Skip to content

Commit 8466166

Browse files
cclausscclauss
authored
fix(ci): add zizmor security linter for github actions (#3358)
1 parent 4a74fbe commit 8466166

12 files changed

Lines changed: 85 additions & 44 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,11 @@ updates:
66
directory: "/"
77
schedule:
88
interval: "daily"
9+
cooldown:
10+
default-days: 7
911
- package-ecosystem: "npm"
1012
directory: "/"
1113
schedule:
1214
interval: "daily"
15+
cooldown:
16+
default-days: 7

‎.github/workflows/lint-commit.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,11 @@ jobs:
1111
name: Commit Lint
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: actions/checkout@v7
14+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1515
with:
1616
fetch-depth: 0
17-
- uses: actions/setup-node@v7
17+
persist-credentials: false
18+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
1819
with:
1920
node-version: 22.x
2021
- run: npm install

‎.github/workflows/release-please.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
release_created: ${{ steps.release.outputs.release_created }}
1616
runs-on: ubuntu-latest
1717
steps:
18-
- uses: googleapis/release-please-action@v5
18+
- uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
1919
id: release
2020
with:
2121
token: ${{ secrets.GH_USER_TOKEN }}
@@ -36,8 +36,10 @@ jobs:
3636
contents: read
3737
id-token: write # to generate npm provenance statements
3838
steps:
39-
- uses: actions/checkout@v7
40-
- uses: actions/setup-node@v7
39+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
40+
with:
41+
persist-credentials: false
42+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
4143
with:
4244
node-version: lts/*
4345
registry-url: 'https://registry.npmjs.org'

‎.github/workflows/tests.yml‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@ jobs:
1818
name: Lint Python
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v7
22-
- uses: astral-sh/ruff-action@v4.1.0
21+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
22+
with:
23+
persist-credentials: false
24+
- uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
2325
with:
2426
args: "check --select=E,F,PLC,PLE,UP,W,YTT --ignore=E721,PLC0206,PLC0415,PLC1901,S101,UP031 --target-version=py39"
2527
# Do not ruff format gyp example code in markdown files.
@@ -30,9 +32,11 @@ jobs:
3032
runs-on: ubuntu-latest
3133
steps:
3234
- name: Checkout Repository
33-
uses: actions/checkout@v7
35+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
36+
with:
37+
persist-credentials: false
3438
- name: Use Node.js 22.x
35-
uses: actions/setup-node@v7
39+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
3640
with:
3741
node-version: 22.x
3842
- name: Install Dependencies
@@ -45,9 +49,11 @@ jobs:
4549
runs-on: ubuntu-latest
4650
steps:
4751
- name: Checkout Repository
48-
uses: actions/checkout@v7
52+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
53+
with:
54+
persist-credentials: false
4955
- name: Use Node.js 22.x
50-
uses: actions/setup-node@v7
56+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
5157
with:
5258
node-version: 22.x
5359
- name: Install Dependencies
@@ -64,9 +70,11 @@ jobs:
6470
timeout-minutes: 30
6571
steps:
6672
- name: Checkout Repository
67-
uses: actions/checkout@v7
73+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
74+
with:
75+
persist-credentials: false
6876
- name: Use Node.js 22.x
69-
uses: actions/setup-node@v7
77+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
7078
with:
7179
node-version: 22.x
7280
- name: Update npm
@@ -120,17 +128,19 @@ jobs:
120128
WASI_SDK_PATH: 'wasi-sdk-25.0'
121129
steps:
122130
- name: Checkout Repository
123-
uses: actions/checkout@v7
131+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
132+
with:
133+
persist-credentials: false
124134
- name: Use Node.js ${{ matrix.node }}
125-
uses: actions/setup-node@v7
135+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
126136
with:
127137
node-version: ${{ matrix.node }}
128138
- name: Use Python ${{ matrix.python }}
129-
uses: actions/setup-python@v7
139+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
130140
with:
131141
python-version: ${{ matrix.python }}
132142
allow-prereleases: true
133-
- uses: seanmiddleditch/gha-setup-ninja@v6
143+
- uses: seanmiddleditch/gha-setup-ninja@3b1f8f94a2f8254bd26914c4ab9474d4f0015f67 # v6
134144
- name: Install wasi-sdk (Windows)
135145
shell: pwsh
136146
if: runner.os == 'Windows'

‎.github/workflows/update-gyp-next.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,11 @@ jobs:
1717
runs-on: ubuntu-latest
1818

1919
steps:
20-
- uses: actions/checkout@v7
20+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2121
with:
2222
persist-credentials: false
2323

24-
- uses: actions/github-script@v9
24+
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
2525
id: get-gyp-next-version
2626
with:
2727
script: |
@@ -33,11 +33,13 @@ jobs:
3333
result-encoding: string
3434

3535
- name: Update gyp-next
36+
env:
37+
GYP_NEXT_VERSION: ${{ steps.get-gyp-next-version.outputs.result }}
3638
run: |
37-
python update-gyp.py --no-commit ${{ steps.get-gyp-next-version.outputs.result }}
39+
python update-gyp.py --no-commit ${GYP_NEXT_VERSION}
3840
3941
- name: Open or update PR for the gyp-next update
40-
uses: gr2m/create-or-update-pull-request-action@v1
42+
uses: gr2m/create-or-update-pull-request-action@483e2e5c8e68c420e72687127cfdc30a45254be7 # v1
4143
with:
4244
branch: actions/update-gyp-next
4345
author: Node.js GitHub Bot <github-bot@iojs.org>

‎.github/workflows/visual-studio.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,11 @@ jobs:
2727
timeout-minutes: 30
2828
steps:
2929
- name: Checkout Repository
30-
uses: actions/checkout@v7
30+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
31+
with:
32+
persist-credentials: false
3133
- name: Use Python 3
32-
uses: actions/setup-python@v7
34+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
3335
with:
3436
python-version: "3.x"
3537
- name: Install Dependencies

‎gyp/.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ updates:
1010
- "*" # Group all Actions updates into a single larger pull request
1111
schedule:
1212
interval: weekly
13+
cooldown:
14+
default-days: 7
1315
- package-ecosystem: "pip"
1416
directory: "/"
1517
groups:
@@ -18,3 +20,5 @@ updates:
1820
- "*" # Group all pip updates into a single larger pull request
1921
schedule:
2022
interval: weekly
23+
cooldown:
24+
default-days: 7

‎gyp/.github/workflows/node-gyp.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,20 @@ jobs:
2121
runs-on: ${{ matrix.os }}
2222
steps:
2323
- name: Clone gyp-next
24-
uses: actions/checkout@v6
24+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
2525
with:
2626
path: gyp-next
27+
persist-credentials: false
2728
- name: Clone nodejs/node-gyp
28-
uses: actions/checkout@v6
29+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
2930
with:
3031
repository: nodejs/node-gyp
3132
path: node-gyp
32-
- uses: actions/setup-node@v6
33+
persist-credentials: false
34+
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
3335
with:
3436
node-version: "lts/*"
35-
- uses: actions/setup-python@v6
37+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
3638
with:
3739
python-version: ${{ matrix.python-version }}
3840
allow-prereleases: true

‎gyp/.github/workflows/nodejs.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,17 @@ jobs:
2222
runs-on: ${{ matrix.os }}
2323
steps:
2424
- name: Clone gyp-next
25-
uses: actions/checkout@v6
25+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
2626
with:
2727
path: gyp-next
28+
persist-credentials: false
2829
- name: Clone nodejs/node
29-
uses: actions/checkout@v6
30+
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
3031
with:
3132
repository: nodejs/node
3233
path: node
33-
- uses: actions/setup-python@v6
34+
persist-credentials: false
35+
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
3436
with:
3537
python-version: ${{ matrix.python-version }}
3638
allow-prereleases: true

‎gyp/.github/workflows/python_tests.yml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,13 @@ jobs:
1010
Python_lint:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v6
13+
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
14+
with:
15+
persist-credentials: false
1416
- name: Lint with ruff # See pyproject.toml for settings
15-
uses: astral-sh/ruff-action@v3
17+
uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3.6.1
1618
- run: ruff format --check --diff
17-
- uses: wagoid/commitlint-github-action@v6
19+
- uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
1820

1921
Python_tests:
2022
runs-on: ${{ matrix.os }}
@@ -31,13 +33,15 @@ jobs:
3133
- os: windows-11-arm # Windows on ARM
3234
python-version: 3.x
3335
steps:
34-
- uses: actions/checkout@v6
36+
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
37+
with:
38+
persist-credentials: false
3539
- name: Set up Python ${{ matrix.python-version }}
36-
uses: actions/setup-python@v6
40+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
3741
with:
3842
python-version: ${{ matrix.python-version }}
3943
allow-prereleases: true
40-
- uses: seanmiddleditch/gha-setup-ninja@v6
44+
- uses: seanmiddleditch/gha-setup-ninja@3b1f8f94a2f8254bd26914c4ab9474d4f0015f67 # v6
4145
- name: Install dependencies
4246
run: |
4347
python -m pip install --upgrade pip

0 commit comments

Comments
 (0)