Skip to content

Commit 4c2818c

Browse files
lachlankidsonlachlankidson
authored
COPP-8605: Deploy zizmor to open source repos (#2561)
* COPP-8605: Deploy zizmor to open source repos * zizmor --fix=all . * pinact run -fix -diff * Address warnings[excessive-permissions] * pull_request_target to pull_request * Address info[template-injection]
1 parent e9d0210 commit 4c2818c

File tree

9 files changed

+93
-41
lines changed

9 files changed

+93
-41
lines changed

‎.github/actions/setup-java/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ runs:
44
using: "composite"
55
steps:
66
- name: Set up JDK
7-
uses: actions/setup-java@v5
7+
uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
88
with:
99
java-version: '17'
1010
distribution: 'adopt'
11-
cache: gradle
11+
cache: gradle

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ updates:
2020
patterns:
2121
- "com.android.tools:*"
2222
- "com.android.tools.*"
23+
cooldown:
24+
default-days: 7
2325

2426
- package-ecosystem: npm
2527
directory: "/"
@@ -31,10 +33,14 @@ updates:
3133
versioning-strategy: increase-if-necessary
3234
allow:
3335
- dependency-type: "direct"
36+
cooldown:
37+
default-days: 7
3438
- package-ecosystem: github-actions
3539
directory: "/"
3640
schedule:
3741
interval: weekly
3842
day: monday
3943
time: "19:00"
4044
open-pull-requests-limit: 10
45+
cooldown:
46+
default-days: 7

‎.github/workflows/_build.yml‎

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@ jobs:
2929
timeout-minutes: 15
3030

3131
steps:
32-
- uses: actions/checkout@v6
32+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
33+
with:
34+
persist-credentials: false
3335

3436
- uses: ./.github/actions/setup-java
3537

@@ -45,7 +47,9 @@ jobs:
4547
timeout-minutes: 15
4648

4749
steps:
48-
- uses: actions/checkout@v6
50+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
51+
with:
52+
persist-credentials: false
4953

5054
- uses: ./.github/actions/setup-java
5155

@@ -62,20 +66,21 @@ jobs:
6266
contents: write
6367

6468
steps:
65-
- uses: actions/create-github-app-token@v2
69+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
6670
id: app-token
6771
with:
6872
app-id: ${{ vars.GH_APP_ID }}
6973
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
7074

71-
- uses: actions/checkout@v6
75+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
7276
with:
7377
token: ${{ steps.app-token.outputs.token }}
78+
persist-credentials: false
7479

7580
- name: Fetch Dependabot metadata
7681
id: dependabot-metadata
77-
uses: dependabot/fetch-metadata@v2.5.0
78-
if: ${{ github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' }}
82+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
83+
if: ${{ github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' }}
7984
with:
8085
github-token: "${{ steps.app-token.outputs.token }}"
8186

@@ -95,27 +100,27 @@ jobs:
95100
- uses: ./.github/actions/setup-java
96101

97102
- name: Validate Gradle Wrapper
98-
uses: gradle/actions/wrapper-validation@v5
103+
uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
99104

100105
- name: Build
101106
run: |
102107
./gradlew assemble${{ env.flavour }}${{ env.config }} -PdisablePreDex
103108
104109
- name: Tokens check
105-
if: ${{ github.event_name != 'pull_request' || github.actor != 'dependabot[bot]' || github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' && !contains(steps.dependabot-metadata.outputs.dependency-names, 'bpk-') }}
110+
if: ${{ github.event_name != 'pull_request' || github.actor != 'dependabot[bot]' || github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' && !contains(steps.dependabot-metadata.outputs.dependency-names, 'bpk-') }}
106111
run: |
107112
./gradlew generateTokens -PdisablePreDex
108113
./scripts/check-no-changes.sh
109114
110115
- name: Token update
111116
id: tokenUpdate
112-
if: ${{ github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' && contains(steps.dependabot-metadata.outputs.dependency-names, 'bpk-')}}
117+
if: ${{ github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' && contains(steps.dependabot-metadata.outputs.dependency-names, 'bpk-')}}
113118
run: |
114119
./gradlew generateTokens -PdisablePreDex
115120
changedFiles=`git status --porcelain` && echo "CHANGED_FILES=${changedFiles//$'\n'/'%0A'}" >> $GITHUB_OUTPUT
116121
117122
- name: Token commit
118-
if: ${{ github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' && steps.tokenUpdate.outputs.CHANGED_FILES != '' && contains(steps.dependabot-metadata.outputs.dependency-names, 'bpk-') }}
123+
if: ${{ github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' && steps.tokenUpdate.outputs.CHANGED_FILES != '' && contains(steps.dependabot-metadata.outputs.dependency-names, 'bpk-') }}
119124
run: |
120125
git config --local user.email "197108191+skyscanner-backpack-bot[bot]@users.noreply.github.com"
121126
git config --local user.name "skyscanner-backpack-bot[bot]"
@@ -138,7 +143,9 @@ jobs:
138143
steps:
139144

140145
- name: Checkout
141-
uses: actions/checkout@v6
146+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
147+
with:
148+
persist-credentials: false
142149

143150
- name: Enable KVM group perms
144151
run: |
@@ -149,7 +156,7 @@ jobs:
149156
- uses: ./.github/actions/setup-java
150157

151158
- name: AVD cache
152-
uses: actions/cache@v5
159+
uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
153160
id: avd-cache
154161
with:
155162
path: |
@@ -159,7 +166,7 @@ jobs:
159166

160167
- name: create AVD and generate snapshot for caching
161168
if: steps.avd-cache.outputs.cache-hit != 'true'
162-
uses: reactivecircus/android-emulator-runner@v2
169+
uses: reactivecircus/android-emulator-runner@b530d96654c385303d652368551fb075bc2f0b6b # v2.35.0
163170
with:
164171
profile: Nexus 4
165172
sdcard-path-or-size: 512M
@@ -171,7 +178,7 @@ jobs:
171178
script: echo "Generated AVD snapshot for caching."
172179

173180
- name: Android Tests
174-
uses: reactivecircus/android-emulator-runner@v2
181+
uses: reactivecircus/android-emulator-runner@b530d96654c385303d652368551fb075bc2f0b6b # v2.35.0
175182
with:
176183
profile: Nexus 4
177184
sdcard-path-or-size: 512M
@@ -212,7 +219,9 @@ jobs:
212219
flag: themed
213220
steps:
214221
- name: Checkout
215-
uses: actions/checkout@v6
222+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
223+
with:
224+
persist-credentials: false
216225

217226
- uses: ./.github/actions/setup-java
218227

@@ -222,7 +231,7 @@ jobs:
222231
./gradlew app:recordRoborazziOssDebug -Dvariant=${{ matrix.variant.flag }}
223232
224233
- name: Upload Screenshots
225-
uses: actions/upload-artifact@v6
234+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
226235
with:
227236
name: screenshots-${{ matrix.variant.flag }}
228237
path: app/screenshots/
@@ -237,19 +246,20 @@ jobs:
237246
contents: write
238247
timeout-minutes: 5
239248
steps:
240-
- uses: actions/create-github-app-token@v2
249+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
241250
id: app-token
242251
with:
243252
app-id: ${{ vars.GH_APP_ID }}
244253
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
245254

246255
- name: Checkout
247-
uses: actions/checkout@v6
256+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
248257
with:
249258
token: ${{ steps.app-token.outputs.token }}
259+
persist-credentials: false
250260

251261
- name: Download all screenshot artifacts
252-
uses: actions/download-artifact@v7
262+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
253263
with:
254264
path: screenshot-artifacts
255265

‎.github/workflows/label-check.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,17 @@
11
name: label-check
22

33
on:
4-
pull_request_target:
4+
pull_request:
55
types: [opened, labeled, unlabeled, synchronize]
66

7+
permissions: {}
8+
79
jobs:
810
label-check:
911
runs-on: ubuntu-24.04-16cores-public
1012

1113
steps:
12-
- uses: actions/create-github-app-token@v2
14+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
1315
id: app-token
1416
with:
1517
app-id: ${{ vars.GH_APP_ID }}

‎.github/workflows/main.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,13 @@ jobs:
3030
contents: write
3131
pull-requests: read
3232
steps:
33-
- uses: actions/create-github-app-token@v2
33+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
3434
id: app-token
3535
with:
3636
app-id: ${{ vars.GH_APP_ID }}
3737
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
3838

3939
- name: Draft release notes
40-
uses: release-drafter/release-drafter@v6
40+
uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
4141
env:
4242
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

‎.github/workflows/pr.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,17 @@ jobs:
2828
runs-on: ubuntu-24.04-16cores-public
2929
permissions:
3030
pull-requests: write
31-
if: ${{ github.actor == 'dependabot[bot]' }}
31+
if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
3232
steps:
33-
- uses: actions/create-github-app-token@v2
33+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
3434
id: app-token
3535
with:
3636
app-id: ${{ vars.GH_APP_ID }}
3737
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
3838

3939
- name: Fetch Dependabot metadata
4040
id: dependabot-metadata
41-
uses: dependabot/fetch-metadata@v2.5.0
41+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
4242
with:
4343
github-token: "${{ steps.app-token.outputs.token }}"
4444

@@ -50,12 +50,14 @@ jobs:
5050
PR_URL: ${{github.event.pull_request.html_url}}
5151

5252
- name: Apply dependency labels
53-
uses: actions/github-script@v8
53+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
54+
env:
55+
UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
5456
with:
5557
github-token: ${{ steps.app-token.outputs.token }}
5658
script: |
5759
const prNumber = context.issue.number;
58-
const updateType = '${{ steps.metadata.outputs.update-type }}';
60+
const updateType = process.env.UPDATE_TYPE;
5961
6062
// Get current labels
6163
const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
@@ -128,14 +130,14 @@ jobs:
128130
permissions:
129131
pull-requests: write
130132
steps:
131-
- uses: actions/create-github-app-token@v2
133+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
132134
id: app-token
133135
with:
134136
app-id: ${{ vars.GH_APP_ID }}
135137
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
136138

137139
- name: Detect Copilot commits and label PR
138-
uses: actions/github-script@v8
140+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
139141
with:
140142
github-token: ${{ steps.app-token.outputs.token }}
141143
script: |

‎.github/workflows/release.yml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,17 +35,19 @@ jobs:
3535

3636
steps:
3737

38-
- uses: actions/create-github-app-token@v2
38+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
3939
id: app-token
4040
with:
4141
app-id: ${{ vars.GH_APP_ID }}
4242
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
4343

4444
- name: Checkout
45-
uses: actions/checkout@v6
45+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
46+
with:
47+
persist-credentials: false
4648

4749
- name: Set up JDK
48-
uses: actions/setup-java@v5
50+
uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
4951
with:
5052
java-version: '17'
5153
distribution: 'adopt'
@@ -66,14 +68,16 @@ jobs:
6668
run: ./gradlew :backpack-compose:generateComponentList
6769
- name: Upload components list to release
6870
continue-on-error: true
69-
run: gh release upload ${{ github.event.release.tag_name }} backpack-compose/build/outputs/compose_components.txt --clobber
71+
run: gh release upload ${GITHUB_EVENT_RELEASE_TAG_NAME} backpack-compose/build/outputs/compose_components.txt --clobber
7072
env:
7173
GH_TOKEN: ${{ steps.app-token.outputs.token }}
74+
GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
7275

7376
- name: Publish artifacts
74-
run: ./gradlew publish -Pversion=${{ github.event.release.tag_name }}
77+
run: ./gradlew publish -Pversion=${GITHUB_EVENT_RELEASE_TAG_NAME}
7578
env:
7679
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80+
GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
7781

7882
- name: Install libsecret for Supernova CLI
7983
run: sudo apt-get update && sudo apt-get install -y libsecret-1-0

‎.github/workflows/update-copyright.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,17 @@ jobs:
1616
runs-on: ubuntu-24.04-16cores-public
1717

1818
steps:
19-
- uses: actions/create-github-app-token@v2
19+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
2020
id: app-token
2121
with:
2222
app-id: ${{ vars.GH_APP_ID }}
2323
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
2424

2525
- name: Checkout repository
26-
uses: actions/checkout@v6
26+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2727
with:
2828
token: ${{ steps.app-token.outputs.token }}
29+
persist-credentials: false
2930

3031
- name: Set current year
3132
id: date
@@ -50,7 +51,7 @@ jobs:
5051
5152
- name: Create Pull Request
5253
if: steps.changes.outputs.changes == 'true'
53-
uses: peter-evans/create-pull-request@v8
54+
uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
5455
with:
5556
token: ${{ steps.app-token.outputs.token }}
5657
commit-message: "chore: update copyright year to ${{ steps.date.outputs.year }}"
@@ -69,8 +70,10 @@ jobs:
6970

7071
- name: Output result
7172
run: |
72-
if [[ "${{ steps.changes.outputs.changes }}" == "true" ]]; then
73+
if [[ "${STEPS_CHANGES_OUTPUTS_CHANGES}" == "true" ]]; then
7374
echo "Copyright year has been updated and a PR has been created"
7475
else
7576
echo "Copyright year is already current, no action needed"
7677
fi
78+
env:
79+
STEPS_CHANGES_OUTPUTS_CHANGES: ${{ steps.changes.outputs.changes }}

‎.github/workflows/zizmor.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: GitHub Actions Security Analysis with zizmor 🌈
2+
3+
on:
4+
push:
5+
branches:
6+
- "main"
7+
pull_request:
8+
branches:
9+
- "**"
10+
11+
permissions: {}
12+
13+
jobs:
14+
zizmor:
15+
runs-on: ubuntu-24.04-2cores-tools-public
16+
permissions:
17+
security-events: write
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
21+
with:
22+
persist-credentials: false
23+
24+
- name: Run zizmor 🌈
25+
uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0

0 commit comments

Comments
 (0)