Skip to content

Commit bf412b4

Browse files
dhalbertdhalbert
authored
Merge pull request adafruit#9785 from jepler/zizmor
Fix various issues detected by zizmor
2 parents db84e81 + 20dc44d commit bf412b4

File tree

6 files changed

+41
-13
lines changed

6 files changed

+41
-13
lines changed

‎.github/workflows/build-board-custom.yml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,21 +42,29 @@ jobs:
4242
run: |
4343
git clone --filter=tree:0 https://github.com/adafruit/circuitpython.git $GITHUB_WORKSPACE
4444
- name: Checkout head / tag
45+
env:
46+
TAG: ${{ inputs.version == 'latest' && 'HEAD' || inputs.version }}
4547
run: |
46-
git checkout ${{ inputs.version == 'latest' && 'HEAD' || inputs.version }}
48+
git checkout "$TAG"
4749
- name: fork compatibility
4850
if: github.repository_owner != 'adafruit'
51+
env:
52+
REPO: ${{ github.repository }}
4953
run: |
50-
git remote add fork https://github.com/${{github.repository}}.git
54+
git remote add fork "https://github.com/$REPO.git"
5155
git fetch fork --filter=tree:0
5256
- name: branch compatibility
5357
if: inputs.branch != 'main' && inputs.version == 'latest' && github.repository_owner == 'adafruit'
58+
env:
59+
BRANCH: ${{ inputs.branch }}
5460
run: |
55-
git checkout ${{inputs.branch}}
61+
git checkout "$BRANCH"
5662
- name: branch compatibility (fork)
5763
if: inputs.branch != '' && inputs.version == 'latest' && github.repository_owner != 'adafruit'
64+
env:
65+
BRANCH: ${{ inputs.branch }}
5866
run: |
59-
git checkout -b fork-branch fork/${{inputs.branch}}
67+
git checkout -b fork-branch "fork/$BRANCH"
6068
- name: Set up identifier
6169
if: inputs.debug || inputs.flags != ''
6270
run: |
@@ -101,7 +109,12 @@ jobs:
101109
riscv64-unknown-elf-gcc --version || true
102110
mkfs.fat --version || true
103111
- name: Build board
104-
run: make -j4 ${{ inputs.flags }} BOARD=${{ inputs.board }} DEBUG=${{ inputs.debug && '1' || '0' }} TRANSLATION=${{ inputs.language }}
112+
env:
113+
TRANSLATION: ${{ inputs.language }}
114+
BOARD: ${{ inputs.board }}
115+
FLAGS: ${{ inputs.flags }}
116+
DEBUG: ${{ inputs.debug && '1' || '0' }}
117+
run: make -j4 $FLAGS BOARD="$BOARD" DEBUG=$DEBUG TRANSLATION="$TRANSLATION"
105118
working-directory: ports/${{ steps.set-up-port.outputs.port }}
106119
- name: Upload artifact
107120
uses: actions/upload-artifact@v4

‎.github/workflows/build-boards.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ jobs:
3131
submodules: false
3232
show-progress: false
3333
fetch-depth: 1
34+
persist-credentials: false
3435

3536
- name: Set up python
3637
uses: actions/setup-python@v5

‎.github/workflows/build-mpy-cross.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ jobs:
3333
submodules: false
3434
show-progress: false
3535
fetch-depth: 1
36+
persist-credentials: false
3637
- name: Set up python
3738
uses: actions/setup-python@v5
3839
with:
@@ -57,9 +58,12 @@ jobs:
5758
run: make -C mpy-cross -j4 -f Makefile.${{ matrix.mpy-cross }}
5859

5960
- name: Set output
61+
env:
62+
EX: ${{ env[format('EX_{0}', matrix.mpy-cross)] || matrix.mpy-cross }}
63+
OS: ${{ env[format('OS_{0}', matrix.mpy-cross)] }}"
6064
run: |
61-
echo >> $GITHUB_ENV "EX=${{ env[format('EX_{0}', matrix.mpy-cross)] || matrix.mpy-cross }}"
62-
echo >> $GITHUB_ENV "OS=${{ env[format('OS_{0}', matrix.mpy-cross)] }}"
65+
echo >> $GITHUB_ENV "EX=$EX"
66+
echo >> $GITHUB_ENV "OS=$OS"
6367
6468
- name: Upload artifact
6569
uses: actions/upload-artifact@v4

‎.github/workflows/build.yml‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ jobs:
3333
submodules: false
3434
show-progress: false
3535
fetch-depth: 1
36+
persist-credentials: false
3637
- name: Set up python
3738
uses: actions/setup-python@v5
3839
with:
@@ -66,15 +67,19 @@ jobs:
6667
EXCLUDE_COMMIT: ${{ github.event.pull_request.head.sha }}
6768
- name: Set head sha (pull)
6869
if: github.event_name == 'pull_request'
69-
run: echo "HEAD_SHA=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV
70+
env:
71+
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
72+
run: echo "HEAD_SHA=$HEAD_SHA" >> $GITHUB_ENV
7073
- name: Set base sha (pull)
7174
if: github.event_name == 'pull_request'
7275
run: git cat-file -e $SHA && echo "BASE_SHA=$SHA" >> $GITHUB_ENV || true
7376
env:
7477
SHA: ${{ steps.get-last-commit-with-checks.outputs.commit_sha || github.event.pull_request.base.sha }}
7578
- name: Set head sha (push)
7679
if: github.event_name == 'push'
77-
run: echo "HEAD_SHA=${{ github.event.after }}" >> $GITHUB_ENV
80+
env:
81+
SHA: ${{ github.event.after }}
82+
run: echo "HEAD_SHA=$SHA" >> $GITHUB_ENV
7883
- name: Set base sha (push)
7984
if: github.event_name == 'push'
8085
run: git cat-file -e $SHA && echo "BASE_SHA=$SHA" >> $GITHUB_ENV || true
@@ -114,6 +119,7 @@ jobs:
114119
submodules: false
115120
show-progress: false
116121
fetch-depth: 1
122+
persist-credentials: false
117123
- name: Set up python
118124
uses: actions/setup-python@v5
119125
with:
@@ -149,9 +155,9 @@ jobs:
149155
(github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository_owner == 'adafruit') ||
150156
(github.event_name == 'release' && (github.event.action == 'published' || github.event.action == 'rerequested'))
151157
run: |
152-
[ -z "$AWS_ACCESS_KEY_ID" ] || aws s3 cp mpy-cross-macos-universal s3://adafruit-circuit-python/bin/mpy-cross/macos/mpy-cross-macos-${{ env.CP_VERSION }}-universal --no-progress --region us-east-1
153-
[ -z "$AWS_ACCESS_KEY_ID" ] || aws s3 cp mpy-cross/build-arm64/mpy-cross-arm64 s3://adafruit-circuit-python/bin/mpy-cross/macos/mpy-cross-macos-${{ env.CP_VERSION }}-arm64 --no-progress --region us-east-1
154-
[ -z "$AWS_ACCESS_KEY_ID" ] || aws s3 cp mpy-cross/build/mpy-cross s3://adafruit-circuit-python/bin/mpy-cross/macos/mpy-cross-macos-${{ env.CP_VERSION }}-x64 --no-progress --region us-east-1
158+
[ -z "$AWS_ACCESS_KEY_ID" ] || aws s3 cp mpy-cross-macos-universal s3://adafruit-circuit-python/bin/mpy-cross/macos/mpy-cross-macos-"${CP_VERSION}"-universal --no-progress --region us-east-1
159+
[ -z "$AWS_ACCESS_KEY_ID" ] || aws s3 cp mpy-cross/build-arm64/mpy-cross-arm64 s3://adafruit-circuit-python/bin/mpy-cross/macos/mpy-cross-macos-"${CP_VERSION}"-arm64 --no-progress --region us-east-1
160+
[ -z "$AWS_ACCESS_KEY_ID" ] || aws s3 cp mpy-cross/build/mpy-cross s3://adafruit-circuit-python/bin/mpy-cross/macos/mpy-cross-macos-"${CP_VERSION}"-x64 --no-progress --region us-east-1
155161
env:
156162
AWS_PAGER: ''
157163
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -170,6 +176,7 @@ jobs:
170176
submodules: false
171177
show-progress: false
172178
fetch-depth: 1
179+
persist-credentials: false
173180
- name: Set up python
174181
uses: actions/setup-python@v5
175182
with:
@@ -188,7 +195,7 @@ jobs:
188195
name: stubs
189196
path: circuitpython-stubs/dist/*
190197
- name: Test Documentation Build (HTML)
191-
run: sphinx-build -E -W -b html -D version=${{ env.CP_VERSION }} -D release=${{ env.CP_VERSION }} . _build/html
198+
run: sphinx-build -E -W -b html -D version="$CP_VERSION" -D release="$CP_VERSION" . _build/html
192199
- uses: actions/upload-artifact@v4
193200
with:
194201
name: docs-html
@@ -271,6 +278,7 @@ jobs:
271278
submodules: false
272279
show-progress: false
273280
fetch-depth: 1
281+
persist-credentials: false
274282
- name: Set up submodules
275283
uses: ./.github/actions/deps/submodules
276284
- name: build mpy-cross

‎.github/workflows/create-website-pr.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ jobs:
2222
submodules: false
2323
show-progress: false
2424
fetch-depth: 1
25+
persist-credentials: false
2526
- name: Set up python
2627
uses: actions/setup-python@v5
2728
with:

‎.github/workflows/pre-commit.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ jobs:
2222
submodules: false
2323
show-progress: false
2424
fetch-depth: 1
25+
persist-credentials: false
2526
- name: Set up python
2627
uses: actions/setup-python@v5
2728
with:

0 commit comments

Comments
 (0)