Skip to content

Commit 8f28c57

Browse files
crazy-maxcrazy-max
committed
fix zizmor findings
1 parent 5d643aa commit 8f28c57

6 files changed

Lines changed: 35 additions & 57 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ updates:
44
directory: "/"
55
schedule:
66
interval: "daily"
7-
time: "08:00"
8-
timezone: "Europe/Paris"
7+
cooldown:
8+
default-days: 2
99
labels:
1010
- ":game_die: dependencies"
1111
- ":robot: bot"

‎.github/workflows/.build.yml‎

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
# reusable workflow
22
name: .build
33

4-
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
54
permissions:
65
contents: read
76

@@ -30,7 +29,7 @@ jobs:
3029
steps:
3130
-
3231
name: Checkout
33-
uses: actions/checkout@v4
32+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3433
-
3534
name: Create matrix
3635
id: platforms
@@ -43,7 +42,7 @@ jobs:
4342
-
4443
name: Tags
4544
id: tags
46-
uses: actions/github-script@v7
45+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
4746
with:
4847
result-encoding: string
4948
script: |
@@ -64,7 +63,7 @@ jobs:
6463
-
6564
name: Docker meta
6665
id: meta
67-
uses: docker/metadata-action@v5
66+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
6867
with:
6968
images: |
7069
${{ env.DOCKERHUB_SLUG }}
@@ -80,7 +79,7 @@ jobs:
8079
mv "${{ steps.meta.outputs.bake-file }}" "/tmp/bake-meta.json"
8180
-
8281
name: Upload meta bake definition
83-
uses: actions/upload-artifact@v4
82+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
8483
with:
8584
name: bake-meta-${{ inputs.go_version }}
8685
path: /tmp/bake-meta.json
@@ -90,10 +89,8 @@ jobs:
9089
build:
9190
runs-on: ${{ startsWith(matrix.platform, 'linux/arm') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
9291
permissions:
93-
# same as global permissions
94-
contents: read
95-
# required to push to GHCR
96-
packages: write
92+
contents: read # same as global permissions
93+
packages: write # required to push to GHCR
9794
needs:
9895
- prepare
9996
strategy:
@@ -108,32 +105,32 @@ jobs:
108105
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
109106
-
110107
name: Download meta bake definition
111-
uses: actions/download-artifact@v4
108+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
112109
with:
113110
name: bake-meta-${{ inputs.go_version }}
114111
path: /tmp
115112
-
116113
name: Login to DockerHub
117114
if: github.event_name != 'pull_request'
118-
uses: docker/login-action@v3
115+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
119116
with:
120117
username: ${{ secrets.DOCKER_USERNAME }}
121118
password: ${{ secrets.DOCKER_PASSWORD }}
122119
-
123120
name: Login to GHCR
124121
if: github.event_name != 'pull_request'
125-
uses: docker/login-action@v3
122+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
126123
with:
127124
registry: ghcr.io
128125
username: ${{ github.repository_owner }}
129126
password: ${{ secrets.GITHUB_TOKEN }}
130127
-
131128
name: Set up Docker Buildx
132-
uses: docker/setup-buildx-action@v3
129+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
133130
-
134131
name: Build
135132
id: bake
136-
uses: docker/bake-action@v6
133+
uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # v6.10.0
137134
with:
138135
files: |
139136
./docker-bake.hcl
@@ -154,7 +151,7 @@ jobs:
154151
touch "/tmp/digests/${digest#sha256:}"
155152
-
156153
name: Upload digest
157-
uses: actions/upload-artifact@v4
154+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
158155
with:
159156
name: digests-${{ inputs.go_version }}-${{ env.PLATFORM_PAIR }}
160157
path: /tmp/digests/*
@@ -165,38 +162,36 @@ jobs:
165162
runs-on: ubuntu-latest
166163
if: github.event_name != 'pull_request'
167164
permissions:
168-
# same as global permissions
169-
contents: read
170-
# required to push to GHCR
171-
packages: write
165+
contents: read # same as global permissions
166+
packages: write # required to push to GHCR
172167
needs:
173168
- build
174169
steps:
175170
-
176171
name: Download meta bake definition
177-
uses: actions/download-artifact@v4
172+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
178173
with:
179174
name: bake-meta-${{ inputs.go_version }}
180175
path: /tmp
181176
-
182177
name: Download digests
183-
uses: actions/download-artifact@v4
178+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
184179
with:
185180
path: /tmp/digests
186181
pattern: digests-${{ inputs.go_version }}-*
187182
merge-multiple: true
188183
-
189184
name: Set up Docker Buildx
190-
uses: docker/setup-buildx-action@v3
185+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
191186
-
192187
name: Login to DockerHub
193-
uses: docker/login-action@v3
188+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
194189
with:
195190
username: ${{ secrets.DOCKER_USERNAME }}
196191
password: ${{ secrets.DOCKER_PASSWORD }}
197192
-
198193
name: Login to GHCR
199-
uses: docker/login-action@v3
194+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
200195
with:
201196
registry: ghcr.io
202197
username: ${{ github.repository_owner }}

‎.github/workflows/image.yml‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ concurrency:
44
group: ${{ github.workflow }}-${{ github.ref }}
55
cancel-in-progress: true
66

7-
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
87
permissions:
98
contents: read
109

@@ -26,10 +25,8 @@ jobs:
2625
build:
2726
uses: ./.github/workflows/.build.yml
2827
permissions:
29-
# same as global permissions
30-
contents: read
31-
# required to push to GHCR
32-
packages: write
28+
contents: read # same as global permissions
29+
packages: write # required to push to GHCR
3330
secrets: inherit
3431
strategy:
3532
fail-fast: false

‎.github/workflows/labels.yml‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ concurrency:
44
group: ${{ github.workflow }}-${{ github.ref }}
55
cancel-in-progress: true
66

7-
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
87
permissions:
98
contents: read
109

@@ -24,16 +23,14 @@ jobs:
2423
labeler:
2524
runs-on: ubuntu-latest
2625
permissions:
27-
# same as global permissions
28-
contents: read
29-
# required to update labels
30-
issues: write
26+
contents: read # same as global permissions
27+
issues: write # required to update labels
3128
steps:
3229
-
3330
name: Checkout
34-
uses: actions/checkout@v4
31+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3532
-
3633
name: Run Labeler
37-
uses: crazy-max/ghaction-github-labeler@v5
34+
uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916 # v5.3.0
3835
with:
3936
dry-run: ${{ github.event_name == 'pull_request' }}

‎.github/workflows/test.yml‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,14 @@ concurrency:
44
group: ${{ github.workflow }}-${{ github.ref }}
55
cancel-in-progress: true
66

7-
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
87
permissions:
98
contents: read
109

1110
on:
1211
push:
1312
branches:
1413
- 'master'
15-
paths-ignore:
16-
- '**.md'
1714
pull_request:
18-
paths-ignore:
19-
- '**.md'
2015

2116
jobs:
2217
test:
@@ -35,7 +30,7 @@ jobs:
3530
steps:
3631
-
3732
name: Build xgo
38-
uses: docker/bake-action@v6
33+
uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # v6.10.0
3934
with:
4035
targets: image
4136
set: |
@@ -45,7 +40,7 @@ jobs:
4540
*.cache-from=type=gha,scope=go-${{ matrix.go_version }}-linux-amd64
4641
-
4742
name: Test ${{ matrix.case }} for go ${{ matrix.go_version }}
48-
uses: docker/bake-action@v6
43+
uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # v6.10.0
4944
with:
5045
targets: test-${{ matrix.case }}
5146
env:

‎.github/workflows/xgo.yml‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ concurrency:
44
group: ${{ github.workflow }}-${{ github.ref }}
55
cancel-in-progress: true
66

7-
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
87
permissions:
98
contents: read
109

@@ -14,13 +13,9 @@ on:
1413
- 'master'
1514
tags:
1615
- 'v*'
17-
paths-ignore:
18-
- '**.md'
1916
pull_request:
2017
branches:
2118
- 'master'
22-
paths-ignore:
23-
- '**.md'
2419

2520
env:
2621
DESTDIR: ./bin
@@ -29,36 +24,35 @@ jobs:
2924
build:
3025
runs-on: ubuntu-latest
3126
permissions:
32-
# required to create GitHub release
33-
contents: write
27+
contents: write # required to create GitHub release
3428
steps:
3529
-
3630
name: Set up Docker Buildx
37-
uses: docker/setup-buildx-action@v3
31+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
3832
-
3933
name: Build artifacts
40-
uses: docker/bake-action@v6
34+
uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # v6.10.0
4135
with:
4236
targets: artifact-all
4337
provenance: false
4438
-
4539
name: Release
46-
uses: docker/bake-action@v6
40+
uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # v6.10.0
4741
with:
4842
targets: release
4943
provenance: false
5044
set: |
5145
*.contexts.artifacts=cwd://${{ env.DESTDIR }}/artifact
5246
-
5347
name: Upload artifacts
54-
uses: actions/upload-artifact@v4
48+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
5549
with:
5650
name: xgo
5751
path: ${{ env.DESTDIR }}/release/*
5852
if-no-files-found: error
5953
-
6054
name: GitHub Release
61-
uses: softprops/action-gh-release@v2
55+
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
6256
if: startsWith(github.ref, 'refs/tags/v')
6357
with:
6458
draft: true

0 commit comments

Comments
 (0)