- Added support for SHA256 hash verification to ensure the integrity of downloaded binaries.
- Introduced `expected_sha256` as an input parameter for users to supply the expected hash.
- Implemented hash computation and comparison; download proceeds only if hashes match.
- Improves security by preventing execution of potentially tampered files.

This enhancement secures the installation process by verifying file integrity.

…tion

- Introduced `expected_sha256` as a new input parameter in `action.yml`.
- Allows users to specify an expected SHA256 hash for the downloaded TFLint binary.
- If `expected_sha256` is provided, the action will compute and compare the hash, proceeding only if there's a match.
- Enhances security by preventing execution of tampered or corrupted files.

This update ensures that downloaded binaries meet integrity requirements before installation.

… feature

- Updated version to 2.1.0 to reflect the new SHA256 verification feature for downloaded binaries.
- Enhanced description and keywords to include SHA256 verification.
- This update improves security by allowing users to verify the integrity of downloaded files with an expected SHA256 hash.

Version bump ensures semantic versioning alignment with the new feature addition.

- Revised `README.md` to describe `expected_sha256` input as accepting a comma-separated list of SHA256 hashes.
- Provided example usage in the `Usage` section showing how to specify multiple expected hash values.
- Clarified that this change allows integrity verification against multiple valid hashes, adding flexibility for binaries from different sources or mirrors.

Updated documentation for the expected_sha256 parameter to clarify that multiple SHA256 hashes may be provided to support platform-specific binaries (e.g., macOS, Linux, Windows) for the same TFLint version. This ensures integrity checks are compatible across platforms in matrix workflows.

- Refactored handling of `expected_sha256` input to avoid errors when input is undefined.
- Ensured `expectedHashes` is set to an array of hashes or `undefined` based on the presence of `expected_sha256`.
- This fix prevents unexpected exceptions during execution if `expected_sha256` is not provided, allowing for optional integrity checks.

This resolves issues with optional SHA256 verification in the `downloadCLI` function.

- Replaced `expected_sha256` input with `checksums` for clarity.
- Updated `checksums` input to use newline-separated values instead of commas for better readability.
- Added a dedicated example section for `checksums` usage in the documentation to guide users on its proper implementation.

remove irrelevant text

- Updated the README to include a note advising users to verify binary hashes independently before pinning.
  - Suggested using methods such as GitHub’s attestation or cosign for hash verification to ensure that only approved binaries are used in workflows.
  - Emphasized that the `checksums` input requires manual pinning and that users should validate hashes as an added security measure.

- Updated the `checksums` section to clarify that checksums guarantee only the immutability of the downloaded binary by verifying it has not been altered, without addressing integrity, trust, attribution, or authenticity.
- Specified that multiple hashes enable cross-platform compatibility for workflows running on different platforms, architectures, or operating systems, where each may produce a unique hash.
- Added guidance for users to verify the binary's source and authenticity independently using methods like GitHub’s Artifact Attestations or cosign before adding hashes to workflows.