Skip to content

Commit 39c1049

Browse files
en-j-ganujm1
en-j-g
and
anujm1
committed
Zizmor report related fixes (#73)
* permission fixes * workflow permission updates * Update .github/workflows/check-spec.yml * Update check-spec.yml --------- Co-authored-by: Anuj Mittal <anuj.mittal@intel.com>
1 parent a893ed7 commit 39c1049

12 files changed

+62
-15
lines changed

‎.github/workflows/check-circular-deps.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
- .github/workflows/check-circular-deps.yml
1212
- '**.spec'
1313

14+
permissions: read-all
15+
1416
jobs:
1517
spec-check:
1618
name: Circular dependency check
@@ -20,6 +22,8 @@ jobs:
2022
# Checkout the branch of our repo that triggered this action
2123
- name: Workflow trigger checkout
2224
uses: actions/checkout@v4
25+
with:
26+
persist-credentials: false
2327

2428
- name: Check for circular dependencies
2529
run: |

‎.github/workflows/check-entangled-specs.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,9 @@ jobs:
2020
# Checkout the branch of our repo that triggered this action
2121
- name: Workflow trigger checkout
2222
uses: actions/checkout@v4
23-
23+
with:
24+
persist-credentials: false
25+
2426
# For consistency, we use the same major/minor version of Python that Azure Linux ships
2527
- name: Setup Python 3.12
2628
uses: actions/setup-python@v5

‎.github/workflows/check-license-map.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,9 @@ jobs:
2424
# Checkout the branch of our repo that triggered this action
2525
- name: Workflow trigger checkout
2626
uses: actions/checkout@v4
27-
27+
with:
28+
persist-credentials: false
29+
2830
- name: Setup Python 3.12
2931
uses: actions/setup-python@v5
3032
with:

‎.github/workflows/check-manifests.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ jobs:
2222
steps:
2323
- name: Check out code
2424
uses: actions/checkout@v4
25+
with:
26+
persist-credentials: false
2527

2628
# This PR runner uses an older Ubuntu with rpm version 4.17, which doesn't understand some newer macros like %bcond
2729
- name: Define missing rpm macros

‎.github/workflows/check-package-cgmanifest.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ jobs:
2222
steps:
2323
- name: Check out code
2424
uses: actions/checkout@v4
25+
with:
26+
persist-credentials: false
2527

2628
# This PR runner uses an older Ubuntu with rpm version 4.17, which doesn't understand some newer macros like %bcond
2729
- name: Define missing rpm macros
@@ -33,9 +35,12 @@ jobs:
3335
- name: Get base commit for PRs
3436
if: ${{ github.event_name == 'pull_request' }}
3537
run: |
36-
git fetch origin ${{ github.base_ref }}
37-
echo "base_sha=$(git rev-parse origin/${{ github.base_ref }})" >> "$GITHUB_ENV"
38-
echo "Merging ${{ github.sha }} into ${{ github.base_ref }}"
38+
base_ref="${BASE_REF}"
39+
git fetch origin $base_ref
40+
echo "base_sha=$(git rev-parse origin/$base_ref)" >> "$GITHUB_ENV"
41+
echo "Merging ${{ github.sha }} into $base_ref"
42+
env:
43+
BASE_REF: ${{ github.base_ref }}
3944

4045
- name: Get base commit for Pushes
4146
if: ${{ github.event_name == 'push' }}

‎.github/workflows/check-source-signatures.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
- .github/workflows/check-source-signatures.yml
1212
- '**.spec'
1313

14+
permissions: read-all
15+
1416
jobs:
1517
spec-check:
1618
name: Source Signature Check
@@ -24,6 +26,7 @@ jobs:
2426
- name: Workflow trigger checkout
2527
uses: actions/checkout@v4
2628
with:
29+
persist-credentials: false
2730
fetch-depth: 0
2831

2932
# For consistency, we use the same major/minor version of Python that Azure Linux ships
@@ -38,8 +41,11 @@ jobs:
3841
- name: Get base commit for PRs
3942
if: ${{ github.event_name == 'pull_request' }}
4043
run: |
41-
echo "base_sha=$(git rev-parse origin/${{ github.base_ref }})" >> "$GITHUB_ENV"
42-
echo "Merging ${{ github.sha }} into ${{ github.base_ref }}"
44+
base_ref="${BASE_REF}"
45+
echo "base_sha=$(git rev-parse origin/$base_ref)" >> "$GITHUB_ENV"
46+
echo "Merging ${{ github.sha }} into $base_ref"
47+
env:
48+
BASE_REF: ${{ github.base_ref }}
4349

4450
- name: Get base commit for Pushes
4551
if: ${{ github.event_name == 'push' }}

‎.github/workflows/check-spec.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ jobs:
2424
uses: actions/checkout@v4
2525
with:
2626
fetch-depth: 0
27+
persist-credentials: false
2728

2829
# For consistency, we use the same major/minor version of Python that Azure Linux ships
2930
- name: Setup Python 3.12
@@ -37,8 +38,11 @@ jobs:
3738
- name: Get base commit for PRs
3839
if: ${{ github.event_name == 'pull_request' }}
3940
run: |
40-
echo "base_sha=$(git rev-parse origin/${{ github.base_ref }})" >> "$GITHUB_ENV"
41-
echo "Merging ${{ github.sha }} into ${{ github.base_ref }}"
41+
base_ref="${BASE_REF}"
42+
echo "base_sha=$(git rev-parse origin/$base_ref)" >> "$GITHUB_ENV"
43+
echo "Merging ${{ github.sha }} into $base_ref"
44+
env:
45+
BASE_REF: ${{ github.base_ref }}
4246

4347
- name: Get base commit for Pushes
4448
if: ${{ github.event_name == 'push' }}
@@ -63,6 +67,7 @@ jobs:
6367
with:
6468
ref: '3.0'
6569
path: '3.0-checkout'
70+
persist-credentials: false
6671

6772
- name: Verify .spec files
6873
if: ${{ env.updated-specs != '' }}

‎.github/workflows/check-static-glibc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ jobs:
2222
# Checkout the branch of our repo that triggered this action
2323
- name: Workflow trigger checkout
2424
uses: actions/checkout@v4
25+
with:
26+
persist-credentials: false
2527

2628
# For consistency, we use the same major/minor version of Python that Azure Linux ships
2729
- name: Setup Python 3.12

‎.github/workflows/go-test-coverage.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ jobs:
3333

3434
- name: Check out code into the Go module directory
3535
uses: actions/checkout@v4
36+
with:
37+
persist-credentials: false
3638

3739
- name: Check go.mod
3840
run: |

‎.github/workflows/lint-specs.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,17 @@ jobs:
2424
uses: actions/checkout@v4
2525
with:
2626
fetch-depth: 0
27+
persist-credentials: false
2728

2829
- name: Get base commit for PRs
2930
if: ${{ github.event_name == 'pull_request' }}
3031
run: |
31-
echo "base_sha=$(git rev-parse origin/${{ github.base_ref }})" >> "$GITHUB_ENV"
32-
echo "Merging ${{ github.sha }} into ${{ github.base_ref }}"
33-
32+
base_ref="${BASE_REF}"
33+
echo "base_sha=$(git rev-parse origin/$base_ref)" >> "$GITHUB_ENV"
34+
echo "Merging ${{ github.sha }} into $base_ref"
35+
env:
36+
BASE_REF: ${{ github.base_ref }}
37+
3438
- name: Get base commit for Pushes
3539
if: ${{ github.event_name == 'push' }}
3640
run: |
@@ -50,6 +54,7 @@ jobs:
5054
with:
5155
ref: '3.0'
5256
path: '3.0-checkout'
57+
persist-credentials: false
5358

5459
# Our linter is based on the spec-cleaner tool from the folks at openSUSE
5560
# We apply a patch to modify it for our needs
@@ -59,6 +64,7 @@ jobs:
5964
repository: 'rpm-software-management/spec-cleaner'
6065
ref: 'spec-cleaner-1.2.0'
6166
path: 'spec-cleaner'
67+
persist-credentials: false
6268

6369
# For consistency, we use the same major/minor version of Python that Azure Linux ships
6470
- name: Setup Python 3.12

0 commit comments

Comments
 (0)