Skip to content

Commit bb9683d

Browse files
tonistiigitonistiigi
authored
Merge pull request #955 from crazy-max/zizmor
ci: zizmor workflow
2 parents 5c42dd2 + abb6787 commit bb9683d

File tree

10 files changed

+110
-46
lines changed

10 files changed

+110
-46
lines changed

‎.github/dependabot.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,21 @@ updates:
44
directory: "/"
55
schedule:
66
interval: "daily"
7+
cooldown:
8+
default-days: 2
9+
groups:
10+
crazy-max-dot-github:
11+
patterns:
12+
- "crazy-max/.github/*"
713
labels:
814
- "dependencies"
915
- "bot"
1016
- package-ecosystem: "npm"
1117
directory: "/"
1218
schedule:
1319
interval: "daily"
20+
cooldown:
21+
default-days: 2
1422
versioning-strategy: "increase"
1523
groups:
1624
aws-sdk-dependencies:

‎.github/workflows/ci.yml‎

Lines changed: 26 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: ci
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -19,7 +22,7 @@ jobs:
1922
steps:
2023
-
2124
name: Checkout
22-
uses: actions/checkout@v6
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2326
-
2427
name: Stop docker
2528
run: |
@@ -43,7 +46,7 @@ jobs:
4346
steps:
4447
-
4548
name: Checkout
46-
uses: actions/checkout@v6
49+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4750
-
4851
name: Login to GitHub Container Registry
4952
uses: ./
@@ -60,7 +63,7 @@ jobs:
6063
steps:
6164
-
6265
name: Checkout
63-
uses: actions/checkout@v6
66+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6467
-
6568
name: Login to GitHub Container Registry
6669
uses: ./
@@ -70,7 +73,7 @@ jobs:
7073
password: ${{ secrets.GHCR_PAT }}
7174
-
7275
name: DinD
73-
uses: docker://docker
76+
uses: docker://docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
7477
with:
7578
entrypoint: docker
7679
args: pull ghcr.io/docker-ghactiontest/test
@@ -85,7 +88,7 @@ jobs:
8588
steps:
8689
-
8790
name: Checkout
88-
uses: actions/checkout@v6
91+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8992
-
9093
name: Login to ACR
9194
uses: ./
@@ -105,7 +108,7 @@ jobs:
105108
steps:
106109
-
107110
name: Checkout
108-
uses: actions/checkout@v6
111+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
109112
-
110113
name: Login to Docker Hub
111114
uses: ./
@@ -124,7 +127,7 @@ jobs:
124127
steps:
125128
-
126129
name: Checkout
127-
uses: actions/checkout@v6
130+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
128131
-
129132
name: Login to ECR
130133
uses: ./
@@ -144,10 +147,10 @@ jobs:
144147
steps:
145148
-
146149
name: Checkout
147-
uses: actions/checkout@v6
150+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
148151
-
149152
name: Configure AWS Credentials
150-
uses: aws-actions/configure-aws-credentials@v6
153+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
151154
with:
152155
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
153156
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -169,7 +172,7 @@ jobs:
169172
steps:
170173
-
171174
name: Checkout
172-
uses: actions/checkout@v6
175+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
173176
-
174177
name: Login to Public ECR
175178
continue-on-error: ${{ matrix.os == 'windows-latest' }}
@@ -192,10 +195,10 @@ jobs:
192195
steps:
193196
-
194197
name: Checkout
195-
uses: actions/checkout@v6
198+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
196199
-
197200
name: Configure AWS Credentials
198-
uses: aws-actions/configure-aws-credentials@v6
201+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
199202
with:
200203
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
201204
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -218,7 +221,7 @@ jobs:
218221
steps:
219222
-
220223
name: Checkout
221-
uses: actions/checkout@v6
224+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
222225
-
223226
name: Login to GitHub Container Registry
224227
uses: ./
@@ -238,7 +241,7 @@ jobs:
238241
steps:
239242
-
240243
name: Checkout
241-
uses: actions/checkout@v6
244+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
242245
-
243246
name: Login to GitLab
244247
uses: ./
@@ -258,7 +261,7 @@ jobs:
258261
steps:
259262
-
260263
name: Checkout
261-
uses: actions/checkout@v6
264+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
262265
-
263266
name: Login to Google Artifact Registry
264267
uses: ./
@@ -278,7 +281,7 @@ jobs:
278281
steps:
279282
-
280283
name: Checkout
281-
uses: actions/checkout@v6
284+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
282285
-
283286
name: Login to Google Container Registry
284287
uses: ./
@@ -292,7 +295,7 @@ jobs:
292295
steps:
293296
-
294297
name: Checkout
295-
uses: actions/checkout@v6
298+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
296299
-
297300
name: Login to registries
298301
uses: ./
@@ -315,7 +318,7 @@ jobs:
315318
steps:
316319
-
317320
name: Checkout
318-
uses: actions/checkout@v6
321+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
319322
-
320323
name: Login to registries
321324
uses: ./
@@ -336,7 +339,7 @@ jobs:
336339
steps:
337340
-
338341
name: Checkout
339-
uses: actions/checkout@v6
342+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
340343
-
341344
name: Login to registries
342345
id: login
@@ -368,7 +371,7 @@ jobs:
368371
steps:
369372
-
370373
name: Checkout
371-
uses: actions/checkout@v6
374+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
372375
-
373376
name: Login to Docker Hub
374377
uses: ./
@@ -398,7 +401,7 @@ jobs:
398401
steps:
399402
-
400403
name: Checkout
401-
uses: actions/checkout@v6
404+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
402405
-
403406
name: Login to Docker Hub
404407
uses: ./
@@ -428,7 +431,7 @@ jobs:
428431
steps:
429432
-
430433
name: Checkout
431-
uses: actions/checkout@v6
434+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
432435
-
433436
name: Login to GitHub Container Registry
434437
uses: ./
@@ -459,7 +462,7 @@ jobs:
459462
steps:
460463
-
461464
name: Checkout
462-
uses: actions/checkout@v6
465+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
463466
-
464467
name: Login to GitHub Container Registry
465468
uses: ./

‎.github/workflows/codeql.yml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,46 @@
11
name: codeql
22

3+
permissions:
4+
contents: read
5+
36
on:
47
push:
58
branches:
69
- 'master'
710
- 'releases/v*'
811
pull_request:
912

10-
permissions:
11-
actions: read
12-
contents: read
13-
security-events: write
14-
1513
env:
1614
NODE_VERSION: "24"
1715

1816
jobs:
1917
analyze:
2018
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
security-events: write
2122
steps:
2223
-
2324
name: Checkout
24-
uses: actions/checkout@v6
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2526
-
2627
name: Enable corepack
2728
run: |
2829
corepack enable
2930
yarn --version
3031
-
3132
name: Set up Node
32-
uses: actions/setup-node@v6
33+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
3334
with:
3435
node-version: ${{ env.NODE_VERSION }}
3536
-
3637
name: Initialize CodeQL
37-
uses: github/codeql-action/init@v4
38+
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
3839
with:
3940
languages: javascript-typescript
4041
build-mode: none
4142
-
4243
name: Perform CodeQL Analysis
43-
uses: github/codeql-action/analyze@v4
44+
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
4445
with:
4546
category: "/language:javascript-typescript"

‎.github/workflows/pr-assign-author.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ permissions:
44
contents: read
55

66
on:
7-
pull_request_target:
7+
pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
88
types:
99
- opened
1010
- reopened

‎.github/workflows/publish.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
name: publish
22

3+
permissions:
4+
contents: read
5+
6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.ref }}
8+
cancel-in-progress: true
9+
310
on:
411
release:
512
types:
@@ -15,7 +22,7 @@ jobs:
1522
steps:
1623
-
1724
name: Checkout
18-
uses: actions/checkout@v6
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1926
-
2027
name: Publish
21-
uses: actions/publish-immutable-action@v0.0.4
28+
uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

‎.github/workflows/test.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: test
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -17,16 +20,16 @@ jobs:
1720
steps:
1821
-
1922
name: Checkout
20-
uses: actions/checkout@v6
23+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2124
-
2225
name: Test
23-
uses: docker/bake-action@v7
26+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
2427
with:
2528
source: .
2629
targets: test
2730
-
2831
name: Upload coverage
29-
uses: codecov/codecov-action@v5
32+
uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
3033
with:
3134
files: ./coverage/clover.xml
3235
token: ${{ secrets.CODECOV_TOKEN }}

‎.github/workflows/update-dist.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
name: update-dist
22

3+
permissions:
4+
contents: read
5+
6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.ref }}
8+
cancel-in-progress: true
9+
310
on:
411
pull_request:
512
types:
@@ -8,27 +15,27 @@ on:
815

916
jobs:
1017
update-dist:
11-
if: github.actor == 'dependabot[bot]'
18+
if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
1219
runs-on: ubuntu-latest
1320
steps:
1421
-
1522
name: GitHub auth token from GitHub App
1623
id: docker-read-app
17-
uses: actions/create-github-app-token@v3
24+
uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
1825
with:
1926
app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
2027
private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
2128
owner: docker
2229
-
2330
name: Checkout
24-
uses: actions/checkout@v6
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2532
with:
2633
ref: ${{ github.event.pull_request.head.ref }}
2734
fetch-depth: 0
28-
token: ${{ steps.docker-read-app.outputs.token || github.token }}
35+
token: ${{ steps.docker-read-app.outputs.token }}
2936
-
3037
name: Build
31-
uses: docker/bake-action@v7
38+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
3239
with:
3340
source: .
3441
targets: build

0 commit comments

Comments
 (0)