Skip to content

Commit 8072de9

Browse files
crazy-maxcrazy-max
committed
fix zizmor findings
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
1 parent 45439ec commit 8072de9

File tree

8 files changed

+91
-58
lines changed

8 files changed

+91
-58
lines changed

‎.github/dependabot.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,21 @@ updates:
44
directory: "/"
55
schedule:
66
interval: "daily"
7+
cooldown:
8+
default-days: 2
9+
groups:
10+
crazy-max-dot-github:
11+
patterns:
12+
- "crazy-max/.github/*"
713
labels:
814
- "dependencies"
915
- "bot"
1016
- package-ecosystem: "npm"
1117
directory: "/"
1218
schedule:
1319
interval: "daily"
20+
cooldown:
21+
default-days: 2
1422
versioning-strategy: "increase"
1523
allow:
1624
- dependency-type: "production"

‎.github/workflows/ci.yml‎

Lines changed: 37 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: ci
22

3+
permissions:
4+
contents: read
5+
36
concurrency:
47
group: ${{ github.workflow }}-${{ github.ref }}
58
cancel-in-progress: true
@@ -32,7 +35,7 @@ jobs:
3235
steps:
3336
-
3437
name: Checkout
35-
uses: actions/checkout@v6
38+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3639
-
3740
name: Set up Docker Buildx
3841
id: buildx
@@ -51,7 +54,7 @@ jobs:
5154
steps:
5255
-
5356
name: Checkout
54-
uses: actions/checkout@v6
57+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5558
-
5659
name: Set up Docker Buildx 1
5760
uses: ./
@@ -64,7 +67,7 @@ jobs:
6467
steps:
6568
-
6669
name: Checkout
67-
uses: actions/checkout@v6
70+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6871
-
6972
name: Stop docker
7073
run: |
@@ -85,14 +88,14 @@ jobs:
8588
-
8689
name: Dump context
8790
if: always()
88-
uses: crazy-max/ghaction-dump-context@v2
91+
uses: crazy-max/ghaction-dump-context@5355a8e5e6ac5a302e746a1c4b7747a0393863c8 # v2.3.0
8992

9093
debug:
9194
runs-on: ubuntu-latest
9295
steps:
9396
-
9497
name: Checkout
95-
uses: actions/checkout@v6
98+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9699
-
97100
name: Create Dockerfile
98101
run: |
@@ -102,15 +105,15 @@ jobs:
102105
EOL
103106
-
104107
name: Set up QEMU
105-
uses: docker/setup-qemu-action@v4
108+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
106109
-
107110
name: Set up Docker Buildx
108111
uses: ./
109112
with:
110113
buildkitd-flags: --debug
111114
-
112115
name: Build
113-
uses: docker/build-push-action@v7
116+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
114117
with:
115118
context: .
116119
platforms: linux/amd64,linux/arm64,linux/ppc64le
@@ -126,7 +129,7 @@ jobs:
126129
steps:
127130
-
128131
name: Checkout
129-
uses: actions/checkout@v6
132+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
130133
-
131134
name: Set up Docker Buildx
132135
uses: ./
@@ -149,7 +152,7 @@ jobs:
149152
steps:
150153
-
151154
name: Checkout
152-
uses: actions/checkout@v6
155+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
153156
-
154157
name: Set up Docker Buildx
155158
uses: ./
@@ -162,7 +165,7 @@ jobs:
162165
steps:
163166
-
164167
name: Checkout
165-
uses: actions/checkout@v6
168+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
166169
-
167170
name: Set up Docker Buildx
168171
uses: ./
@@ -181,7 +184,7 @@ jobs:
181184
runs-on: ubuntu-latest
182185
services:
183186
dind:
184-
image: docker:dind
187+
image: docker:29.3-dind@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
185188
options: >-
186189
--privileged
187190
--health-cmd "docker info"
@@ -195,7 +198,7 @@ jobs:
195198
steps:
196199
-
197200
name: Checkout
198-
uses: actions/checkout@v6
201+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
199202
-
200203
name: Create context
201204
run: |
@@ -217,7 +220,7 @@ jobs:
217220
steps:
218221
-
219222
name: Checkout
220-
uses: actions/checkout@v6
223+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
221224
-
222225
name: Create buildkitd conf
223226
run: |
@@ -240,7 +243,7 @@ jobs:
240243
buildkitd-config: /tmp/buildkitd.toml
241244
-
242245
name: Build
243-
uses: docker/build-push-action@v7
246+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
244247
with:
245248
context: .
246249

@@ -249,7 +252,7 @@ jobs:
249252
steps:
250253
-
251254
name: Checkout
252-
uses: actions/checkout@v6
255+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
253256
-
254257
name: Create Dockerfile
255258
run: |
@@ -267,7 +270,7 @@ jobs:
267270
mirrors = ["mirror.gcr.io"]
268271
-
269272
name: Build
270-
uses: docker/build-push-action@v7
273+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
271274
with:
272275
context: .
273276

@@ -285,10 +288,10 @@ jobs:
285288
steps:
286289
-
287290
name: Checkout
288-
uses: actions/checkout@v6
291+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
289292
-
290293
name: Set up QEMU
291-
uses: docker/setup-qemu-action@v4
294+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
292295
with:
293296
platforms: ${{ matrix.qemu-platforms }}
294297
-
@@ -314,7 +317,7 @@ jobs:
314317
steps:
315318
-
316319
name: Checkout
317-
uses: actions/checkout@v6
320+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
318321
-
319322
name: Set up Docker Buildx
320323
uses: ./
@@ -328,7 +331,7 @@ jobs:
328331
EOL
329332
-
330333
name: Build
331-
uses: docker/build-push-action@master
334+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
332335
with:
333336
context: .
334337

@@ -337,7 +340,7 @@ jobs:
337340
steps:
338341
-
339342
name: Checkout
340-
uses: actions/checkout@v6
343+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
341344
-
342345
name: Uninstall docker cli
343346
run: |
@@ -365,7 +368,7 @@ jobs:
365368
steps:
366369
-
367370
name: Checkout
368-
uses: actions/checkout@v6
371+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
369372
-
370373
name: Uninstall docker cli
371374
run: |
@@ -387,7 +390,7 @@ jobs:
387390
EOL
388391
-
389392
name: Build
390-
uses: docker/build-push-action@master
393+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
391394
with:
392395
context: .
393396

@@ -396,7 +399,7 @@ jobs:
396399
steps:
397400
-
398401
name: Checkout
399-
uses: actions/checkout@v6
402+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
400403
-
401404
name: Create dummy contexts
402405
run: |
@@ -425,10 +428,10 @@ jobs:
425428
steps:
426429
-
427430
name: Checkout
428-
uses: actions/checkout@v6
431+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
429432
-
430433
name: Set up QEMU
431-
uses: docker/setup-qemu-action@v4
434+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
432435
-
433436
name: Set up Docker Buildx
434437
uses: ./
@@ -440,7 +443,7 @@ jobs:
440443
steps:
441444
-
442445
name: Checkout
443-
uses: actions/checkout@v6
446+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
444447
-
445448
name: Create Docker context
446449
run: |
@@ -463,7 +466,7 @@ jobs:
463466
steps:
464467
-
465468
name: Checkout
466-
uses: actions/checkout@v6
469+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
467470
-
468471
name: Set up Docker Buildx
469472
uses: ./
@@ -482,7 +485,7 @@ jobs:
482485
steps:
483486
-
484487
name: Checkout
485-
uses: actions/checkout@v6
488+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
486489
-
487490
name: Install k3s
488491
uses: crazy-max/.github/.github/actions/install-k3s@20ef82212dc54bab5749f5e05576ca6d3c8a5773 # v1.1.0
@@ -515,7 +518,7 @@ jobs:
515518
EOL
516519
-
517520
name: Build
518-
uses: docker/build-push-action@master
521+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
519522
with:
520523
context: .
521524

@@ -530,7 +533,7 @@ jobs:
530533
steps:
531534
-
532535
name: Checkout
533-
uses: actions/checkout@v6
536+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
534537
-
535538
name: Set up Docker Buildx
536539
uses: ./
@@ -543,7 +546,7 @@ jobs:
543546
steps:
544547
-
545548
name: Checkout
546-
uses: actions/checkout@v6
549+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
547550
-
548551
name: Set up Docker Buildx
549552
id: buildx
@@ -564,7 +567,7 @@ jobs:
564567
steps:
565568
-
566569
name: Checkout
567-
uses: actions/checkout@v6
570+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
568571
-
569572
name: Set up Docker Buildx
570573
uses: ./
@@ -583,7 +586,7 @@ jobs:
583586
steps:
584587
-
585588
name: Checkout
586-
uses: actions/checkout@v6
589+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
587590
-
588591
name: Set up Docker Buildx
589592
id: buildx

‎.github/workflows/codeql.yml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,46 @@
11
name: codeql
22

3+
permissions:
4+
contents: read
5+
36
on:
47
push:
58
branches:
69
- 'master'
710
- 'releases/v*'
811
pull_request:
912

10-
permissions:
11-
actions: read
12-
contents: read
13-
security-events: write
14-
1513
env:
1614
NODE_VERSION: "24"
1715

1816
jobs:
1917
analyze:
2018
runs-on: ubuntu-latest
19+
permissions:
20+
contents: read
21+
security-events: write
2122
steps:
2223
-
2324
name: Checkout
24-
uses: actions/checkout@v6
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2526
-
2627
name: Enable corepack
2728
run: |
2829
corepack enable
2930
yarn --version
3031
-
3132
name: Set up Node
32-
uses: actions/setup-node@v6
33+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
3334
with:
3435
node-version: ${{ env.NODE_VERSION }}
3536
-
3637
name: Initialize CodeQL
37-
uses: github/codeql-action/init@v4
38+
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
3839
with:
3940
languages: javascript-typescript
4041
build-mode: none
4142
-
4243
name: Perform CodeQL Analysis
43-
uses: github/codeql-action/analyze@v4
44+
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
4445
with:
4546
category: "/language:javascript-typescript"

‎.github/workflows/pr-assign-author.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,14 @@ permissions:
44
contents: read
55

66
on:
7-
pull_request_target:
7+
pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
88
types:
99
- opened
1010
- reopened
1111

1212
jobs:
1313
run:
14-
uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@20ef82212dc54bab5749f5e05576ca6d3c8a5773 # v1.1.0
14+
uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@bb328ea508cd6a89d0865555ddbeb148e5724aed # v1.3.0
1515
permissions:
1616
contents: read
1717
pull-requests: write

0 commit comments

Comments
 (0)