Skip to content

Commit 3525eed

Browse files
authored
ci: run zizmor (#8767)
Zizmor (https://github.com/zizmorcore/zizmor) is a GitHub Actions linter. The state of the GHA ecosystem is such that static analysis of GHA workflows is mandatory IMO. I have deliberately avoided use of https://github.com/zizmorcore/zizmor-action since it lacks stability, and I generally think it's better just to avoid third-party actions if we can (ack that the maintainers of the action and the linter are the same people). This PR also autofixes some trivial findings.
1 parent fbf3aa5 commit 3525eed

10 files changed

Lines changed: 61 additions & 20 deletions

.github/dependabot.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,5 @@ updates:
2121
schedule:
2222
interval: monthly
2323
open-pull-requests-limit: 1
24+
cooldown:
25+
default-days: 7

.github/workflows/boulder-ci.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ jobs:
7171
# Sequence of tasks that will be executed as part of the job.
7272
steps:
7373
# Checks out your repository under $GITHUB_WORKSPACE, so your job can access it
74-
- uses: actions/checkout@v6
74+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7575
with:
7676
persist-credentials: false
7777

@@ -104,17 +104,18 @@ jobs:
104104

105105
steps:
106106
# Checks out your repository under $GITHUB_WORKSPACE, so your job can access it
107-
- uses: actions/checkout@v6
107+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
108108
with:
109109
persist-credentials: false
110110

111111
- name: Setup Go
112-
uses: actions/setup-go@v6
112+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
113113
with:
114114
# When Go produces a security release, we want govulncheck to run
115115
# against the most recently released Go version.
116116
check-latest: true
117117
go-version: "stable"
118+
cache: false
118119

119120
- name: Run govulncheck
120121
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
@@ -129,14 +130,15 @@ jobs:
129130

130131
steps:
131132
# Checks out your repository under $GITHUB_WORKSPACE, so your job can access it
132-
- uses: actions/checkout@v6
133+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
133134
with:
134135
persist-credentials: false
135136

136137
- name: Setup Go ${{ matrix.go-version }}
137-
uses: actions/setup-go@v6
138+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
138139
with:
139140
go-version: ${{ matrix.go-version }}
141+
cache: false
140142

141143
- name: Verify vendor
142144
shell: bash

.github/workflows/check-iana-registries.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,10 @@ jobs:
1515

1616
steps:
1717
- name: Checkout iana/data from main branch
18-
uses: actions/checkout@v6
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1919
with:
2020
sparse-checkout: iana/data
21+
persist-credentials: false
2122

2223
# If the branch already exists, this will fail, which will remind us about
2324
# the outstanding PR.

.github/workflows/codeql.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ jobs:
1818

1919
steps:
2020
- name: Checkout repository
21-
uses: actions/checkout@v6
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2222
with:
2323
persist-credentials: false
2424
- name: Initialize CodeQL
25-
uses: github/codeql-action/init@v4
25+
uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
2626
- name: Autobuild
27-
uses: github/codeql-action/autobuild@v4
27+
uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
2828
- name: Perform CodeQL Analysis
29-
uses: github/codeql-action/analyze@v4
29+
uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0

.github/workflows/cps-review.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,20 @@ jobs:
1313
pull-requests: write
1414
steps:
1515
- name: Setup Go
16-
uses: actions/setup-go@v6
16+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
1717
with:
1818
go-version: "stable"
1919

2020
- name: Checkout Upstream
21-
uses: actions/checkout@v6
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2222
with:
2323
persist-credentials: false
2424
ref: ${{ github.event.pull_request.base.ref }}
2525
- name: Get Current Flags
2626
run: go run ./test/list-features/list-features.go | sort >| /tmp/currflags.txt
2727

2828
- name: Checkout PR
29-
uses: actions/checkout@v6
29+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3030
with:
3131
persist-credentials: false
3232
- name: Get PR Flags
@@ -38,7 +38,7 @@ jobs:
3838

3939
- name: Comment PR
4040
if: ${{ steps.newflags.outputs.flagnames != '' }}
41-
uses: actions/github-script@v9
41+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
4242
env:
4343
NEW_FLAGS: ${{ steps.newflags.outputs.flagnames }}
4444
with:

.github/workflows/issue-for-sre-handoff.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
pull-requests: write
1919
steps:
2020
- name: Comment PR
21-
uses: actions/github-script@v9
21+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
2222
with:
2323
script: |
2424
const commentMarker = '<!-- deployment_ticket_check -->';

.github/workflows/merged-to-main-or-release-branch.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,6 @@ jobs:
1414
name: Merged to main (or hotfix)
1515
runs-on: ubuntu-24.04
1616
steps:
17-
- uses: actions/checkout@v6
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
with:
1919
persist-credentials: false

.github/workflows/release.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
permissions:
1616
contents: write
1717
steps:
18-
- uses: actions/checkout@v6
18+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1919
with:
2020
persist-credentials: false
2121
fetch-depth: '0' # Needed for verify-release-ancestry.sh to see origin/main
@@ -41,7 +41,7 @@ jobs:
4141
contents: write
4242
packages: write
4343
steps:
44-
- uses: actions/checkout@v6
44+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4545
with:
4646
persist-credentials: false
4747
fetch-depth: '0' # Needed for verify-release-ancestry.sh to see origin/main
@@ -87,7 +87,7 @@ jobs:
8787
permissions:
8888
contents: write
8989
steps:
90-
- uses: actions/checkout@v6
90+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
9191
with:
9292
persist-credentials: false
9393

.github/workflows/try-release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
- "1.26.3"
2424
runs-on: ubuntu-24.04
2525
steps:
26-
- uses: actions/checkout@v6
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2727
with:
2828
persist-credentials: false
2929

.github/workflows/zizmor.yml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Lint GitHub Actions
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- release-branch-*
8+
pull_request:
9+
branches:
10+
- '**'
11+
workflow_dispatch:
12+
13+
permissions: {}
14+
15+
jobs:
16+
zizmor:
17+
runs-on: ubuntu-24.04
18+
19+
env:
20+
ZIZMOR_IMAGE: ghcr.io/zizmorcore/zizmor:1.25.2@sha256:14ea7f5cc7c67933394a35b5a38a277397818d232602635edb2010b313afb110
21+
22+
steps:
23+
- name: Checkout repository
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
with:
26+
persist-credentials: false
27+
28+
- name: Run zizmor
29+
env:
30+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31+
run: |
32+
docker run \
33+
--volume "${GITHUB_WORKSPACE}:/src:ro" \
34+
--workdir "/src" \
35+
--env "GH_TOKEN" \
36+
"$ZIZMOR_IMAGE" -- /src

0 commit comments

Comments
 (0)