    }
+    // official
     const releases = releases_json_1.default;
     if (!(version in releases)) {
         console.log(`official ORAS CLI releases does not contain version ${version}`);
@@ -6808,19 +6816,25 @@ function setup() {
         try {
             // inputs from user
             const version = core.getInput('version');
+            const url = core.getInput('url');
+            const checksum = core.getInput('checksum').toLowerCase();
+            // sanity check
+            if (url && !checksum) {
+                throw new Error("user provided url of customized ORAS CLI release but without SHA256 checksum");
+            }
             // download ORAS CLI and validate checksum
-            const info = (0, release_1.getReleaseInfo)(version);
-            const url = info.url;
-            console.log(`downloading ORAS CLI from ${url}`);
-            const pathToTarball = yield tc.downloadTool(url);
+            const info = (0, release_1.getReleaseInfo)(version, url, checksum);
+            const download_url = info.url;
+            console.log(`downloading ORAS CLI from ${download_url}`);
+            const pathToTarball = yield tc.downloadTool(download_url);
             console.log("downloading ORAS CLI completed");
-            const checksum = yield (0, checksum_1.hash)(pathToTarball);
-            if (checksum !== info.checksum) {
-                throw new Error(`checksum of downloaded ORAS CLI ${checksum} does not match expected checksum ${info.checksum}`);
+            const actual_checksum = yield (0, checksum_1.hash)(pathToTarball);
+            if (actual_checksum !== info.checksum) {
+                throw new Error(`checksum of downloaded ORAS CLI ${actual_checksum} does not match expected checksum ${info.checksum}`);
             }
             console.log("successfully verified downloaded release checksum");
             // extract the tarball/zipball onto host runner
-            const extract = url.endsWith('.zip') ? tc.extractZip : tc.extractTar;
+            const extract = download_url.endsWith('.zip') ? tc.extractZip : tc.extractTar;
             const pathToCLI = yield extract(pathToTarball);
             // add `ORAS` to PATH
             core.addPath(pathToCLI);
diff --git a/package-lock.json b/package-lock.json
index 6d1efd5..1ae01db 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,88 +1,121 @@
 {
   "name": "setup-oras",
   "version": "0.1.0",
-  "lockfileVersion": 1,
+  "lockfileVersion": 3,
   "requires": true,
-  "dependencies": {
-    "@actions/core": {
+  "packages": {
+    "": {
+      "name": "setup-oras",
+      "version": "0.1.0",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@actions/core": "^1.10.0",
+        "@actions/tool-cache": "^2.0.1",
+        "@types/node": "^20.4.0",
+        "@vercel/ncc": "^0.36.1",
+        "typescript": "^5.2.2"
+      }
+    },
+    "node_modules/@actions/core": {
       "version": "1.10.0",
       "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
       "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
-      "requires": {
+      "dependencies": {
         "@actions/http-client": "^2.0.1",
         "uuid": "^8.3.2"
       }
     },
-    "@actions/exec": {
+    "node_modules/@actions/exec": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
       "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
-      "requires": {
+      "dependencies": {
         "@actions/io": "^1.0.1"
       }
     },
-    "@actions/http-client": {
+    "node_modules/@actions/http-client": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.1.1.tgz",
       "integrity": "sha512-qhrkRMB40bbbLo7gF+0vu+X+UawOvQQqNAA/5Unx774RS8poaOhThDOG6BGmxvAnxhQnDp2BG/ZUm65xZILTpw==",
-      "requires": {
+      "dependencies": {
         "tunnel": "^0.0.6"
       }
     },
-    "@actions/io": {
+    "node_modules/@actions/io": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
       "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
     },
-    "@actions/tool-cache": {
+    "node_modules/@actions/tool-cache": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/@actions/tool-cache/-/tool-cache-2.0.1.tgz",
       "integrity": "sha512-iPU+mNwrbA8jodY8eyo/0S/QqCKDajiR8OxWTnSk/SnYg0sj8Hp4QcUEVC1YFpHWXtrfbQrE13Jz4k4HXJQKcA==",
-      "requires": {
+      "dependencies": {
         "@actions/core": "^1.2.6",
         "@actions/exec": "^1.0.0",
         "@actions/http-client": "^2.0.1",
         "@actions/io": "^1.1.1",
         "semver": "^6.1.0",
         "uuid": "^3.3.2"
-      },
-      "dependencies": {
-        "uuid": {
-          "version": "3.4.0",
-          "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-          "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A=="
-        }
       }
     },
-    "@types/node": {
+    "node_modules/@actions/tool-cache/node_modules/uuid": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
+      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
+      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
+      "bin": {
+        "uuid": "bin/uuid"
+      }
+    },
+    "node_modules/@types/node": {
       "version": "20.5.9",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-20.5.9.tgz",
       "integrity": "sha512-PcGNd//40kHAS3sTlzKB9C9XL4K0sTup8nbG5lC14kzEteTNuAFh9u5nA0o5TWnSG2r/JNPRXFVcHJIIeRlmqQ=="
     },
-    "@vercel/ncc": {
+    "node_modules/@vercel/ncc": {
       "version": "0.36.1",
       "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.36.1.tgz",
-      "integrity": "sha512-S4cL7Taa9yb5qbv+6wLgiKVZ03Qfkc4jGRuiUQMQ8HGBD5pcNRnHeYM33zBvJE4/zJGjJJ8GScB+WmTsn9mORw=="
+      "integrity": "sha512-S4cL7Taa9yb5qbv+6wLgiKVZ03Qfkc4jGRuiUQMQ8HGBD5pcNRnHeYM33zBvJE4/zJGjJJ8GScB+WmTsn9mORw==",
+      "bin": {
+        "ncc": "dist/ncc/cli.js"
+      }
     },
-    "semver": {
+    "node_modules/semver": {
       "version": "6.3.1",
       "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
     },
-    "tunnel": {
+    "node_modules/tunnel": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
-      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
+      "engines": {
+        "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
+      }
     },
-    "typescript": {
+    "node_modules/typescript": {
       "version": "5.2.2",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.2.2.tgz",
-      "integrity": "sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w=="
+      "integrity": "sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w==",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
     },
-    "uuid": {
+    "node_modules/uuid": {
       "version": "8.3.2",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
     }
   }
 }
diff --git a/src/lib/release.ts b/src/lib/release.ts
index c0c0a89..779a38e 100644
--- a/src/lib/release.ts
+++ b/src/lib/release.ts
@@ -27,7 +27,15 @@ interface releases {
 }
 
 // Get release info of a certain verion of ORAS CLI
-export function getReleaseInfo(version: string) {
+export function getReleaseInfo(version: string, url: string, checksum: string) {
+    // customized ORAS CLI
+    if (url && checksum) {
+        return {
+            checksum: checksum, 
+            url: url
+        } 
+    }
+    // official
     const releases = releaseJson as releases;
     if (!(version in releases)) {
         console.log(`official ORAS CLI releases does not contain version ${version}`)
diff --git a/src/setup.ts b/src/setup.ts
index f40f508..68e2bda 100644
--- a/src/setup.ts
+++ b/src/setup.ts
@@ -21,21 +21,28 @@ async function setup(): Promise<void> {
   try {
     // inputs from user
     const version: string = core.getInput('version');
+    const url: string = core.getInput('url');
+    const checksum = core.getInput('checksum').toLowerCase();
+
+    // sanity check
+    if (url && !checksum) {
+      throw new Error("user provided url of customized ORAS CLI release but without SHA256 checksum");
+    }
 
     // download ORAS CLI and validate checksum
-    const info = getReleaseInfo(version);
-    const url = info.url;
-    console.log(`downloading ORAS CLI from ${url}`);
-    const pathToTarball: string = await tc.downloadTool(url);
+    const info = getReleaseInfo(version, url, checksum);
+    const download_url = info.url;
+    console.log(`downloading ORAS CLI from ${download_url}`);
+    const pathToTarball: string = await tc.downloadTool(download_url);
     console.log("downloading ORAS CLI completed");
-    const checksum = await hash(pathToTarball);
-    if (checksum !== info.checksum) {
-      throw new Error(`checksum of downloaded ORAS CLI ${checksum} does not match expected checksum ${info.checksum}`);
+    const actual_checksum = await hash(pathToTarball);
+    if (actual_checksum !== info.checksum) {
+      throw new Error(`checksum of downloaded ORAS CLI ${actual_checksum} does not match expected checksum ${info.checksum}`);
     }
     console.log("successfully verified downloaded release checksum");
 
     // extract the tarball/zipball onto host runner
-    const extract = url.endsWith('.zip') ? tc.extractZip : tc.extractTar;
+    const extract = download_url.endsWith('.zip') ? tc.extractZip : tc.extractTar;
     const pathToCLI: string = await extract(pathToTarball);
 
     // add `ORAS` to PATH

From 314662bd8b4edb5770494080f8aed218b6047f80 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 29 May 2024 06:59:36 +0000
Subject: [PATCH 02/22] added a test

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 15 ++++++++++++++-
 action.yml                 |  4 ++--
 src/lib/release.ts         |  4 ++--
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b79735a..d620d6e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,7 +28,7 @@ defaults:
     shell: bash
 
 jobs:
-  test:
+  test-basic-setup:
     name: Test Setup ORAS CLI
     runs-on: ${{ matrix.os }}
     strategy:
@@ -56,3 +56,16 @@ jobs:
         echo ---
         read -ra ORAS_VERSION_INSTALLED <<<$(oras version)
         [ "${ORAS_VERSION_INSTALLED[1]}" == "$ORAS_VERSION_EXPECTED" ]
+
+  test-custom-url:
+    name: Test Setup using URL
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: Setup ORAS using URL
+      uses: ./
+      with:
+        url: "https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz"
+        checksum: "8533c9ea1e5a0d5eb1dfc5094c0e8ef106d15462f8a119077548f88937ed2133"
diff --git a/action.yml b/action.yml
index 54ccb80..a8099c0 100644
--- a/action.yml
+++ b/action.yml
@@ -18,11 +18,11 @@ branding:
   color: blue
 inputs:
   version:
-    description: Version of official ORAS CLI to install
+    description: Version of the official ORAS CLI to install
     required: false
     default: 1.1.0
   url:
-    description: URL of customized ORAS CLI to install
+    description: URL of the customized ORAS CLI to install
     required: false
   checksum:
     description: SHA256 of the customized ORAS CLI. Required if 'url' is present.
diff --git a/src/lib/release.ts b/src/lib/release.ts
index 779a38e..f7a4f15 100644
--- a/src/lib/release.ts
+++ b/src/lib/release.ts
@@ -28,14 +28,14 @@ interface releases {
 
 // Get release info of a certain verion of ORAS CLI
 export function getReleaseInfo(version: string, url: string, checksum: string) {
-    // customized ORAS CLI
+    // if customized ORAS CLI link is provided
     if (url && checksum) {
         return {
             checksum: checksum, 
             url: url
         } 
     }
-    // official
+    // get the official release
     const releases = releaseJson as releases;
     if (!(version in releases)) {
         console.log(`official ORAS CLI releases does not contain version ${version}`)

From 27416b37bfcc32328dd4e8d2162fb8470053b46d Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 29 May 2024 07:02:34 +0000
Subject: [PATCH 03/22] fix

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 dist/index.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dist/index.js b/dist/index.js
index 184798a..ce82ae5 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -6692,14 +6692,14 @@ const os = __importStar(__nccwpck_require__(2037));
 const releases_json_1 = __importDefault(__nccwpck_require__(2387));
 // Get release info of a certain verion of ORAS CLI
 function getReleaseInfo(version, url, checksum) {
-    // customized ORAS CLI
+    // if customized ORAS CLI link is provided
     if (url && checksum) {
         return {
             checksum: checksum,
             url: url
         };
     }
-    // official
+    // get the official release
     const releases = releases_json_1.default;
     if (!(version in releases)) {
         console.log(`official ORAS CLI releases does not contain version ${version}`);

From c90244bd03693286ea91a61e40251814f1018454 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 29 May 2024 07:14:38 +0000
Subject: [PATCH 04/22] added more tests

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 40 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d620d6e..fb908d7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -67,5 +67,43 @@ jobs:
     - name: Setup ORAS using URL
       uses: ./
       with:
-        url: "https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz"
+        url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
         checksum: "8533c9ea1e5a0d5eb1dfc5094c0e8ef106d15462f8a119077548f88937ed2133"
+
+    - name: Setup ORAS using URL without checksum
+      id: no-checksum
+      continue-on-error: true
+        uses: ./
+        with:
+          url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
+      - name: 'Should Fail: Setup ORAS using URL without checksum'
+        if: steps.no-checksum.outcome != 'failure'
+        run: |
+            echo "Setup ORAS using URL without checksum should fail, but succeeded."
+            exit 1
+    
+    - name: Setup ORAS using URL and invalid checksum
+        id: invalid-checksum
+        continue-on-error: true
+        uses: ./
+        with:
+          url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
+          checksum: abcedf
+      - name: 'Should Fail: Setup ORAS using URL and invalid checksum'
+        if: steps.invalid-checksum.outcome != 'failure'
+        run: |
+            echo "Setup ORAS using URL and invalid checksum should fail, but succeeded."
+            exit 1
+    
+      - name: Setup ORAS using invalid URL
+        id: invalid-url
+        continue-on-error: true
+        uses: ./
+        with:
+          url: invalid-url
+          checksum: test
+      - name: 'Should Fail: Setup ORAS using invalid URL'
+        if: steps.invalid-url.outcome != 'failure'
+        run: |
+            echo "Setup ORAS using invalid URL should fail, but succeeded."
+            exit 1
\ No newline at end of file

From 5f281f2ec48029ebd6664a93b3027eb75266da20 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 29 May 2024 07:20:15 +0000
Subject: [PATCH 05/22] fix

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 62 +++++++++++++++++++-------------------
 1 file changed, 31 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fb908d7..9fd41ce 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -73,37 +73,37 @@ jobs:
     - name: Setup ORAS using URL without checksum
       id: no-checksum
       continue-on-error: true
-        uses: ./
-        with:
-          url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
-      - name: 'Should Fail: Setup ORAS using URL without checksum'
-        if: steps.no-checksum.outcome != 'failure'
-        run: |
-            echo "Setup ORAS using URL without checksum should fail, but succeeded."
-            exit 1
+      uses: ./
+      with:
+        url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
+    - name: 'Should Fail: Setup ORAS using URL without checksum'
+      if: steps.no-checksum.outcome != 'failure'
+      run: |
+        echo "Setup ORAS using URL without checksum should fail, but succeeded."
+        exit 1
     
     - name: Setup ORAS using URL and invalid checksum
-        id: invalid-checksum
-        continue-on-error: true
-        uses: ./
-        with:
-          url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
-          checksum: abcedf
-      - name: 'Should Fail: Setup ORAS using URL and invalid checksum'
-        if: steps.invalid-checksum.outcome != 'failure'
-        run: |
-            echo "Setup ORAS using URL and invalid checksum should fail, but succeeded."
-            exit 1
+      id: invalid-checksum
+      continue-on-error: true
+      uses: ./
+      with:
+        url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
+        checksum: abcedf
+    - name: 'Should Fail: Setup ORAS using URL and invalid checksum'
+      if: steps.invalid-checksum.outcome != 'failure'
+      run: |
+        echo "Setup ORAS using URL and invalid checksum should fail, but succeeded."
+        exit 1
     
-      - name: Setup ORAS using invalid URL
-        id: invalid-url
-        continue-on-error: true
-        uses: ./
-        with:
-          url: invalid-url
-          checksum: test
-      - name: 'Should Fail: Setup ORAS using invalid URL'
-        if: steps.invalid-url.outcome != 'failure'
-        run: |
-            echo "Setup ORAS using invalid URL should fail, but succeeded."
-            exit 1
\ No newline at end of file
+    - name: Setup ORAS using invalid URL
+      id: invalid-url
+      continue-on-error: true
+      uses: ./
+      with:
+        url: invalid-url
+        checksum: test
+    - name: 'Should Fail: Setup ORAS using invalid URL'
+      if: steps.invalid-url.outcome != 'failure'
+      run: |
+        echo "Setup ORAS using invalid URL should fail, but succeeded."
+        exit 1
\ No newline at end of file

From cf69ba81f1088e8c2cf3dc542c3f935d0ab5763c Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 29 May 2024 07:31:44 +0000
Subject: [PATCH 06/22] space

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9fd41ce..7ab3ed8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -106,4 +106,4 @@ jobs:
       if: steps.invalid-url.outcome != 'failure'
       run: |
         echo "Setup ORAS using invalid URL should fail, but succeeded."
-        exit 1
\ No newline at end of file
+        exit 1

From 569ed56253c8eab7bbee09558db55bfb68fab6c0 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Mon, 3 Jun 2024 07:36:45 +0000
Subject: [PATCH 07/22] try using variables

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7ab3ed8..afc1e06 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -63,11 +63,16 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v3
+    
+    - name: Create test variables
+      run:
+        URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)
+        CHECKSUM=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)
 
     - name: Setup ORAS using URL
       uses: ./
       with:
-        url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
+        url: ${{ env.URL }}
         checksum: "8533c9ea1e5a0d5eb1dfc5094c0e8ef106d15462f8a119077548f88937ed2133"
 
     - name: Setup ORAS using URL without checksum
@@ -75,7 +80,7 @@ jobs:
       continue-on-error: true
       uses: ./
       with:
-        url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
+        url: ${{ env.URL }}
     - name: 'Should Fail: Setup ORAS using URL without checksum'
       if: steps.no-checksum.outcome != 'failure'
       run: |
@@ -87,7 +92,7 @@ jobs:
       continue-on-error: true
       uses: ./
       with:
-        url: https://github.com/oras-project/oras/releases/download/v1.0.0/oras_1.0.0_linux_amd64.tar.gz
+        url: ${{ env.URL }}
         checksum: abcedf
     - name: 'Should Fail: Setup ORAS using URL and invalid checksum'
       if: steps.invalid-checksum.outcome != 'failure'

From 0f17d5e0a395a53b0a7b7a74e8cd04c0330e3b9c Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Mon, 3 Jun 2024 07:49:57 +0000
Subject: [PATCH 08/22] another try that likely will fail

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index afc1e06..f781813 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,6 +23,10 @@ on:
       - main
       - release-*
 
+env:
+  URL: $(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)
+  CHECKSUM: $(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)
+
 defaults:
   run:
     shell: bash
@@ -63,11 +67,6 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v3
-    
-    - name: Create test variables
-      run:
-        URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)
-        CHECKSUM=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)
 
     - name: Setup ORAS using URL
       uses: ./

From 896428c50613c26d70cee25df8441e78930a3698 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Tue, 4 Jun 2024 07:06:12 +0000
Subject: [PATCH 09/22] another try

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f781813..d865922 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,9 +23,9 @@ on:
       - main
       - release-*
 
-env:
-  URL: $(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)
-  CHECKSUM: $(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)
+# env:
+  # URL: $(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)
+  # CHECKSUM: $(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)
 
 defaults:
   run:
@@ -61,9 +61,21 @@ jobs:
         read -ra ORAS_VERSION_INSTALLED <<<$(oras version)
         [ "${ORAS_VERSION_INSTALLED[1]}" == "$ORAS_VERSION_EXPECTED" ]
 
+  create-test-variables:
+    runs-on: ubuntu-latest
+    outputs:
+      output1: ${{ steps.step1.outputs.URL }}
+      output2: ${{ steps.step2.outputs.CHECKSUM }}
+    steps:
+      - id: step1
+        run: echo "$URL=(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+      - id: step2
+        run: echo "$CHECKSUM=(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+
   test-custom-url:
     name: Test Setup using URL
     runs-on: ubuntu-latest
+    needs: create-test-variables
     steps:
     - name: Checkout
       uses: actions/checkout@v3
@@ -71,7 +83,7 @@ jobs:
     - name: Setup ORAS using URL
       uses: ./
       with:
-        url: ${{ env.URL }}
+        url: ${{ needs.create-test-variables.outputs.output1 }}
         checksum: "8533c9ea1e5a0d5eb1dfc5094c0e8ef106d15462f8a119077548f88937ed2133"
 
     - name: Setup ORAS using URL without checksum
@@ -79,7 +91,7 @@ jobs:
       continue-on-error: true
       uses: ./
       with:
-        url: ${{ env.URL }}
+        url: ${{ needs.create-test-variables.outputs.output1 }}
     - name: 'Should Fail: Setup ORAS using URL without checksum'
       if: steps.no-checksum.outcome != 'failure'
       run: |
@@ -91,7 +103,7 @@ jobs:
       continue-on-error: true
       uses: ./
       with:
-        url: ${{ env.URL }}
+        url: ${{ needs.create-test-variables.outputs.output1 }}
         checksum: abcedf
     - name: 'Should Fail: Setup ORAS using URL and invalid checksum'
       if: steps.invalid-checksum.outcome != 'failure'

From 0e8e781ff6e706a5e4067c7a80e2e2dce39e2e9b Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Tue, 4 Jun 2024 07:07:46 +0000
Subject: [PATCH 10/22] fix

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d865922..a490eef 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,9 +68,9 @@ jobs:
       output2: ${{ steps.step2.outputs.CHECKSUM }}
     steps:
       - id: step1
-        run: echo "$URL=(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+        run: echo "URL=(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
       - id: step2
-        run: echo "$CHECKSUM=(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+        run: echo "CHECKSUM=(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
 
   test-custom-url:
     name: Test Setup using URL

From 0d22d690c6c9ebbb6c06b6a10d45812a145c43fe Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Tue, 4 Jun 2024 07:15:13 +0000
Subject: [PATCH 11/22] bug fix

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a490eef..9ce219e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,9 +68,13 @@ jobs:
       output2: ${{ steps.step2.outputs.CHECKSUM }}
     steps:
       - id: step1
-        run: echo "URL=(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+        run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+      - id: debug1
+        run: echo $URL
       - id: step2
-        run: echo "CHECKSUM=(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+        run: echo "CHECKSUM=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+      - id: debug2
+        run: echo $CHECKSUM
 
   test-custom-url:
     name: Test Setup using URL

From 5d6a68c3f02939dee6246c42ad8a31f99c35c4cd Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Tue, 4 Jun 2024 07:18:27 +0000
Subject: [PATCH 12/22] debug

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9ce219e..aa51000 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -69,6 +69,8 @@ jobs:
     steps:
       - id: step1
         run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+      - id: debug0
+        run: echo $PWD
       - id: debug1
         run: echo $URL
       - id: step2

From 4cb6ac71e7b5c3428a6668de650bc52047c2c295 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Tue, 4 Jun 2024 07:21:46 +0000
Subject: [PATCH 13/22] attempt

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index aa51000..0da96df 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,13 +68,13 @@ jobs:
       output2: ${{ steps.step2.outputs.CHECKSUM }}
     steps:
       - id: step1
-        run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+        run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' ./src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
       - id: debug0
-        run: echo $PWD
+        run: ls
       - id: debug1
         run: echo $URL
       - id: step2
-        run: echo "CHECKSUM=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+        run: echo "CHECKSUM=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' ./src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
       - id: debug2
         run: echo $CHECKSUM
 

From 6bc5f8ceae706c414c75beb0b3c5fa93e4304e4c Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Tue, 4 Jun 2024 07:25:35 +0000
Subject: [PATCH 14/22] debug

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0da96df..0e62bbc 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -71,6 +71,8 @@ jobs:
         run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' ./src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
       - id: debug0
         run: ls
+      - id: debug00
+        run: echo $PWD
       - id: debug1
         run: echo $URL
       - id: step2

From ed7fb1920e3dc20bdd10597dbcf6314d8de63406 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Tue, 4 Jun 2024 07:34:35 +0000
Subject: [PATCH 15/22] add checkout

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0e62bbc..61416a5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -67,6 +67,8 @@ jobs:
       output1: ${{ steps.step1.outputs.URL }}
       output2: ${{ steps.step2.outputs.CHECKSUM }}
     steps:
+      - id: checkout
+        uses: actions/checkout@v3
       - id: step1
         run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' ./src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
       - id: debug0

From a201d6d53a71e98ad690b031c93730530bf727eb Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Tue, 4 Jun 2024 07:51:48 +0000
Subject: [PATCH 16/22] clean up

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 32 ++++++++++----------------------
 1 file changed, 10 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 61416a5..5812ef3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,10 +23,6 @@ on:
       - main
       - release-*
 
-# env:
-  # URL: $(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)
-  # CHECKSUM: $(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)
-
 defaults:
   run:
     shell: bash
@@ -64,23 +60,15 @@ jobs:
   create-test-variables:
     runs-on: ubuntu-latest
     outputs:
-      output1: ${{ steps.step1.outputs.URL }}
-      output2: ${{ steps.step2.outputs.CHECKSUM }}
+      url: ${{ steps.get-url.outputs.URL }}
+      checksum: ${{ steps.get-checksum.outputs.CHECKSUM }}
     steps:
       - id: checkout
         uses: actions/checkout@v3
-      - id: step1
-        run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' ./src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
-      - id: debug0
-        run: ls
-      - id: debug00
-        run: echo $PWD
-      - id: debug1
-        run: echo $URL
-      - id: step2
-        run: echo "CHECKSUM=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' ./src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
-      - id: debug2
-        run: echo $CHECKSUM
+      - id: get-url
+        run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+      - id: get-checksum
+        run: echo "CHECKSUM=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
 
   test-custom-url:
     name: Test Setup using URL
@@ -93,15 +81,15 @@ jobs:
     - name: Setup ORAS using URL
       uses: ./
       with:
-        url: ${{ needs.create-test-variables.outputs.output1 }}
-        checksum: "8533c9ea1e5a0d5eb1dfc5094c0e8ef106d15462f8a119077548f88937ed2133"
+        url: ${{ needs.create-test-variables.outputs.url }}
+        checksum: ${{ needs.create-test-variables.outputs.checksum }}
 
     - name: Setup ORAS using URL without checksum
       id: no-checksum
       continue-on-error: true
       uses: ./
       with:
-        url: ${{ needs.create-test-variables.outputs.output1 }}
+        url: ${{ needs.create-test-variables.outputs.url }}
     - name: 'Should Fail: Setup ORAS using URL without checksum'
       if: steps.no-checksum.outcome != 'failure'
       run: |
@@ -113,7 +101,7 @@ jobs:
       continue-on-error: true
       uses: ./
       with:
-        url: ${{ needs.create-test-variables.outputs.output1 }}
+        url: ${{ needs.create-test-variables.outputs.url }}
         checksum: abcedf
     - name: 'Should Fail: Setup ORAS using URL and invalid checksum'
       if: steps.invalid-checksum.outcome != 'failure'

From 95cb4b934a3d7eb7629838aff081655e8a51a42b Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 5 Jun 2024 01:40:37 +0000
Subject: [PATCH 17/22] resolve comments

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 src/lib/release.ts | 11 ++++++++++-
 src/setup.ts       |  5 -----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/lib/release.ts b/src/lib/release.ts
index f7a4f15..3ec406a 100644
--- a/src/lib/release.ts
+++ b/src/lib/release.ts
@@ -28,13 +28,22 @@ interface releases {
 
 // Get release info of a certain verion of ORAS CLI
 export function getReleaseInfo(version: string, url: string, checksum: string) {
-    // if customized ORAS CLI link is provided
+    // if customized ORAS CLI link and checksum are provided, version is ignored
     if (url && checksum) {
         return {
             checksum: checksum, 
             url: url
         } 
     }
+
+    // sanity checks
+    if (url && !checksum) {
+        throw new Error("user provided url of customized ORAS CLI release but without SHA256 checksum");
+    }
+    if (!url && checksum) {
+        throw new Error("user provided SHA256 checksum but without url");
+    }
+
     // get the official release
     const releases = releaseJson as releases;
     if (!(version in releases)) {
diff --git a/src/setup.ts b/src/setup.ts
index 68e2bda..cfec8a5 100644
--- a/src/setup.ts
+++ b/src/setup.ts
@@ -24,11 +24,6 @@ async function setup(): Promise<void> {
     const url: string = core.getInput('url');
     const checksum = core.getInput('checksum').toLowerCase();
 
-    // sanity check
-    if (url && !checksum) {
-      throw new Error("user provided url of customized ORAS CLI release but without SHA256 checksum");
-    }
-
     // download ORAS CLI and validate checksum
     const info = getReleaseInfo(version, url, checksum);
     const download_url = info.url;

From ecdebb4bbba82d048279c0a2b08daeb6d78e217e Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 5 Jun 2024 01:42:33 +0000
Subject: [PATCH 18/22] run build

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 dist/index.js | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/dist/index.js b/dist/index.js
index ce82ae5..855623c 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -6692,13 +6692,20 @@ const os = __importStar(__nccwpck_require__(2037));
 const releases_json_1 = __importDefault(__nccwpck_require__(2387));
 // Get release info of a certain verion of ORAS CLI
 function getReleaseInfo(version, url, checksum) {
-    // if customized ORAS CLI link is provided
+    // if customized ORAS CLI link and checksum are provided, version is ignored
     if (url && checksum) {
         return {
             checksum: checksum,
             url: url
         };
     }
+    // sanity checks
+    if (url && !checksum) {
+        throw new Error("user provided url of customized ORAS CLI release but without SHA256 checksum");
+    }
+    if (!url && checksum) {
+        throw new Error("user provided SHA256 checksum but without url");
+    }
     // get the official release
     const releases = releases_json_1.default;
     if (!(version in releases)) {
@@ -6818,10 +6825,6 @@ function setup() {
             const version = core.getInput('version');
             const url = core.getInput('url');
             const checksum = core.getInput('checksum').toLowerCase();
-            // sanity check
-            if (url && !checksum) {
-                throw new Error("user provided url of customized ORAS CLI release but without SHA256 checksum");
-            }
             // download ORAS CLI and validate checksum
             const info = (0, release_1.getReleaseInfo)(version, url, checksum);
             const download_url = info.url;

From 23e5458b3be04b97d3d7e59c96f5d3e079dc8bf7 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 5 Jun 2024 03:21:59 +0000
Subject: [PATCH 19/22] resolve comments

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 21 +++++++++++++++++----
 dist/index.js              |  2 +-
 src/lib/release.ts         |  2 +-
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5812ef3..74f66d9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -65,10 +65,11 @@ jobs:
     steps:
       - id: checkout
         uses: actions/checkout@v3
-      - id: get-url
-        run: echo "URL=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.url' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
-      - id: get-checksum
-        run: echo "CHECKSUM=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64.checksum' src/lib/data/releases.json)" >> "$GITHUB_OUTPUT"
+      - id: get-checksum-url
+        run: |
+        RELEASE=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64' src/lib/data/releases.json)
+        echo "CHECKSUM=$(echo $RELEASE | jq -r '.checksum')" >> "$GITHUB_OUTPUT"
+        echo "URL=$(echo $RELEASE | jq -r '.url')" >> "$GITHUB_OUTPUT"
 
   test-custom-url:
     name: Test Setup using URL
@@ -96,6 +97,18 @@ jobs:
         echo "Setup ORAS using URL without checksum should fail, but succeeded."
         exit 1
     
+    - name: Setup ORAS using checksum without url
+      id: no-url
+      continue-on-error: true
+      uses: ./
+      with:
+        checksum: ${{ needs.create-test-variables.outputs.checksum }}
+    - name: 'Should Fail: Setup ORAS using checksum without url'
+      if: steps.no-url.outcome != 'failure'
+      run: |
+        echo "Setup ORAS using checksum without url should fail, but succeeded."
+        exit 1
+    
     - name: Setup ORAS using URL and invalid checksum
       id: invalid-checksum
       continue-on-error: true
diff --git a/dist/index.js b/dist/index.js
index 855623c..9d20e09 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -6692,8 +6692,8 @@ const os = __importStar(__nccwpck_require__(2037));
 const releases_json_1 = __importDefault(__nccwpck_require__(2387));
 // Get release info of a certain verion of ORAS CLI
 function getReleaseInfo(version, url, checksum) {
-    // if customized ORAS CLI link and checksum are provided, version is ignored
     if (url && checksum) {
+        // if customized ORAS CLI link and checksum are provided, version is ignored
         return {
             checksum: checksum,
             url: url
diff --git a/src/lib/release.ts b/src/lib/release.ts
index 3ec406a..c67c233 100644
--- a/src/lib/release.ts
+++ b/src/lib/release.ts
@@ -28,8 +28,8 @@ interface releases {
 
 // Get release info of a certain verion of ORAS CLI
 export function getReleaseInfo(version: string, url: string, checksum: string) {
-    // if customized ORAS CLI link and checksum are provided, version is ignored
     if (url && checksum) {
+        // if customized ORAS CLI link and checksum are provided, version is ignored
         return {
             checksum: checksum, 
             url: url

From 55c5341162b9a35746096e4615a695195d093118 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 5 Jun 2024 03:24:29 +0000
Subject: [PATCH 20/22] fix

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 74f66d9..10c7e89 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -67,9 +67,9 @@ jobs:
         uses: actions/checkout@v3
       - id: get-checksum-url
         run: |
-        RELEASE=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64' src/lib/data/releases.json)
-        echo "CHECKSUM=$(echo $RELEASE | jq -r '.checksum')" >> "$GITHUB_OUTPUT"
-        echo "URL=$(echo $RELEASE | jq -r '.url')" >> "$GITHUB_OUTPUT"
+          RELEASE=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64' src/lib/data/releases.json)
+          echo "CHECKSUM=$(echo $RELEASE | jq -r '.checksum')" >> "$GITHUB_OUTPUT"
+          echo "URL=$(echo $RELEASE | jq -r '.url')" >> "$GITHUB_OUTPUT"
 
   test-custom-url:
     name: Test Setup using URL

From f7ec69281d1e50370bd346bb5a63739fe4669156 Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 5 Jun 2024 06:25:16 +0000
Subject: [PATCH 21/22] try to fix

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 10c7e89..d182094 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,8 +68,13 @@ jobs:
       - id: get-checksum-url
         run: |
           RELEASE=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64' src/lib/data/releases.json)
-          echo "CHECKSUM=$(echo $RELEASE | jq -r '.checksum')" >> "$GITHUB_OUTPUT"
-          echo "URL=$(echo $RELEASE | jq -r '.url')" >> "$GITHUB_OUTPUT"
+          CHECKSUM=$(echo $RELEASE | jq -r '.checksum')
+          echo $CHECKSUM
+          echo "CHECKSUM=$CHECKSUM" >> "$GITHUB_OUTPUT"
+
+          URL=$(echo $RELEASE | jq -r '.url')
+          echo $URL
+          echo "URL=$URL" >> "$GITHUB_OUTPUT"
 
   test-custom-url:
     name: Test Setup using URL

From a3e2f64c3f0fae364698628d96369ee55d5683ef Mon Sep 17 00:00:00 2001
From: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
Date: Wed, 5 Jun 2024 06:35:13 +0000
Subject: [PATCH 22/22] fix

Signed-off-by: Xiaoxuan Wang <wangxiaoxuan119@gmail.com>
---
 .github/workflows/test.yml | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d182094..110f1e9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -60,21 +60,16 @@ jobs:
   create-test-variables:
     runs-on: ubuntu-latest
     outputs:
-      url: ${{ steps.get-url.outputs.URL }}
-      checksum: ${{ steps.get-checksum.outputs.CHECKSUM }}
+      url: ${{ steps.get-checksum-url.outputs.URL }}
+      checksum: ${{ steps.get-checksum-url.outputs.CHECKSUM }}
     steps:
       - id: checkout
         uses: actions/checkout@v3
       - id: get-checksum-url
         run: |
           RELEASE=$(jq -r 'keys_unsorted[0] as $k | .[$k].linux.amd64' src/lib/data/releases.json)
-          CHECKSUM=$(echo $RELEASE | jq -r '.checksum')
-          echo $CHECKSUM
-          echo "CHECKSUM=$CHECKSUM" >> "$GITHUB_OUTPUT"
-
-          URL=$(echo $RELEASE | jq -r '.url')
-          echo $URL
-          echo "URL=$URL" >> "$GITHUB_OUTPUT"
+          echo "CHECKSUM=$(echo $RELEASE | jq -r '.checksum')" >> "$GITHUB_OUTPUT"
+          echo "URL=$(echo $RELEASE | jq -r '.url')" >> "$GITHUB_OUTPUT"
 
   test-custom-url:
     name: Test Setup using URL