chore: Update zizmor to v1.23.1
#52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright © 2025 hashcatHitman | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 OR MIT | |
| name: CI | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| branches: ["**"] | |
| workflow_dispatch: {} | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_VET_VERSION: 0.10.2 | |
| CARGO_AUDIT_VERSION: 0.22.1 | |
| ZIZMOR_VERSION: 1.23.1 | |
| MSRV: 1.89.0 | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| zizmor: | |
| name: Workflow Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Required for upload-sarif to upload SARIF files. | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust | |
| run: rustup update stable && rustup default stable | |
| - name: Check cache for zizmor | |
| id: cache-zizmor | |
| uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 | |
| with: | |
| path: ~/.cargo/bin/zizmor | |
| key: zizmor-bin-${{ env.ZIZMOR_VERSION }} | |
| - if: ${{ steps.cache-zizmor.outputs.cache-hit != 'true' }} | |
| name: Install zizmor | |
| run: cargo install --locked --version ${ZIZMOR_VERSION} zizmor | |
| - name: Invoke zizmor | |
| run: zizmor --persona auditor --format=sarif . > zizmor_results.sarif | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 | |
| with: | |
| sarif_file: zizmor_results.sarif | |
| category: zizmor | |
| reuse: | |
| name: REUSE compliance check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: REUSE Compliance Check | |
| uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0 | |
| cargo-audit: | |
| name: Audit Dependencies | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Required for upload-sarif to upload SARIF files. | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust | |
| run: rustup update stable && rustup default stable | |
| - name: Check cache for cargo-audit | |
| id: cache-cargo-audit | |
| uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 | |
| with: | |
| path: ~/.cargo/bin/cargo-audit | |
| key: cargo-audit-bin-${{ env.CARGO_AUDIT_VERSION }} | |
| - if: ${{ steps.cache-cargo-audit.outputs.cache-hit != 'true' }} | |
| name: Install cargo-audit | |
| run: cargo install --locked --version ${CARGO_AUDIT_VERSION} cargo-audit | |
| - name: Invoke cargo-audit | |
| run: cargo audit --deny warnings --format=sarif > cargo_audit_results.sarif | |
| - if: success() || failure() | |
| name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3 | |
| with: | |
| sarif_file: cargo_audit_results.sarif | |
| category: cargo-audit | |
| cargo-vet: | |
| name: Vet Dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust | |
| run: rustup update stable && rustup default stable | |
| - name: Check cache for cargo-vet | |
| id: cache-cargo-vet | |
| uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 | |
| with: | |
| path: ~/.cargo/bin/cargo-vet | |
| key: cargo-vet-bin-${{ env.CARGO_VET_VERSION }} | |
| - if: ${{ steps.cache-cargo-vet.outputs.cache-hit != 'true' }} | |
| name: Install cargo-vet | |
| run: cargo install --locked --version ${CARGO_VET_VERSION} cargo-vet | |
| - name: Invoke cargo-vet | |
| run: cargo vet --locked | |
| quality-control: | |
| name: Quality Control | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Nightly Install | |
| run: rustup toolchain add nightly && rustup component add --toolchain nightly rustfmt clippy | |
| - name: Format Check (Nightly) | |
| run: cargo +nightly fmt --verbose --all --check | |
| - name: Clippy (Nightly) | |
| run: cargo +nightly clippy --locked --workspace --all-targets --all-features -- -D warnings -Zcrate-attr=feature"(strict_provenance_lints,unqualified_local_imports,must_not_suspend,multiple_supertrait_upcastable,non_exhaustive_omitted_patterns_lint,supertrait_item_shadowing)" | |
| build-test-msrv: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| name: Build & Test (${{ matrix.os }}) (MSRV) | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: MSRV Install | |
| run: rustup toolchain add ${MSRV} | |
| - name: Build | |
| run: cargo +${MSRV} build --verbose --workspace --all-targets --all-features --locked | |
| - name: Tests | |
| run: cargo +${MSRV} test --verbose --workspace --all-targets --all-features --locked | |
| - name: Doctests | |
| run: cargo +${MSRV} test --verbose --workspace --doc --all-features --locked | |
| build-test-nightly: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| name: Build & Test (${{ matrix.os }}) (Nightly) | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Build | |
| run: cargo +nightly build --verbose --workspace --all-targets --all-features --locked | |
| - name: Tests | |
| run: cargo +nightly test --verbose --workspace --all-targets --all-features --locked | |
| - name: Doctests | |
| run: cargo +nightly test --verbose --workspace --doc --all-features --locked |