From bb2bd1e7075eef04462c8eeadf41a732e5d8c677 Mon Sep 17 00:00:00 2001
From: Miha Kralj <miha.kralj@outlook.com>
Date: Sat, 13 Dec 2025 21:50:47 -0800
Subject: [PATCH] refactor: improve Codacy CLI download robustness and error
 handling

- Use curl with -fSL flags for fail-fast behavior and proper redirects
- Check curl exit code immediately after download
- Replace piped echo with temporary file for sha256sum verification
- Use sha256sum -c --status for cleaner verification
- Add detailed error logging with expected checksum
- Clean up temp file and binary on any failure
- Exit 1 immediately on download or verification failure
---
 .github/scanner.sh | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/scanner.sh b/.github/scanner.sh
index e89b24a7..3e9ea439 100644
--- a/.github/scanner.sh
+++ b/.github/scanner.sh
@@ -193,16 +193,25 @@ if [ "$SKIP_CODACY" = false ]; then
         CODACY_BIN="/tmp/codacy-coverage-reporter"
 
         log_info "Downloading Codacy coverage reporter v${CODACY_VERSION}..."
-        curl -L -o "$CODACY_BIN" "$CODACY_URL"
-        
-        # Verify hash
-        echo "$CODACY_SHA256  $CODACY_BIN" | sha256sum -c -
-        if [ $? -ne 0 ]; then
-            log_error "Codacy reporter checksum verification failed!"
+        if ! curl -fSL -o "$CODACY_BIN" "$CODACY_URL"; then
+            log_error "Failed to download Codacy coverage reporter from $CODACY_URL"
             rm -f "$CODACY_BIN"
             exit 1
         fi
         
+        # Verify hash using temporary checksum file
+        CHECKSUM_FILE=$(mktemp)
+        printf "%s  %s\n" "$CODACY_SHA256" "$CODACY_BIN" > "$CHECKSUM_FILE"
+        
+        if ! sha256sum -c --status "$CHECKSUM_FILE"; then
+            log_error "Codacy reporter checksum verification failed!"
+            log_error "Expected: $CODACY_SHA256"
+            log_error "File: $CODACY_BIN"
+            rm -f "$CODACY_BIN" "$CHECKSUM_FILE"
+            exit 1
+        fi
+        
+        rm -f "$CHECKSUM_FILE"
         chmod +x "$CODACY_BIN"
 
         for file in "${coverage_files[@]}"; do