Skip to content

Commit cc8797f

Browse files
segiddinssegiddins
authored
Set up github actions linting (#303)
Also, proactively pin all actions to a SHA
1 parent 5983545 commit cc8797f

4 files changed

Lines changed: 80 additions & 38 deletions

File tree

‎.github/workflows/check-dist.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,19 @@ on:
1616
- '**.md'
1717
workflow_dispatch:
1818

19+
permissions: {}
20+
1921
jobs:
2022
check-dist:
2123
runs-on: ubuntu-latest
2224

2325
steps:
24-
- uses: actions/checkout@v4
26+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
27+
with:
28+
persist-credentials: false
2529

2630
- name: Set up Node.js
27-
uses: actions/setup-node@v4.4.0
31+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2832
with:
2933
node-version-file: .nvmrc
3034

@@ -46,7 +50,7 @@ jobs:
4650
id: diff
4751

4852
# If index.js was different than expected, upload the expected version as an artifact
49-
- uses: actions/upload-artifact@v4
53+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
5054
if: ${{ failure() && steps.diff.conclusion == 'failure' }}
5155
with:
5256
name: dist

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 34 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,19 @@
99
# the `language` matrix defined below to confirm you have the correct set of
1010
# supported CodeQL languages.
1111
#
12-
name: "CodeQL"
12+
name: 'CodeQL'
1313

1414
on:
1515
push:
16-
branches: [ main ]
16+
branches: [main]
1717
pull_request:
1818
# The branches below must be a subset of the branches above
19-
branches: [ main ]
19+
branches: [main]
2020
schedule:
2121
- cron: '31 7 * * 3'
2222

23+
permissions: {}
24+
2325
jobs:
2426
analyze:
2527
name: Analyze
@@ -32,40 +34,42 @@ jobs:
3234
strategy:
3335
fail-fast: false
3436
matrix:
35-
language: [ 'TypeScript' ]
37+
language: ['TypeScript']
3638
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
3739
# Learn more about CodeQL language support at https://git.io/codeql-language-support
3840

3941
steps:
40-
- name: Checkout repository
41-
uses: actions/checkout@v4
42+
- name: Checkout repository
43+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
44+
with:
45+
persist-credentials: false
4246

43-
# Initializes the CodeQL tools for scanning.
44-
- name: Initialize CodeQL
45-
uses: github/codeql-action/init@v3
46-
with:
47-
languages: ${{ matrix.language }}
48-
source-root: src
49-
# If you wish to specify custom queries, you can do so here or in a config file.
50-
# By default, queries listed here will override any specified in a config file.
51-
# Prefix the list here with "+" to use these queries and those in the config file.
52-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
47+
# Initializes the CodeQL tools for scanning.
48+
- name: Initialize CodeQL
49+
uses: github/codeql-action/init@df559355d593797519d70b90fc8edd5db049e7a2 # v3.29.9
50+
with:
51+
languages: ${{ matrix.language }}
52+
source-root: src
53+
# If you wish to specify custom queries, you can do so here or in a config file.
54+
# By default, queries listed here will override any specified in a config file.
55+
# Prefix the list here with "+" to use these queries and those in the config file.
56+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
5357

54-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
55-
# If this step fails, then you should remove it and run the build manually (see below)
56-
- name: Autobuild
57-
uses: github/codeql-action/autobuild@v3
58+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
59+
# If this step fails, then you should remove it and run the build manually (see below)
60+
- name: Autobuild
61+
uses: github/codeql-action/autobuild@df559355d593797519d70b90fc8edd5db049e7a2 # v3.29.9
5862

59-
# ℹ️ Command-line programs to run using the OS shell.
60-
# 📚 https://git.io/JvXDl
63+
# ℹ️ Command-line programs to run using the OS shell.
64+
# 📚 https://git.io/JvXDl
6165

62-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
63-
# and modify them (or add more) to build your code if your project
64-
# uses a compiled language
66+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
67+
# and modify them (or add more) to build your code if your project
68+
# uses a compiled language
6569

66-
#- run: |
67-
# make bootstrap
68-
# make release
70+
#- run: |
71+
# make bootstrap
72+
# make release
6973

70-
- name: Perform CodeQL Analysis
71-
uses: github/codeql-action/analyze@v3
74+
- name: Perform CodeQL Analysis
75+
uses: github/codeql-action/analyze@df559355d593797519d70b90fc8edd5db049e7a2 # v3.29.9

‎.github/workflows/test.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,15 @@ on: # rebuild any PRs and main branch changes
66
- main
77
- 'releases/*'
88

9+
permissions: {}
10+
911
jobs:
1012
build: # make sure build/ci work properly
1113
runs-on: ubuntu-latest
1214
steps:
13-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
16+
with:
17+
persist-credentials: false
1418
- run: |
1519
npm install
1620
- run: |
@@ -32,14 +36,16 @@ jobs:
3236
gem-server: 'https://staging.rubygems.org'
3337

3438
steps:
35-
- uses: actions/checkout@v4
39+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
40+
with:
41+
persist-credentials: false
3642
- uses: ./
3743
with:
3844
role-to-assume: '${{ matrix.roleToken }}'
3945
gem-server: '${{ matrix.gem-server }}'
4046
- name: Test token
4147
run: |
42-
curl -v --fail '${{ matrix.gem-server }}/api/v1/oidc/api_key_roles/${{ matrix.roleToken }}' -H 'Authorization: ${{ env.RUBYGEMS_API_KEY }}'
48+
curl -v --fail '${{ matrix.gem-server }}/api/v1/oidc/api_key_roles/${{ matrix.roleToken }}' -H "Authorization: $RUBYGEMS_API_KEY"
4349
test-trusted-publisher: # make sure the action works on a clean machine without building
4450
runs-on: ubuntu-latest
4551
permissions:
@@ -53,14 +59,16 @@ jobs:
5359
- 'staging.rubygems.org'
5460

5561
steps:
56-
- uses: actions/checkout@v4
62+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
63+
with:
64+
persist-credentials: false
5765
- uses: ./
5866
with:
5967
gem-server: 'https://${{ matrix.gem-server }}'
6068
audience: '${{ matrix.gem-server }}'
6169
- name: Test token
6270
run: |
63-
output="$(curl -s -w "\n\n%{http_code}" -v -X POST 'https://${{ matrix.gem-server }}/api/v1/gems' -H 'Authorization: ${{ env.RUBYGEMS_API_KEY }}' -H 'Accept: application/json')"
71+
output="$(curl -s -w "\n\n%{http_code}" -v -X POST 'https://${{ matrix.gem-server }}/api/v1/gems' -H "Authorization: $RUBYGEMS_API_KEY" -H 'Accept: application/json')"
6472
expected="$(printf "RubyGems.org cannot process this gem.\nPlease try rebuilding it and installing it locally to make sure it's valid.\nError:\npackage metadata is missing\n\n\n422")"
6573
test "$output" = "$expected" || (echo "$output" && exit 1)
6674
test-all:

‎.github/workflows/zizmor.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: GitHub Actions Security Analysis with zizmor 🌈
2+
3+
on:
4+
push:
5+
branches: ['main']
6+
pull_request:
7+
branches: ['**']
8+
9+
permissions: {}
10+
11+
jobs:
12+
zizmor:
13+
name: Run zizmor 🌈
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
contents: read # only needed for private repos
18+
actions: read # only needed for private repos
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run zizmor 🌈
26+
uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1

0 commit comments

Comments
 (0)