Install an exact Smoque release for a GitHub Actions job without adding
Smoque, a package.json, or a lockfile to the consumer repository.
The Action only installs Smoque. The workflow owns test discovery, selection, reporting, and every other Smoque operation.
steps:
- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
- uses: zactionsz/setup-smoque@91389c294e30e11c62adbc7257186cf108ded493
with:
version: "0.1.2"
sha256: "f6644336d7104c8099c42824a28dacdf402fcfe8b7a487fefc09b00b3b58d45d"
- run: smoque run smoke/ --ciThe SHA-256 input is for the exact npm tarball at
https://registry.npmjs.org/smoque/-/smoque-<version>.tgz. The Action verifies
the bytes before installing with lifecycle scripts disabled. It rejects a
release that declares runtime dependencies so the same version and digest stay
a complete installation identity.
version: verified Smoque versionsha256: verified lowercase tarball digestpath: absolute path to the installed launchercache-hit:truewhen the verified tarball was already in the runner tool cache
The Action supports GitHub-hosted Linux, macOS, and Windows runners. It uses the Node 24 runtime bundled with the Actions runner for both setup and the installed Smoque command.
npm ci
npm run checkdist/index.js is committed because GitHub executes the bundle rather than the
TypeScript source.