From 01b5229b9f071e92be492976180cf31397ac9916 Mon Sep 17 00:00:00 2001
From: Ty Smith <ty@tysmith.me>
Date: Wed, 28 Oct 2026 20:03:25 -0700
Subject: [PATCH] fix(build): pin starlight with provenance and signing support

Refs tyvsmith/steam-native-notifications#56
---
 .github/workflows/ci.yml           |  6 +++++-
 .github/workflows/pr.yml           |  6 +++++-
 scripts/build/install-starlight.sh | 11 +++++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 scripts/build/install-starlight.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d3df43..c392e94 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -141,9 +141,13 @@ jobs:
           name: build-scripts
           path: scripts/build/
 
+      - name: Set up Rust
+        if: steps.format.outputs.format == 'star'
+        uses: dtolnay/rust-toolchain@stable
+
       - name: Install starlight
         if: steps.format.outputs.format == 'star'
-        run: npm install -g @steambrew/starlight@${{ vars.STARLIGHT_VERSION }}
+        run: bash ./scripts/build/install-starlight.sh
 
       - name: Install pnpm
         if: steps.format.outputs.format != 'star'
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 4fffe55..d621a2e 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -131,9 +131,13 @@ jobs:
         with:
           node-version: "20"
 
+      - name: Set up Rust
+        if: steps.format.outputs.format == 'star'
+        uses: dtolnay/rust-toolchain@stable
+
       - name: Install starlight
         if: steps.format.outputs.format == 'star'
-        run: npm install -g @steambrew/starlight@${{ vars.STARLIGHT_VERSION }}
+        run: bash ./scripts/build/install-starlight.sh
 
       - name: Install pnpm
         if: steps.format.outputs.format != 'star'
diff --git a/scripts/build/install-starlight.sh b/scripts/build/install-starlight.sh
new file mode 100644
index 0000000..08b8edf
--- /dev/null
+++ b/scripts/build/install-starlight.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+set -euo pipefail
+
+# npm 1.1.6 predates source-commit metadata and the sign command.
+# Keep PR builds and production signing on the same immutable compiler source.
+cargo install starlight --locked \
+  --git https://github.com/SteamClientHomebrew/Millennium.git \
+  --rev d6a7822a43744b6290a0e059bdd032d9b9a2ec94 \
+  --root "$RUNNER_TEMP/starlight"
+
+echo "$RUNNER_TEMP/starlight/bin" >> "$GITHUB_PATH"