Skip to content

Commit e5ac0fc

Browse files
ianksgithub-advanced-security[bot]
ianks
and
github-advanced-security[bot]
authored
Fix some security warnings (#539)
* Potential fix for code scanning alert no. 4338: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 4334: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Pin gh actions * Add more permissions * Fix cache delete action * Remove flagged files * Remove more flagged files --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent fe2f70c commit e5ac0fc

18 files changed

+145
-51
lines changed

‎.github/workflows/cache-clean.yml‎

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Delete caches
21-
uses: actions/github-script@v7
21+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
2222
with:
2323
script: |
2424
let totalDeleted = 0;
@@ -71,13 +71,27 @@ jobs:
7171
totalDeleted++;
7272
totalBytes += cache.size_in_bytes;
7373
74-
await github.rest.actions.deleteActionsCacheById({
75-
owner: context.repo.owner,
76-
repo: context.repo.repo,
77-
cache_id: cache.id
78-
});
79-
80-
console.log(`Deleted cache ${cache.id} (${sizeInMb(cache.size_in_bytes)} MB) for ref ${cache.ref}`);
74+
try {
75+
await github.rest.actions.deleteActionsCacheByKey({
76+
owner: context.repo.owner,
77+
repo: context.repo.repo,
78+
key: cache.key,
79+
ref: cache.ref
80+
});
81+
console.log(`Deleted cache ${cache.key} (${sizeInMb(cache.size_in_bytes)} MB) for ref ${cache.ref}`);
82+
} catch (error) {
83+
console.warn(`Error deleting cache by key: ${error.message}. Attempting alternative method...`);
84+
try {
85+
await github.rest.actions.deleteActionsCacheByKey({
86+
owner: context.repo.owner,
87+
repo: context.repo.repo,
88+
key: cache.key
89+
});
90+
console.log(`Deleted cache ${cache.key} (${sizeInMb(cache.size_in_bytes)} MB) without ref parameter`);
91+
} catch (secondError) {
92+
console.error(`Failed to delete cache ${cache.key}: ${secondError.message}`);
93+
}
94+
}
8195
}
8296
}
8397

‎.github/workflows/ci.yml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
22
name: "CI"
3+
permissions:
4+
contents: read
35

46
on:
57
push:
@@ -72,15 +74,15 @@ jobs:
7274
rust_toolchain: stable
7375
runs-on: ${{ matrix.sys.os }}
7476
steps:
75-
- uses: actions/checkout@v4
77+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
7678

77-
- uses: oxidize-rb/actions/upload-core-dumps@v1
79+
- uses: oxidize-rb/actions/upload-core-dumps@d4731ac609739be0920f0faf5569b58b8eb1a262 # v1
7880

7981
- name: Setup debug info
8082
shell: bash
8183
run: script/ci/set-debug-env.sh
8284

83-
- uses: oxidize-rb/actions/setup-ruby-and-rust@v1
85+
- uses: oxidize-rb/actions/setup-ruby-and-rust@d4731ac609739be0920f0faf5569b58b8eb1a262 # v1
8486
if: matrix.ruby_version != 'skip'
8587
with:
8688
cache-version: v2
@@ -150,7 +152,7 @@ jobs:
150152
if: env.ACTIONS_STEP_DEBUG == 'true'
151153
run: bundle exec rake bindings:generate
152154

153-
- uses: actions/upload-artifact@v4
155+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
154156
if: always()
155157
with:
156158
name: rb-sys-ci-debug-artifacts-${{ matrix.sys.os }}-${{ matrix.ruby_version }}
@@ -171,11 +173,11 @@ jobs:
171173
rust_toolchain: stable
172174
runs-on: ${{ matrix.sys.os }}
173175
steps:
174-
- uses: actions/checkout@v4
176+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
175177

176-
- uses: oxidize-rb/actions/upload-core-dumps@v1
178+
- uses: oxidize-rb/actions/upload-core-dumps@d4731ac609739be0920f0faf5569b58b8eb1a262 # v1
177179

178-
- uses: oxidize-rb/actions/setup-ruby-and-rust@v1
180+
- uses: oxidize-rb/actions/setup-ruby-and-rust@d4731ac609739be0920f0faf5569b58b8eb1a262 # v1
179181
with:
180182
ruby-version: none
181183
rustup-toolchain: ${{ matrix.sys.rust_toolchain }}
@@ -187,7 +189,7 @@ jobs:
187189
echo "GEM_HOME=~/.gem/ruby/${{ matrix.ruby_version }}" >> $GITHUB_ENV
188190
189191
- name: ⚡ Cache
190-
uses: actions/cache@v4
192+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
191193
with:
192194
path: |
193195
/opt/rubies/${{ matrix.ruby_version }}

‎.github/workflows/docker.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
matrix:
3939
toolchain: ${{ fromJSON(needs.fetch_ci_data.outputs.toolchains-data) }}
4040
steps:
41-
- uses: actions/checkout@v4
41+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
4242

4343
- name: Set rb-sys version variable
4444
id: vars
@@ -55,28 +55,28 @@ jobs:
5555
echo "aliases=$aliases" >> $GITHUB_ENV
5656
5757
# Test the container
58-
- uses: actions/checkout@v4
58+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
5959
with:
6060
repository: "oxidize-rb/oxi-test"
6161
path: "tmp/oxi-test"
6262

63-
- uses: ruby/setup-ruby@v1
63+
- uses: ruby/setup-ruby@e34163cd15f4bb403dcd72d98e295997e6a55798 # v1
6464
with:
6565
ruby-version: "3.1"
6666

6767
- name: Login to Docker Hub
6868
if: github.event_name != 'pull_request'
69-
uses: docker/login-action@v3
69+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
7070
with:
7171
username: ${{ secrets.DOCKER_HUB_USERNAME }}
7272
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
7373

7474
- name: Set up QEMU
75-
uses: docker/setup-qemu-action@v3
75+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
7676

7777
- name: Set up Docker Buildx
7878
id: buildx
79-
uses: docker/setup-buildx-action@v3
79+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
8080

8181
- name: Prepare Docker images list
8282
id: prepare_images
@@ -91,7 +91,7 @@ jobs:
9191
9292
- name: Docker meta
9393
id: meta
94-
uses: docker/metadata-action@v5
94+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
9595
with:
9696
images: |
9797
${{ env.images }}
@@ -108,7 +108,7 @@ jobs:
108108
org.oxidize-rb.ruby.platform=${{ env.ruby_platform }}
109109

110110
- name: Docker build
111-
uses: docker/build-push-action@v6
111+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
112112
with:
113113
builder: ${{ steps.buildx.outputs.name }}
114114
context: ./docker
@@ -182,7 +182,7 @@ jobs:
182182
--highestUserWastedPercent "$highest_user_wasted_percent"
183183
184184
- name: Run Trivy vulnerability scanner
185-
uses: aquasecurity/trivy-action@master
185+
uses: aquasecurity/trivy-action@99baf0d8b4e787c3cfd7b602664c8ce60a43cd38 # master
186186
with:
187187
image-ref: "${{ secrets.DOCKER_HUB_USERNAME }}/${{ env.ruby_platform }}:sha-${{ github.sha }}"
188188
format: "sarif"
@@ -193,13 +193,13 @@ jobs:
193193
exit-code: "0" # Changed from "1" to "0" to prevent failing on EOL OS warnings
194194

195195
- name: Upload Trivy scan results to GitHub Security tab
196-
uses: github/codeql-action/upload-sarif@v3
196+
uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3
197197
with:
198198
sarif_file: "trivy-results-${{ env.ruby_platform }}.sarif"
199199
category: "docker-${{ env.ruby_platform }}"
200200

201201
- name: Docker push
202-
uses: docker/build-push-action@v6
202+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
203203
with:
204204
builder: ${{ steps.buildx.outputs.name }}
205205
context: ./docker
@@ -212,15 +212,15 @@ jobs:
212212
cache-to: ${{ secrets.DOCKER_HUB_USERNAME }}/${{ env.ruby_platform }}:cache-${{ steps.vars.outputs.rb-sys-version }}
213213

214214
- name: Docker Hub Description
215-
uses: peter-evans/dockerhub-description@v4
215+
uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4
216216
with:
217217
username: ${{ secrets.DOCKER_HUB_USERNAME }}
218218
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
219219
repository: rbsys/${{ env.ruby_platform }}
220220
readme-filepath: ./readme.md
221221

222222
- name: Slack Noti on Failure
223-
uses: 8398a7/action-slack@v3
223+
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3
224224
with:
225225
status: ${{ job.status }}
226226
fields: repo,message,commit,author,action,eventName,ref,workflow,job,took,pullRequest

‎.github/workflows/docs.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
---
22
name: "Docs"
33

4+
permissions:
5+
contents: read
6+
47
on:
58
push:
69
branches:
@@ -16,9 +19,9 @@ jobs:
1619
name: 📑 Validate Docs
1720
runs-on: ubuntu-latest
1821
steps:
19-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2023

21-
- uses: ruby/setup-ruby@v1
24+
- uses: ruby/setup-ruby@e34163cd15f4bb403dcd72d98e295997e6a55798 # v1
2225
with:
2326
bundler-cache: true
2427
ruby-version: "3.2"

‎.github/workflows/integration.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
22
name: Integration
3+
permissions:
4+
contents: read
35
on:
46
push:
57
branches:
@@ -41,15 +43,15 @@ jobs:
4143
INPUTS: ${{ toJSON(matrix) }}
4244
run: |
4345
echo "$INPUTS" | jq
44-
- uses: actions/checkout@v4
46+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
4547
with:
4648
repository: ${{ matrix.repo.name }}
4749
ref: ${{ matrix.repo.ref }}
4850
path: repo
49-
- uses: actions/checkout@v4
51+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
5052
with:
5153
path: rb-sys
52-
- uses: oxidize-rb/actions/setup-ruby-and-rust@v1
54+
- uses: oxidize-rb/actions/setup-ruby-and-rust@d4731ac609739be0920f0faf5569b58b8eb1a262 # v1
5355
id: setup
5456
with:
5557
cache-version: v2
@@ -76,14 +78,14 @@ jobs:
7678
name: Bundle install in Dockerfile
7779
runs-on: ubuntu-latest
7880
steps:
79-
- uses: actions/checkout@v4
81+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
8082
with:
8183
repository: ${{ matrix.repo.name }}
8284
ref: ${{ matrix.repo.ref }}
8385
path: repo
8486

8587
- name: Set up Docker Buildx
86-
uses: docker/setup-buildx-action@v3
88+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
8789

8890
- name: Generate Dockerfile
8991
run: |
@@ -106,7 +108,7 @@ jobs:
106108
cat Gemfile.issue
107109
108110
- name: Build and push Docker image
109-
uses: docker/build-push-action@v6
111+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
110112
with:
111113
context: .
112114
file: ./Dockerfile.issue

‎.github/workflows/publish-book.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ jobs:
1616
concurrency:
1717
group: ${{ github.workflow }}-${{ github.ref }}
1818
steps:
19-
- uses: actions/checkout@v4
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2020

21-
- uses: oxidize-rb/actions/setup-ruby-and-rust@v1
21+
- uses: oxidize-rb/actions/setup-ruby-and-rust@d4731ac609739be0920f0faf5569b58b8eb1a262 # v1
2222
with:
2323
ruby-version: "3.4"
2424
bundler-cache: true
@@ -31,7 +31,7 @@ jobs:
3131
run: bundle exec rake book:build
3232

3333
- name: Deploy
34-
uses: peaceiris/actions-gh-pages@v4
34+
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
3535
if: ${{ github.ref == 'refs/heads/main' }}
3636
with:
3737
github_token: ${{ secrets.GITHUB_TOKEN }}

‎docker/Dockerfile.aarch64-linux‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,12 @@ ENV RUBY_TARGET="aarch64-linux" \
1717
CMAKE_aarch64_unknown_linux_gnu="/opt/cmake/bin/cmake" \
1818
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER="aarch64-linux-gnu-gcc"
1919

20-
COPY setup/lib.sh setup/rustup.sh setup/rubygems.sh setup/cmake.sh setup/rubybashrc.sh setup/rb-sys-dock.sh /
20+
COPY setup/lib.sh setup/rustup.sh setup/rubygems.sh setup/cmake.sh setup/rubybashrc.sh setup/rb-sys-dock.sh setup/delete-unused-files.sh /
2121

2222
RUN bash -c "source /lib.sh && install_packages libclang-12-dev llvm-12-dev clang-12 libc6-arm64-cross libc6-dev-arm64-cross" && \
2323
/rustup.sh && \
2424
/rubygems.sh && \
2525
/cmake.sh && \
2626
/rubybashrc.sh && \
27+
/delete-unused-files.sh && \
2728
/rb-sys-dock.sh

‎docker/Dockerfile.aarch64-linux-musl‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,12 @@ ENV RUBY_TARGET="aarch64-linux-musl" \
1818
BINDGEN_EXTRA_CLANG_ARGS_aarch64_unknown_linux_musl="--sysroot=/usr/aarch64-linux-musl" \
1919
CMAKE_aarch64_unknown_linux_musl="cmake"
2020

21-
COPY setup/lib.sh setup/rustup.sh setup/rubygems.sh setup/cmake.sh setup/rubybashrc.sh setup/rb-sys-dock.sh /
21+
COPY setup/lib.sh setup/rustup.sh setup/rubygems.sh setup/cmake.sh setup/rubybashrc.sh setup/rb-sys-dock.sh setup/delete-unused-files.sh /
2222

2323
RUN bash -c "source /lib.sh && install_packages libclang-12-dev llvm-12-dev" && \
2424
/rustup.sh && \
2525
/rubygems.sh && \
2626
/cmake.sh && \
2727
/rubybashrc.sh && \
28+
/delete-unused-files.sh && \
2829
/rb-sys-dock.sh

‎docker/Dockerfile.arm-linux‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,12 @@ ENV RUBY_TARGET="arm-linux" \
1616
PKG_CONFIG_PATH="/usr/lib/arm-linux-gnueabihf/pkgconfig" \
1717
CMAKE_arm_unknown_linux_gnueabihf="/opt/cmake/bin/cmake"
1818

19-
COPY setup/lib.sh setup/rustup.sh setup/rubygems.sh setup/cmake.sh setup/rubybashrc.sh setup/rb-sys-dock.sh /
19+
COPY setup/lib.sh setup/rustup.sh setup/rubygems.sh setup/cmake.sh setup/rubybashrc.sh setup/rb-sys-dock.sh setup/delete-unused-files.sh /
2020

2121
RUN bash -c "source /lib.sh && install_packages libclang-dev clang llvm-dev libc6-armhf-cross libc6-dev-armhf-cross" && \
2222
/rustup.sh && \
2323
/rubygems.sh && \
2424
/cmake.sh && \
2525
/rubybashrc.sh && \
26+
/delete-unused-files.sh && \
2627
/rb-sys-dock.sh

‎docker/Dockerfile.arm64-darwin‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,13 @@ ENV RUBY_TARGET="arm64-darwin" \
1717
PKG_CONFIG="aarch64-apple-darwin-pkg-config" \
1818
CMAKE_aarch64_apple_darwin="/opt/cmake/bin/cmake"
1919

20-
COPY setup/lib.sh setup/osxcross-shebang.sh setup/rustup.sh setup/rubygems.sh setup/cmake.sh setup/rubybashrc.sh setup/rb-sys-dock.sh /
20+
COPY setup/lib.sh setup/osxcross-shebang.sh setup/rustup.sh setup/rubygems.sh setup/cmake.sh setup/rubybashrc.sh setup/rb-sys-dock.sh setup/delete-unused-files.sh /
2121

2222
RUN bash -c "source /lib.sh && install_packages libclang-dev clang libc6-arm64-cross libc6-dev-arm64-cross" && \
2323
/rustup.sh && \
2424
/rubygems.sh && \
2525
/cmake.sh && \
2626
/rubybashrc.sh && \
27+
/delete-unused-files.sh && \
2728
/rb-sys-dock.sh && \
2829
/osxcross-shebang.sh

0 commit comments

Comments
 (0)