Skip to content

Commit b183611

Browse files
woodruffwwoodruffw
authored
chore(ci): address CI lint findings (#545)
This addresses all of zizmor's non-pedantic findings, and adds a workflow to proactively flag any more that come in. Key changes: * I've hash-pinned all actions references. Dependabot will continue to keep these updated and will update the hash comments as well. * I've marked every `actions/checkout` with `persist-credentials: false` except for one that actually needs persisted credentials (which I've explicitly enabled with an explanatory comment) * I've dropped some workflow-level permissions in favor of job-level permissions that were already provisioned. * I fixed two small template injections caused by expanding output contexts. I think these were not exploitable in practice, but fixing them is good for defense in depth (and makes spellcheck work nicely on these steps). --------- Signed-off-by: William Woodruff <william@astral.sh>
1 parent 557e51d commit b183611

File tree

5 files changed

+139
-45
lines changed

5 files changed

+139
-45
lines changed

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ on:
2121
branches:
2222
- main
2323

24+
permissions: {}
25+
2426
jobs:
2527
analyze:
2628
name: Analyze
@@ -39,11 +41,13 @@ jobs:
3941

4042
steps:
4143
- name: Checkout repository
42-
uses: actions/checkout@v5
44+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
45+
with:
46+
persist-credentials: false
4347

4448
# Initializes the CodeQL tools for scanning.
4549
- name: Initialize CodeQL
46-
uses: github/codeql-action/init@v3
50+
uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
4751
with:
4852
languages: ${{ matrix.language }}
4953
source-root: src
@@ -55,7 +59,7 @@ jobs:
5559
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5660
# If this step fails, then you should remove it and run the build manually (see below)
5761
- name: Autobuild
58-
uses: github/codeql-action/autobuild@v3
62+
uses: github/codeql-action/autobuild@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
5963

6064
# ℹ️ Command-line programs to run using the OS shell.
6165
# 📚 https://git.io/JvXDl
@@ -69,4 +73,4 @@ jobs:
6973
# make release
7074

7175
- name: Perform CodeQL Analysis
72-
uses: github/codeql-action/analyze@v3
76+
uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11

‎.github/workflows/release-drafter.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
branches:
99
- main
1010

11+
permissions: {}
12+
1113
jobs:
1214
update_release_draft:
1315
name: ✏️ Draft release
@@ -17,6 +19,6 @@ jobs:
1719
pull-requests: read
1820
steps:
1921
- name: 🚀 Run Release Drafter
20-
uses: release-drafter/release-drafter@v6.1.0
22+
uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
2123
env:
2224
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)