From eef772da5ff58b17df0a1a9452b9b3bf6c91f161 Mon Sep 17 00:00:00 2001 From: marshmallow Date: Fri, 19 Dec 2025 15:28:20 +1100 Subject: [PATCH] run repo against zizmor (#373) --- .github/actions/setup-nix/action.yml | 8 +++++--- .github/workflows/autofix.yml | 10 +++++++--- .github/workflows/follow-nixpkgs.yml | 14 ++++++++++---- .github/workflows/labeler.yml | 2 +- .github/workflows/pages.yml | 10 +++++++--- .github/workflows/pr-preview.yml | 23 +++++++++++++++++------ .github/workflows/test.yml | 7 +++++-- nix/hooks.nix | 1 + 8 files changed, 53 insertions(+), 22 deletions(-) diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml index 7474d53..7bbdd5a 100644 --- a/.github/actions/setup-nix/action.yml +++ b/.github/actions/setup-nix/action.yml @@ -10,7 +10,7 @@ inputs: runs: using: "composite" steps: - - uses: wimpysworld/nothing-but-nix@main + - uses: wimpysworld/nothing-but-nix@10c936d9e46521bf923f75458e0cbd4fa309300d with: hatchet-protocol: "carve" - name: Generate nix.conf @@ -21,7 +21,7 @@ runs: echo 'config<> "$GITHUB_OUTPUT" - - uses: cachix/install-nix-action@v31 + env: + INPUTS_WITHQEMU: ${{ inputs.withQEMU }} + - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 with: nix_path: nixpkgs=channel:nixos-unstable extra_nix_config: ${{ steps.config.outputs.config }} diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml index 38788e7..e69c473 100644 --- a/.github/workflows/autofix.yml +++ b/.github/workflows/autofix.yml @@ -14,8 +14,10 @@ jobs: outputs: docs-pnpm: ${{ steps.filter.outputs.docs-pnpm }} steps: - - uses: actions/checkout@v6 - - uses: dorny/paths-filter@v3 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + with: + persist-credentials: false + - uses: dorny/paths-filter@668c092af3649c4b664c54e4b704aa46782f6f7c id: filter with: filters: | @@ -25,7 +27,9 @@ jobs: runs-on: ubuntu-latest needs: check-changes steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + with: + persist-credentials: false - uses: ./.github/actions/setup-nix - name: Cache Cargo uses: actions/cache@v5 diff --git a/.github/workflows/follow-nixpkgs.yml b/.github/workflows/follow-nixpkgs.yml index 73ea4c5..3eaee55 100644 --- a/.github/workflows/follow-nixpkgs.yml +++ b/.github/workflows/follow-nixpkgs.yml @@ -8,10 +8,13 @@ jobs: pre-job: continue-on-error: true runs-on: ubuntu-latest + permissions: {} outputs: number: ${{ steps.skip_check.outputs.number }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + with: + persist-credentials: false - id: skip_check run: | echo "number=$(gh pr list --label flake-lock-update --state open --json id | jq 'length')" >> "$GITHUB_OUTPUT" @@ -19,13 +22,15 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} update: runs-on: ubuntu-latest + permissions: {} needs: pre-job if: needs.pre-job.outputs.number == '0' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 with: ssh-key: ${{ secrets.FOLLOW_NIXPKGS_PRIVATE_KEY }} ref: main + persist-credentials: false - uses: ./.github/actions/setup-nix - run: | git config user.name 'github-actions[bot]' @@ -36,13 +41,14 @@ jobs: run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT" - name: Create Pull Request id: cpr - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@0979079bc20c05bbbb590a56c21c4e2b1d1f1bbe with: title: Update flake.lock ${{ steps.date.outputs.date }} labels: flake-lock-update branch: ci/flake-update - name: Enable automerge if: steps.cpr.outputs.pull-request-number - run: gh pr merge --squash --auto "${{ steps.cpr.outputs.pull-request-number }}" + run: gh pr merge --squash --auto "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index cb28413..27a2dad 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -1,6 +1,6 @@ name: "Pull Request Labeler" on: - - pull_request_target + - pull_request jobs: labeler: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 71c147f..2e305a5 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -10,19 +10,23 @@ jobs: pre-job: continue-on-error: true runs-on: ubuntu-latest + permissions: {} outputs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: - id: skip_check - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3 deploy: runs-on: ubuntu-latest + permissions: {} environment: name: production url: https://wire.althaea.zone/ if: github.actor != 'dependabot[bot]' && needs.pre-job.outputs.should_skip != 'true' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + with: + persist-credentials: false - uses: ./.github/actions/setup-nix - run: nix build .#docs if: github.ref == 'refs/heads/stable' @@ -30,7 +34,7 @@ jobs: if: github.ref != 'refs/heads/stable' - name: Deploy to Cloudflare Pages id: deployment - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@707f63750981584eb6abc365a50d441516fb04b8 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml index 79211ec..fbcd443 100644 --- a/.github/workflows/pr-preview.yml +++ b/.github/workflows/pr-preview.yml @@ -7,14 +7,16 @@ jobs: runs-on: ubuntu-latest outputs: number: ${{ steps.find-pr.outputs.number }} + permissions: {} if: ${{ github.actor != 'dependabot[bot]' }} steps: - - uses: jwalton/gh-find-current-pr@master + - uses: jwalton/gh-find-current-pr@89ee5799558265a1e0e31fab792ebb4ee91c016b id: find-pr with: state: all base-ref: runs-on: ubuntu-latest + permissions: {} needs: get-pr outputs: base-ref: ${{ steps.base-ref.outputs.base-ref }} @@ -24,34 +26,41 @@ jobs: - name: Locate Base Ref id: base-ref run: | - echo "base-ref=$(gh api /repos/${{ github.repository }}/pulls/${{ needs.get-pr.outputs.number }} | jq -r '.base.ref')" >> "$GITHUB_OUTPUT" + echo "base-ref=$(gh api /repos/${{ github.repository }}/pulls/${NEEDS_GET_PR_OUTPUTS_NUMBER} | jq -r '.base.ref')" >> "$GITHUB_OUTPUT" env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NEEDS_GET_PR_OUTPUTS_NUMBER: ${{ needs.get-pr.outputs.number }} eval-base: runs-on: ubuntu-latest + permissions: {} needs: base-ref outputs: drv: ${{ steps.drv.outputs.drv }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 with: ref: ${{ needs.base-ref.outputs.base-ref }} + persist-credentials: false - uses: ./.github/actions/setup-nix - id: drv run: echo "drv=$(nix eval .#docs --json)" >> "$GITHUB_OUTPUT" eval-head: runs-on: ubuntu-latest + permissions: {} needs: get-pr outputs: drv: ${{ steps.drv.outputs.drv }} if: ${{ needs.get-pr.outputs.number != '' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + with: + persist-credentials: false - uses: ./.github/actions/setup-nix - id: drv run: echo "drv=$(nix eval .#docs --json)" >> "$GITHUB_OUTPUT" deploy: runs-on: ubuntu-latest + permissions: {} needs: - eval-head - eval-base @@ -62,12 +71,14 @@ jobs: # skip if nothing changed in the docs package if: needs.eval-head.outputs.drv != needs.eval-base.outputs.drv steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + with: + persist-credentials: false - uses: ./.github/actions/setup-nix - run: nix build .#docs - name: Deploy to Cloudflare Pages id: deployment - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@707f63750981584eb6abc365a50d441516fb04b8 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index dc63dcb..951f21d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -7,11 +7,12 @@ jobs: pre-job: continue-on-error: true runs-on: ubuntu-latest + permissions: {} outputs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: - id: skip_check - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3 with: concurrent_skipping: "same_content_newer" cancel_others: "true" @@ -22,7 +23,9 @@ jobs: contents: read if: needs.pre-job.outputs.should_skip != 'true' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + with: + persist-credentials: false - uses: ./.github/actions/setup-nix - name: Build Tests run: nix build .#cargo-tests -L -vv diff --git a/nix/hooks.nix b/nix/hooks.nix index d6bd192..3ee3fdb 100644 --- a/nix/hooks.nix +++ b/nix/hooks.nix @@ -15,6 +15,7 @@ enable = true; settings.edit = true; }; + zizmor.enable = true; clippy = { enable = true; settings.extraArgs = "--tests"; -- 2.51.2