Verify downloaded Terraform archive against the published SHA256SUMS

[somaz94]

Related Issue

Fixes #556

Description

setup-terraform downloaded the Terraform release zip and extracted it without verifying its integrity — TLS protected the bytes in transit, but the action took no defense-in-depth step beyond that, so a compromised mirror, CDN incident, or any future change to the resolved URL could land an arbitrary binary on every runner.

This adds a single verification step in downloadCLI, right after the download and before extraction:

await release.verify(pathToCLIZip, build.filename);

@hashicorp/js-releases (already a dependency) exposes Release.verify(pkg, buildName), which fetches the release's terraform_<v>_SHA256SUMS, verifies its detached PGP signature against the embedded HashiCorp release key, then compares the SHA-256 of the downloaded archive against the signed checksum — failing the install loudly on any mismatch. Reusing this existing, already-vendored method keeps the change minimal and covers both the SHA-256 check and the stronger signature-verification path described in the issue, with no new input or behavior toggle.

The Apache Software Foundation flags every release of this action in its approved-actions allowlist because of this missing check (see #556); this closes that gap so future version bumps no longer require a manual security re-review.

Validation

• npm test — semistandard clean, 19/19 jest pass (added 2 tests: verification is invoked with the platform build name; a checksum mismatch aborts before extraction).
• npm run build — dist/ rebuilt; diff is limited to the logical change.
• Added a changie ENHANCEMENTS fragment for Verify downloaded Terraform zip against published SHA256SUMS / SHA256SUMS.sig #556.

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Yes. This adds an integrity control to the install path: the downloaded Terraform archive is now verified against HashiCorp's PGP-signed SHA256SUMS before it is extracted or placed on the PATH. A failed or missing verification aborts the install. No logging, access-control, or credential-handling behavior changes.