If we add more dependencies it means we need to fetch more things, plus this PR unnecessarily increases the complexity of the Action.

I'm confused, this PR doesn't add a dependency, what do you mean by that?

Dependencies in "external" files (as in files that are not the Action file, not actual dependencies). So if we move git log --oneline ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} | grep -v -e fixup -e squash | awk '{ print $1 }' | xargs npx -q core-validate-commit --no-validate-metadata --tap to a script in tools/actions now we need to download two files instead of one. Furthermore, downloading a file manually when this file will be fetched automatically as part of #39121 is unnecessary extra work that doesn't add robustness to the action, just complexity.

I agree that curl command does make the action more fragile. If the script is made to work around merging (which clearly different from squashing, please blame my insufficient knowledge of git on that one), I'm closing this in favor of your PR.