Skip to content

Commit 8a97090

Browse files
mandreko-bitwardenmandreko-bitwarden
authored
Clean up workflow files from Zizmor output (#1350)
1 parent 1fed28d commit 8a97090

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+346
-190
lines changed

‎.github/workflows/build-cli-docker.yml‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,16 @@ jobs:
2121
steps:
2222
- name: Checkout Repository
2323
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
24+
with:
25+
persist-credentials: false
2426

2527
- name: Check Branch to Publish
2628
id: publish-branch-check
2729
run: |
2830
if [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
29-
echo "is_publish_branch=true" >> $GITHUB_ENV
31+
echo "is_publish_branch=true" >> "$GITHUB_ENV"
3032
else
31-
echo "is_publish_branch=false" >> $GITHUB_ENV
33+
echo "is_publish_branch=false" >> "$GITHUB_ENV"
3234
fi
3335
3436
########## Set up Docker ##########
@@ -47,7 +49,7 @@ jobs:
4749
client_id: ${{ secrets.AZURE_CLIENT_ID }}
4850

4951
- name: Login to Azure ACR
50-
run: az acr login -n ${_AZ_REGISTRY%.azurecr.io}
52+
run: az acr login -n "${_AZ_REGISTRY%.azurecr.io}"
5153

5254
- name: Retrieve github PAT secrets
5355
id: retrieve-secret-pat
@@ -72,17 +74,17 @@ jobs:
7274
IMAGE_TAG=dev
7375
fi
7476
75-
echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
77+
echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
7678
7779
- name: Generate tag list
7880
id: tag-list
7981
env:
8082
IMAGE_TAG: ${{ steps.tag.outputs.image_tag }}
8183
run: |
8284
if [[ "${IMAGE_TAG}" == "dev" ]]; then
83-
echo "tags=$_AZ_REGISTRY/bws:${IMAGE_TAG},bitwarden/bws:${IMAGE_TAG}" >> $GITHUB_OUTPUT
85+
echo "tags=$_AZ_REGISTRY/bws:${IMAGE_TAG},bitwarden/bws:${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
8486
else
85-
echo "tags=$_AZ_REGISTRY/bws:${IMAGE_TAG}" >> $GITHUB_OUTPUT
87+
echo "tags=$_AZ_REGISTRY/bws:${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
8688
fi
8789
8890
- name: Build and push Docker image
@@ -109,12 +111,13 @@ jobs:
109111
DIGEST: ${{ steps.build-docker.outputs.digest }}
110112
TAGS: ${{ steps.tag-list.outputs.tags }}
111113
run: |
112-
IFS="," read -a tags <<< "${TAGS}"
113-
images=""
114-
for tag in "${tags[@]}"; do
115-
images+="${tag}@${DIGEST} "
114+
IFS=',' read -r -a tags_array <<< "${TAGS}"
115+
images=()
116+
for tag in "${tags_array[@]}"; do
117+
images+=("${tag}@${DIGEST}")
116118
done
117-
cosign sign --yes ${images}
119+
cosign sign --yes ${images[@]}
120+
echo "images=${images[*]}" >> "$GITHUB_OUTPUT"
118121
119122
- name: Scan Docker image
120123
id: container-scan
@@ -135,7 +138,7 @@ jobs:
135138
if: ${{ env.is_publish_branch == 'true' }}
136139
run: |
137140
docker logout
138-
echo "DOCKER_CONTENT_TRUST=0" >> $GITHUB_ENV
141+
echo "DOCKER_CONTENT_TRUST=0" >> "$GITHUB_ENV"
139142
140143
- name: Log out from Azure
141144
uses: bitwarden/gh-actions/azure-logout@main

‎.github/workflows/build-cli.yml‎

Lines changed: 44 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -23,22 +23,24 @@ jobs:
2323
steps:
2424
- name: Checkout repo
2525
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
26+
with:
27+
persist-credentials: false
2628

2729
- name: Get Package Version
2830
id: retrieve-version
2931
run: |
3032
VERSION=$(grep -o '^version = ".*"' crates/bws/Cargo.toml | grep -Eo "[0-9]+\.[0-9]+\.[0-9]+")
31-
echo "package_version=$VERSION" >> $GITHUB_OUTPUT
33+
echo "package_version=$VERSION" >> "$GITHUB_OUTPUT"
3234
3335
- name: Sign if repo is owned by Bitwarden
3436
id: sign
3537
env:
3638
REPO_OWNER: ${{ github.repository_owner }}
3739
run: |
3840
if [[ $REPO_OWNER == bitwarden ]]; then
39-
echo "sign=true" >> $GITHUB_OUTPUT
41+
echo "sign=true" >> "$GITHUB_OUTPUT"
4042
fi
41-
echo "sign=false" >> $GITHUB_OUTPUT
43+
echo "sign=false" >> "$GITHUB_OUTPUT"
4244
4345
build-windows:
4446
name: Building CLI for - ${{ matrix.settings.os }} - ${{ matrix.settings.target }}
@@ -61,6 +63,8 @@ jobs:
6163
steps:
6264
- name: Checkout repo
6365
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
66+
with:
67+
persist-credentials: false
6468

6569
- name: Install rust
6670
uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # stable
@@ -115,11 +119,11 @@ jobs:
115119
SIGNING_CERT_NAME: ${{ steps.retrieve-secrets-windows.outputs.code-signing-cert-name }}
116120
run: |
117121
azuresigntool sign -v \
118-
-kvu $SIGNING_VAULT_URL \
119-
-kvi $SIGNING_CLIENT_ID \
120-
-kvt $SIGNING_TENANT_ID \
121-
-kvs $SIGNING_CLIENT_SECRET \
122-
-kvc $SIGNING_CERT_NAME \
122+
-kvu "$SIGNING_VAULT_URL" \
123+
-kvi "$SIGNING_CLIENT_ID" \
124+
-kvt "$SIGNING_TENANT_ID" \
125+
-kvs "$SIGNING_CLIENT_SECRET" \
126+
-kvc "$SIGNING_CERT_NAME" \
123127
-fd sha256 \
124128
-du https://bitwarden.com \
125129
-tr http://timestamp.digicert.com \
@@ -158,6 +162,8 @@ jobs:
158162
steps:
159163
- name: Checkout repo
160164
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
165+
with:
166+
persist-credentials: false
161167

162168
- name: Install rust
163169
uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # stable
@@ -207,7 +213,7 @@ jobs:
207213
env:
208214
DECRYPT_FILE_PASSWORD: ${{ steps.get-kv-secrets.outputs.DECRYPT-FILE-PASSWORD }}
209215
run: |
210-
mkdir -p $HOME/secrets
216+
mkdir -p "$HOME/secrets"
211217
212218
gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
213219
--output "$HOME/secrets/devid-app-cert.p12" \
@@ -218,17 +224,17 @@ jobs:
218224
KEYCHAIN_PASSWORD: ${{ steps.get-kv-secrets.outputs.KEYCHAIN-PASSWORD }}
219225
DEVID_CERT_PASSWORD: ${{ steps.get-kv-secrets.outputs.DEVID-CERT-PASSWORD }}
220226
run: |
221-
security create-keychain -p $KEYCHAIN_PASSWORD build.keychain
227+
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
222228
security default-keychain -s build.keychain
223-
security unlock-keychain -p $KEYCHAIN_PASSWORD build.keychain
229+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
224230
security set-keychain-settings -lut 1200 build.keychain
225231
226-
ls $HOME/secrets
232+
ls "$HOME/secrets"
227233
228-
security import "$HOME/secrets/devid-app-cert.p12" -k build.keychain -P $DEVID_CERT_PASSWORD \
234+
security import "$HOME/secrets/devid-app-cert.p12" -k build.keychain -P "$DEVID_CERT_PASSWORD" \
229235
-T /usr/bin/codesign -T /usr/bin/security -T /usr/bin/productbuild
230236
231-
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $KEYCHAIN_PASSWORD build.keychain
237+
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
232238
233239
- name: Sign macos
234240
env:
@@ -246,12 +252,12 @@ jobs:
246252
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD"
247253
248254
echo "Creating notarization archive"
249-
zip -j ./bws-${{ matrix.settings.target }}-${{ env._PACKAGE_VERSION }}.zip ./target/${{ matrix.settings.target }}/release/bws
255+
zip -j "./bws-${{ matrix.settings.target }}-${_PACKAGE_VERSION}.zip" ./target/${{ matrix.settings.target }}/release/bws
250256
251-
codesign --sign "$MACOS_CERTIFICATE_NAME" --verbose=3 --force --options=runtime --timestamp ./bws-${{ matrix.settings.target }}-${{ env._PACKAGE_VERSION }}.zip
257+
codesign --sign "$MACOS_CERTIFICATE_NAME" --verbose=3 --force --options=runtime --timestamp "./bws-${{ matrix.settings.target }}-${_PACKAGE_VERSION}.zip"
252258
253259
echo "Notarize app"
254-
xcrun notarytool submit ./bws-${{ matrix.settings.target }}-${{ env._PACKAGE_VERSION }}.zip --keychain-profile "notarytool-profile" --wait
260+
xcrun notarytool submit "./bws-${{ matrix.settings.target }}-${_PACKAGE_VERSION}.zip" --keychain-profile "notarytool-profile" --wait
255261
256262
- name: Upload artifact
257263
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
@@ -286,6 +292,8 @@ jobs:
286292
steps:
287293
- name: Checkout repo
288294
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
295+
with:
296+
persist-credentials: false
289297

290298
- name: Install rust
291299
uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # stable
@@ -312,7 +320,7 @@ jobs:
312320
run: cargo zigbuild -p bws --release --target=${{ matrix.settings.target }}
313321

314322
- name: Zip linux
315-
run: zip -j ./bws-${{ matrix.settings.target }}-${{ env._PACKAGE_VERSION }}.zip ./target/${{ matrix.settings.target }}/release/bws
323+
run: zip -j "./bws-${{ matrix.settings.target }}-${_PACKAGE_VERSION}.zip" ./target/${{ matrix.settings.target }}/release/bws
316324

317325
- name: Upload artifact
318326
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
@@ -335,6 +343,8 @@ jobs:
335343
steps:
336344
- name: Checkout repo
337345
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
346+
with:
347+
persist-credentials: false
338348

339349
- name: Download x86_64-apple-darwin artifact
340350
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
@@ -348,8 +358,8 @@ jobs:
348358

349359
- name: Unzip artifacts
350360
run: |
351-
unzip bws-x86_64-apple-darwin-${{ env._PACKAGE_VERSION }}.zip -d ./bws-x86_64-apple-darwin
352-
unzip bws-aarch64-apple-darwin-${{ env._PACKAGE_VERSION }}.zip -d ./bws-aarch64-apple-darwin
361+
unzip "bws-x86_64-apple-darwin-${_PACKAGE_VERSION}.zip" -d ./bws-x86_64-apple-darwin
362+
unzip "bws-aarch64-apple-darwin-${_PACKAGE_VERSION}.zip" -d ./bws-aarch64-apple-darwin
353363
354364
- name: Create universal package with lipo
355365
run: |
@@ -389,7 +399,7 @@ jobs:
389399
env:
390400
DECRYPT_FILE_PASSWORD: ${{ steps.get-kv-secrets.outputs.DECRYPT-FILE-PASSWORD }}
391401
run: |
392-
mkdir -p $HOME/secrets
402+
mkdir -p "$HOME/secrets"
393403
394404
gpg --quiet --batch --yes --decrypt --passphrase="$DECRYPT_FILE_PASSWORD" \
395405
--output "$HOME/secrets/devid-app-cert.p12" \
@@ -400,15 +410,15 @@ jobs:
400410
KEYCHAIN_PASSWORD: ${{ steps.get-kv-secrets.outputs.KEYCHAIN-PASSWORD }}
401411
DEVID_CERT_PASSWORD: ${{ steps.get-kv-secrets.outputs.DEVID-CERT-PASSWORD }}
402412
run: |
403-
security create-keychain -p $KEYCHAIN_PASSWORD build.keychain
413+
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
404414
security default-keychain -s build.keychain
405-
security unlock-keychain -p $KEYCHAIN_PASSWORD build.keychain
415+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
406416
security set-keychain-settings -lut 1200 build.keychain
407417
408-
security import "$HOME/secrets/devid-app-cert.p12" -k build.keychain -P $DEVID_CERT_PASSWORD \
418+
security import "$HOME/secrets/devid-app-cert.p12" -k build.keychain -P "$DEVID_CERT_PASSWORD" \
409419
-T /usr/bin/codesign -T /usr/bin/security -T /usr/bin/productbuild
410420
411-
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k $KEYCHAIN_PASSWORD build.keychain
421+
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
412422
413423
- name: Sign binary
414424
env:
@@ -427,12 +437,12 @@ jobs:
427437
xcrun notarytool store-credentials "notarytool-profile" --apple-id "$MACOS_NOTARIZATION_APPLE_ID" --team-id "$MACOS_NOTARIZATION_TEAM_ID" --password "$MACOS_NOTARIZATION_PWD"
428438
429439
echo "Creating notarization archive"
430-
zip -j ./bws-macos-universal-${{ env._PACKAGE_VERSION }}.zip ./bws-macos-universal/bws
440+
zip -j "./bws-macos-universal-${_PACKAGE_VERSION}.zip" ./bws-macos-universal/bws
431441
432-
codesign --sign "$MACOS_CERTIFICATE_NAME" --verbose=3 --force --options=runtime --timestamp ./bws-macos-universal-${{ env._PACKAGE_VERSION }}.zip
442+
codesign --sign "$MACOS_CERTIFICATE_NAME" --verbose=3 --force --options=runtime --timestamp "./bws-macos-universal-${_PACKAGE_VERSION}.zip"
433443
434444
echo "Notarize app"
435-
xcrun notarytool submit ./bws-macos-universal-${{ env._PACKAGE_VERSION }}.zip --keychain-profile "notarytool-profile" --wait
445+
xcrun notarytool submit "./bws-macos-universal-${_PACKAGE_VERSION}.zip" --keychain-profile "notarytool-profile" --wait
436446
437447
- name: Upload artifact
438448
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
@@ -451,6 +461,8 @@ jobs:
451461
steps:
452462
- name: Checkout repo
453463
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
464+
with:
465+
persist-credentials: false
454466

455467
- name: Install rust
456468
uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # stable
@@ -469,7 +481,7 @@ jobs:
469481
working-directory: ./crates/bws
470482
run: |
471483
cargo about generate ../../about.hbs > THIRDPARTY.html
472-
sed -i.bak 's/\$NAME\$/Bitwarden Secrets Manager CLI/g' THIRDPARTY.html
484+
sed -i.bak "s/\$NAME\$/Bitwarden Secrets Manager CLI/g" THIRDPARTY.html
473485
474486
- name: Upload artifact
475487
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
@@ -487,6 +499,8 @@ jobs:
487499
steps:
488500
- name: Checkout repo
489501
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
502+
with:
503+
persist-credentials: false
490504

491505
- name: Install rust
492506
uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 # stable
@@ -502,7 +516,7 @@ jobs:
502516
run: |
503517
cargo check -p bws --message-format json > build.json
504518
OUT_DIR=$(jq -r --slurp '.[] | select (.reason == "build-script-executed") | select(.package_id|contains("crates/bws")) .out_dir' build.json)
505-
mv $OUT_DIR/manpages .
519+
mv "$OUT_DIR/manpages" .
506520
507521
- name: Upload artifact
508522
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3

‎.github/workflows/build-cpp.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ jobs:
4747
steps:
4848
- name: Checkout Repository
4949
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
50+
with:
51+
persist-credentials: false
5052

5153
- name: Install dependencies linux
5254
if: runner.os == 'Linux'
@@ -127,7 +129,7 @@ jobs:
127129
128130
mkdir build
129131
cd build
130-
cmake .. -DNLOHMANN=$DNLOHMANN_PATH -DBOOST=$DBOOST_PATH -DTARGET=$DTARGET
132+
cmake .. -DNLOHMANN="$DNLOHMANN_PATH" -DBOOST="$DBOOST_PATH" -DTARGET="$DTARGET"
131133
cmake --build .
132134
133135
- name: Build windows
@@ -153,7 +155,7 @@ jobs:
153155
cp libBitwardenClient.* artifacts
154156
fi
155157
if [[ '${{ runner.os }}' == 'Windows' ]]; then
156-
cp */BitwardenClient.* artifacts
158+
cp ./*/BitwardenClient.* artifacts
157159
cp ../include/bitwarden_c.{lib,dll.lib,dll} artifacts
158160
fi
159161

‎.github/workflows/build-dotnet.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ jobs:
2929
steps:
3030
- name: Checkout repo
3131
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
32+
with:
33+
persist-credentials: false
3234

3335
- name: Install xmllint
3436
run: |
@@ -39,7 +41,7 @@ jobs:
3941
id: version
4042
run: |
4143
VERSION=$(xmllint --xpath 'string(/Project/PropertyGroup/Version)' languages/csharp/Bitwarden.Sdk/Bitwarden.Sdk.csproj)
42-
echo "version=$VERSION" >> $GITHUB_OUTPUT
44+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
4345
4446
build_dotnet:
4547
name: Build .NET
@@ -52,6 +54,8 @@ jobs:
5254
steps:
5355
- name: Checkout Repository
5456
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
57+
with:
58+
persist-credentials: false
5559

5660
- name: Download C# schemas artifact
5761
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0

‎.github/workflows/build-go.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ jobs:
2323
steps:
2424
- name: Checkout Repository
2525
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
26+
with:
27+
persist-credentials: false
2628

2729
- name: Setup Go environment
2830
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0

‎.github/workflows/build-java.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ jobs:
2929
steps:
3030
- name: Checkout Repository
3131
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
32+
with:
33+
persist-credentials: false
3234

3335
- name: Download Java schemas artifact
3436
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0

‎.github/workflows/build-napi.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ jobs:
5555
steps:
5656
- name: Checkout repo
5757
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
58+
with:
59+
persist-credentials: false
5860

5961
- name: Setup Node
6062
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0

0 commit comments

Comments
 (0)