Use @actions/tool-cache which provides neat utilities for downloading stuff from the Internet and is expected to be integrated with GitHub’s caches. This possible means that we could drop dependency on both adm-zip and node-fetch.

At https://github.com/step-security/secure-workflows we are building a knowledge-base (KB) of GITHUB_TOKEN permissions needed by different GitHub Actions. When developers try to set minimum token permissions for their workflows, they can use this knowledge-base instead of trying to research permissions needed by each GitHub Action they use.

Below you can see the KB of your GITHUB Action.

name: Set up NASM # ilammy/setup-nasm
# GITHUB_TOKEN not used

If you think this information is not accurate, or if in the future your GitHub Action starts using a different set of permissions, please create an issue at https://github.com/step-security/secure-workflows/issues to let us know.

This issue is automatically created by our analysis bot, feel free to close after reading :)

References:

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

Setting minimum token permissions is also checked for by Open Source Security Foundation (OpenSSF) Scorecards. Scorecards recommend using https://github.com/step-security/secure-workflows so developers can fix this issue in an easier manner.

This Github action was working fine until today... More info on the first failing job. Do you know why? Thanks for the support and for the amazing action :)
https://github.com/davidgm94/rise/actions/runs/3724987598/jobs/6317509440

The error

Warning: binaries did not work: Error: HTTP GET failed: Not Found

has been popping up on Ubuntu runs. Now it builds from source, which is fine as a back up, but it takes a bit longer.

Annotations
1 warning
build (windows-2019)
Node.js 12 actions are deprecated. For more information see: https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/. Please update the following actions to use Node.js 16: ilammy/setup-nasm

I'm using ndisasm in my batch file, why it wasn't added to the PATH variable?

Last stable version of NASM includes that

name: Build
on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  build:
    if: "!contains(github.event.head_commit.message, '[ci skip]')"
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v2

      - uses: ilammy/setup-nasm@v1

      - name: Build project
        run: build.bat
        shell: cmd

'ndisasm' is not recognized as an internal or external command, operable program or batch file.

Like this: #26

node_modules directory is checked in on release/v1 so that the action works. However, it does not need development dependencies there. Tweak the package-lock checking task to avoid installing them for checks (use --only production), which will likely avoid including them into PRs.

Currently setup-nasm v1.1.0 gives the following error:

Error: The add-path command is deprecated and will be disabled on November 16th. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/

Could you add a mirror for downloading nasm, www.nasm.us is often down. Like right now.

Run ilammy/setup-nasm@v1
Downloading binary distribution...
binaries did not work: FetchError: request to https://www.nasm.us/pub/nasm/releasebuilds/2.15.05/win64/nasm-2.15.05-win64.zip failed, reason: connect ETIMEDOUT 198.137.202.136:443
Downloading source code...
Warning: source code did not work: FetchError: request to https://www.nasm.us/pub/nasm/releasebuilds/2.15.05/nasm-2.15.05.tar.gz failed, reason: connect ETIMEDOUT 198.137.202.136:443
Error: could not install NASM: Error: I'm sorry, Dave. I'm afraid I can't do that.