Install the logmind CLI on a GitHub Actions runner.

logmind is a decision-logging tool for AI-assisted development. This action fetches a signed, notarized release binary from the logmind release page and puts it on the runner's $PATH so subsequent steps can call logmind directly.

The recommended pattern is a static pin to an exact action version. Let Dependabot bump the pin when new versions ship.

steps:
  - uses: actions/checkout@v4
  - uses: thrillmade/[email protected]
  - run: logmind check-links

By default this installs the latest logmind release. Pin the CLI version too if you want fully reproducible CI:

- uses: thrillmade/[email protected]
  with:
    version: v1.0.1

Add this to .github/dependabot.yml in your repo and Dependabot will open a PR whenever setup-logmind (or any other thrillmade/* action) cuts a new release:

version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    groups:
      thrillmade-actions:
        patterns:
          - "thrillmade/*"

This is the path we recommend over moving major tags. Static pins keep your workflow files an audit trail of what actually ran.

Use it downstream like:

- id: lm
  uses: thrillmade/[email protected]
- run: echo "Installed ${{ steps.lm.outputs.version }}"

- uses: thrillmade/setup-logmind@v1
  with:
    version: v1   # or omit to track latest stable

For workflows that audit every action by SHA (we recommend this for any workflow with secrets):

- uses: thrillmade/setup-logmind@<full-sha-of-v1.0.1-tag>
  with:
    version: v1.0.1

Find the SHA at https://github.com/thrillmade/setup-logmind/releases/tag/v1.0.1 and pin to it. Dependabot natively supports SHA-pinned actions — it'll open PRs with the SHA bumped and the comment annotated with the version.

Every release is exercised on ubuntu-latest, macos-latest, and windows-latest in CI before the tag is published.

The action is composite (shell-only — no Docker, no JS). On Linux and macOS it pipes the upstream logmind installer so the SHA-256 verification stays in one place. On Windows it downloads the release zip directly, verifies it against the same SHA256SUMS file, and unpacks logmind.exe into the install prefix.

Either way, <prefix>/bin is appended to $GITHUB_PATH so subsequent steps in the same job can call logmind without qualifying the path.

• v1.0.1 — fix: action no longer requires GH_TOKEN. v1.0.0 used gh api for release lookup, which needed GH_TOKEN exposed by the caller. Composite actions don't inherit GH_TOKEN automatically, so any consumer that didn't explicitly pass with: token: or env: GH_TOKEN: failed with gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. v1.0.1 switches the API lookups to curl + jq against the public logmind release endpoint, removing the gh dependency entirely. The token input is still accepted but no longer required.
• v1.0.0 — initial release.

See Releases for the full history.

MIT. See LICENSE.