From 4da7db043b1eef37b074bcb7819da81048e9f9b8 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 9 Oct 2026 17:36:32 +0000
Subject: [PATCH] fix(ci): remove stale OpenROM-bins commit pin and prevent
 working directory traversal

Co-authored-by: ClausValcaTD <193546948+ClausValcaTD@users.noreply.github.com>
---
 .github/workflows/Flatpak.yml |  3 +--
 .github/workflows/Release.yml | 12 ++++--------
 build_windows.bat             |  4 ++--
 3 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/Flatpak.yml b/.github/workflows/Flatpak.yml
index 92cb486..8b4a5ea 100644
--- a/.github/workflows/Flatpak.yml
+++ b/.github/workflows/Flatpak.yml
@@ -66,8 +66,7 @@ jobs:
       - name: Clone OpenROM binaries repo
         run: |
           git clone --depth 1 https://github.com/M5Devs/OpenROM-bins.git bins
-          git -C bins checkout 586f7cc54df0facf9df9d3066c70e6b434b93753
-          cd bins && sha256sum -c checksums.sha256 && cd ..
+          (cd bins && sha256sum -c checksums.sha256)
 
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
diff --git a/.github/workflows/Release.yml b/.github/workflows/Release.yml
index a6e3a79..8fdd73c 100644
--- a/.github/workflows/Release.yml
+++ b/.github/workflows/Release.yml
@@ -23,8 +23,7 @@ jobs:
         shell: bash
         run: |
           git clone https://github.com/M5Devs/OpenROM-bins.git bins
-          git -C bins checkout 586f7cc54df0facf9df9d3066c70e6b434b93753
-          cd bins && sha256sum -c checksums.sha256 && cd ..
+          (cd bins && sha256sum -c checksums.sha256)
 
       - name: Copy Windows binaries
         run: |
@@ -154,8 +153,7 @@ jobs:
       - name: Fetch binaries from OpenROM-bins
         run: |
           git clone https://github.com/M5Devs/OpenROM-bins.git bins
-          git -C bins checkout 586f7cc54df0facf9df9d3066c70e6b434b93753
-          cd bins && sha256sum -c checksums.sha256 && cd ..
+          (cd bins && sha256sum -c checksums.sha256)
           mkdir -p assets/linux/x86_64
           cp -r bins/linux/x86_64/. assets/linux/x86_64/
           chmod +x assets/linux/x86_64/*
@@ -279,8 +277,7 @@ jobs:
       - name: Fetch binaries from OpenROM-bins
         run: |
           git clone https://github.com/M5Devs/OpenROM-bins.git bins
-          git -C bins checkout 586f7cc54df0facf9df9d3066c70e6b434b93753
-          cd bins && sha256sum -c checksums.sha256 && cd ..
+          (cd bins && sha256sum -c checksums.sha256)
           mkdir -p assets/linux/arm64
           cp -r bins/linux/arm64/. assets/linux/arm64/
           chmod +x assets/linux/arm64/*
@@ -387,8 +384,7 @@ jobs:
       - name: Fetch binaries from OpenROM-bins
         run: |
           git clone https://github.com/M5Devs/OpenROM-bins.git bins
-          git -C bins checkout 586f7cc54df0facf9df9d3066c70e6b434b93753
-          cd bins && (sha256sum -c checksums.sha256 || shasum -a 256 -c checksums.sha256) && cd ..
+          (cd bins && (sha256sum -c checksums.sha256 || shasum -a 256 -c checksums.sha256))
           mkdir -p assets/macos/arm64 assets/macos/x86_64
           cp -r bins/macos/arm64/.  assets/macos/arm64/
           cp -r bins/macos/x86_64/. assets/macos/x86_64/
diff --git a/build_windows.bat b/build_windows.bat
index 5fe8cad..b08f4b9 100644
--- a/build_windows.bat
+++ b/build_windows.bat
@@ -1,10 +1,10 @@
 @echo off
 if exist bins (
     echo === Verifying OpenROM-bins checksums ===
-    cd bins
+    pushd bins
     powershell -Command "Get-Content checksums.sha256 | ForEach-Object { $line = $_; $parts = $line -split '  '; if ($parts.Length -eq 2) { $hash = $parts[0].Trim(); $file = $parts[1].Trim(); if (Test-Path $file) { $actual = (Get-FileHash -Algorithm SHA256 $file).Hash.ToLower(); if ($actual -ne $hash) { Write-Error 'Checksum mismatch'; throw 'Checksum error' } } } }"
+    popd
     if errorlevel 1 goto fail
-    cd ..
 )
 echo === Building OpenROM Core (Dart CLI) ===
 cd core