Skip to content

Feature request: An official github action to install jq to avoid using custom unofficial actions #3305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nitrocode opened this issue Mar 30, 2025 · 1 comment

Comments

@nitrocode
Copy link

nitrocode commented Mar 30, 2025

Describe the bug
Hi jq org. Thank you so much for all your hard work. It's very much appreciated.

I looked recently for an install jq github action and was greeted in the github marketplace with official looking actions which are run by single users. In light of the recent tj-actions security events, it would be nice to have an official action to install jq.

Here is a search on the marketplace https://github.com/marketplace?query=jq&type=actions

https://github.com/marketplace/actions/install-jq - dcarbone/install-jq-action
https://github.com/marketplace/actions/install-jq-tool - mbround18/install-jq
https://github.com/marketplace/actions/yet-another-setup-jq - vegardit/gha-setup-jq

Of course a workaround is this, but people are more likely to use an action off the shelf like the above which can lead to security risk.

    - name: Install jq
      run: sudo apt-get update && sudo apt-get install jq --no-install-recommends

or

    - name: Install jq
      run: |
        wget https://github.com/jqlang/jq/releases/latest/download/jq-linux-amd64 -O $HOME/bin/jq
        chmod +x $HOME/bin/jq
@wader
Copy link
Member

wader commented Mar 30, 2025

Hi, i think all the hosted github runner images have jq installed by default. I checked ubuntu|winows|macos-latest.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants