Skip to content

Commit f3e8262

Browse files
mr-cmr-c
committed
tighten github actions with zizmor
1 parent 1747b24 commit f3e8262

9 files changed

Lines changed: 144 additions & 58 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,5 @@ updates:
99
directory: "/" # Location of package manifests
1010
schedule:
1111
interval: "weekly"
12+
cooldown:
13+
default-days: 7

‎.github/workflows/actionlint.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
name: Lint GitHub Actions workflows
22
on: [push, pull_request]
33

4+
permissions: {}
5+
46
jobs:
57
actionlint:
68
runs-on: ubuntu-latest
79
steps:
8-
- uses: actions/checkout@v6
10+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
11+
with:
12+
persist-credentials: false
913
- name: Check workflow files
1014
run: |
1115
echo "::add-matcher::.github/actionlint-matcher.json"

‎.github/workflows/ci.yml‎

Lines changed: 45 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ on:
1010
branches:
1111
- 'master'
1212

13+
permissions: {}
14+
1315
concurrency:
1416
group: build-${{ github.event.pull_request.number || github.ref }}
1517
cancel-in-progress: true
@@ -18,9 +20,10 @@ jobs:
1820
checkinstall:
1921
runs-on: ubuntu-slim
2022
steps:
21-
- uses: actions/checkout@v6
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2224
with:
2325
fetch-depth: 2
26+
persist-credentials: false
2427
- name: Install APT Dependencies
2528
run: |
2629
sudo apt-get update && sudo apt-get install -y --no-install-recommends ninja-build
@@ -33,9 +36,10 @@ jobs:
3336
formatting:
3437
runs-on: ubuntu-slim
3538
steps:
36-
- uses: actions/checkout@v6
39+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3740
with:
3841
fetch-depth: 2
42+
persist-credentials: false
3943
- name: Install pcre2grep
4044
run: sudo apt-get update && sudo apt-get install -y --no-install-recommends pcre2-utils
4145
# Check for trailing whitespace
@@ -126,9 +130,10 @@ jobs:
126130
CXXFLAGS: -Wall -Wextra -Werror ${{ matrix.isax }}
127131
INTEL_TARGET: ${{ matrix.target }}
128132
steps:
129-
- uses: actions/checkout@v6
133+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
130134
with:
131135
submodules: recursive
136+
persist-credentials: false
132137
- name: CPU Information
133138
run: cat /proc/cpuinfo
134139
- name: Install APT Dependencies
@@ -143,7 +148,7 @@ jobs:
143148
sudo ln -s /usr/bin/g++-15 /usr/bin/g++
144149
pipx install meson==1.3.2
145150
- name: ccache
146-
uses: hendrikmuhs/ccache-action@v1.2
151+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
147152
with:
148153
key: ${{ github.job }}-${{ matrix.isax }}
149154
verbose: 2
@@ -171,9 +176,10 @@ jobs:
171176
CFLAGS: -Wall -Wextra -Werror -march=bdver2
172177
CXXFLAGS: -Wall -Wextra -Werror -march=bdver2
173178
steps:
174-
- uses: actions/checkout@v6
179+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
175180
with:
176181
submodules: recursive
182+
persist-credentials: false
177183
- name: CPU Information
178184
run: cat /proc/cpuinfo
179185
- name: Install APT Dependencies
@@ -188,7 +194,7 @@ jobs:
188194
sudo ln -s /usr/bin/g++-15 /usr/bin/g++
189195
pipx install meson==1.3.2
190196
- name: ccache
191-
uses: hendrikmuhs/ccache-action@v1.2
197+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
192198
with:
193199
key: ${{ github.job }}
194200
verbose: 2
@@ -213,16 +219,17 @@ jobs:
213219
- "32-relaxed"
214220
- "64-relaxed"
215221
steps:
216-
- uses: actions/checkout@v6
222+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
217223
with:
218224
submodules: recursive
225+
persist-credentials: false
219226
- name: Install APT Dependencies
220227
run: |
221228
sudo add-apt-repository ppa:stephanosio/ccache
222229
sudo apt-get install -y --no-install-recommends ninja-build pipx ccache
223230
pipx install meson==1.3.2
224231
- name: ccache
225-
uses: hendrikmuhs/ccache-action@v1.2
232+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
226233
with:
227234
key: ${{ github.job }}
228235
verbose: 2
@@ -254,9 +261,10 @@ jobs:
254261
CFLAGS: -DSIMDE_ENABLE_NATIVE_ALIASES -DSIMDE_NATIVE_ALIASES_TESTING -Wall -Wextra -Werror -pedantic
255262
CXXFLAGS: -DSIMDE_ENABLE_NATIVE_ALIASES -DSIMDE_NATIVE_ALIASES_TESTING -Wall -Wextra -Werror -pedantic
256263
steps:
257-
- uses: actions/checkout@v6
264+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
258265
with:
259266
submodules: recursive
267+
persist-credentials: false
260268
- id: cpu
261269
name: CPU Information
262270
run: cat /proc/cpuinfo
@@ -272,7 +280,7 @@ jobs:
272280
sudo ln -s /usr/bin/g++-15 /usr/bin/g++
273281
pipx install meson==1.3.2
274282
- name: ccache
275-
uses: hendrikmuhs/ccache-action@v1.2
283+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
276284
with:
277285
key: ${{ github.job }}
278286
verbose: 2
@@ -294,9 +302,10 @@ jobs:
294302
CFLAGS: -march=native -Wall -Wextra -Werror
295303
CXXFLAGS: -march=native -Wall -Wextra -Werror
296304
steps:
297-
- uses: actions/checkout@v6
305+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
298306
with:
299307
submodules: recursive
308+
persist-credentials: false
300309
- id: cpu
301310
name: CPU Information
302311
run: |
@@ -313,7 +322,7 @@ jobs:
313322
sudo ln -s /usr/bin/g++-15 /usr/bin/g++
314323
pipx install meson==1.3.2
315324
- name: ccache
316-
uses: hendrikmuhs/ccache-action@v1.2
325+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
317326
with:
318327
key: ${{ github.job }}
319328
verbose: 2
@@ -415,9 +424,10 @@ jobs:
415424
format('{0}-g++-{1}', matrix.gcc, matrix.version)
416425
) }}
417426
steps:
418-
- uses: actions/checkout@v6
427+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
419428
with:
420429
submodules: recursive
430+
persist-credentials: false
421431
- id: cpu
422432
name: CPU Information
423433
run: |
@@ -440,7 +450,7 @@ jobs:
440450
- if: ${{ matrix.version == '15' }}
441451
run: sudo apt-get satisfy -y 'binutils (>= 2.45)'
442452
- name: ccache
443-
uses: hendrikmuhs/ccache-action@v1.2
453+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
444454
with:
445455
key: ${{ github.job }}-${{ matrix.version }}-${{ matrix.distro }}-${{ matrix.arch_flags }}
446456
verbose: 2
@@ -503,9 +513,10 @@ jobs:
503513
# distro: ubuntu-24.04
504514
runs-on: ${{ matrix.distro }}
505515
steps:
506-
- uses: actions/checkout@v6
516+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
507517
with:
508518
submodules: recursive
519+
persist-credentials: false
509520
- name: CPU Information
510521
run: cat /proc/cpuinfo
511522
- if: ${{ matrix.distro == 'ubuntu-24.04' && ( matrix.version == '15' )}}
@@ -521,7 +532,7 @@ jobs:
521532
qemu-user-static pipx libc6-${{ matrix.arch_deb }}-cross libstdc++-${{ matrix.version }}-dev-${{ matrix.arch_deb }}-cross
522533
pipx install meson==1.3.2
523534
- name: ccache
524-
uses: hendrikmuhs/ccache-action@v1.2
535+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
525536
with:
526537
key: ${{ github.job }}-${{ matrix.version}}${{ matrix.extra }}-${{ matrix.distro }}-${{ matrix.cross }}
527538
verbose: 2
@@ -559,9 +570,10 @@ jobs:
559570
distro: ubuntu-24.04
560571
runs-on: ${{ matrix.distro }}
561572
steps:
562-
- uses: actions/checkout@v6
573+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
563574
with:
564575
submodules: recursive
576+
persist-credentials: false
565577
- name: CPU Information
566578
run: cat /proc/cpuinfo
567579
- name: Install APT Dependencies
@@ -575,7 +587,7 @@ jobs:
575587
libstdc++-12-dev-${{ matrix.arch_deb }}-cross \
576588
binutils-${{ matrix.arch_gnu }}-linux-gnu
577589
- name: ccache
578-
uses: hendrikmuhs/ccache-action@v1.2
590+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
579591
with:
580592
key: ${{ github.job }}-${{ matrix.distro }}-${{ matrix.cross }}
581593
verbose: 2
@@ -615,9 +627,10 @@ jobs:
615627
distro: ubuntu-24.04
616628
runs-on: ${{ matrix.distro }}
617629
steps:
618-
- uses: actions/checkout@v6
630+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
619631
with:
620632
submodules: recursive
633+
persist-credentials: false
621634
- name: CPU Information
622635
run: cat /proc/cpuinfo
623636
- name: Install APT Dependencies
@@ -629,7 +642,7 @@ jobs:
629642
libstdc++-12-dev-${{ matrix.arch_deb }}-cross \
630643
binutils-${{ matrix.arch_gnu }}-linux-gnu ccache
631644
- name: ccache
632-
uses: hendrikmuhs/ccache-action@v1.2
645+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
633646
with:
634647
key: ${{ github.job }}-${{ matrix.distro }}-${{ matrix.cross }}
635648
verbose: 2
@@ -686,9 +699,10 @@ jobs:
686699
distro: ubuntu-24.04
687700
runs-on: ${{ matrix.distro }}
688701
steps:
689-
- uses: actions/checkout@v6
702+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
690703
with:
691704
submodules: recursive
705+
persist-credentials: false
692706
- name: CPU Information
693707
run: cat /proc/cpuinfo
694708
- name: Install APT Dependencies
@@ -703,7 +717,7 @@ jobs:
703717
binutils-${{ matrix.arch_gnu }}-linux-gnu${{ matrix.arch_gnu_abi }}
704718
pipx install meson
705719
- name: ccache
706-
uses: hendrikmuhs/ccache-action@v1.2
720+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
707721
with:
708722
key: ${{ github.job }}-${{ matrix.version }}-${{ matrix.cross }}
709723
verbose: 2
@@ -901,9 +915,10 @@ jobs:
901915
matrix.plain == true, '-Wall -Weverything -Werror',
902916
'-march=native -Wall -Weverything -Werror') }} -fno-lax-vector-conversions
903917
steps:
904-
- uses: actions/checkout@v6
918+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
905919
with:
906920
submodules: recursive
921+
persist-credentials: false
907922
- id: cpu
908923
name: CPU Information
909924
run: |
@@ -937,7 +952,7 @@ jobs:
937952
sudo ln -s "$(command -v clang-${{ matrix.version }})" /usr/bin/cc
938953
sudo ln -s "$(command -v clang-${{ matrix.version }})" /usr/bin/c++
939954
- name: ccache
940-
uses: hendrikmuhs/ccache-action@v1.2
955+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
941956
with:
942957
key: ${{ github.job }}-${{ matrix.version }}-${{ matrix.distro }}-${{ matrix.arch_flags }}${{ matrix.plain }}
943958
verbose: 2
@@ -992,15 +1007,16 @@ jobs:
9921007
CFLAGS: ${{ matrix.arch_flags }} -Wall -Weverything -Werror -Wno-complex-component-init
9931008
CXXFLAGS: ${{ matrix.arch_flags }} -Wall -Weverything -Werror -Wno-complex-component-init
9941009
steps:
995-
- uses: actions/checkout@v6
1010+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
9961011
with:
9971012
submodules: recursive
1013+
persist-credentials: false
9981014
# - name: System Information
9991015
# run: system_profiler
10001016
- name: Compiler version
10011017
run: cc --version
10021018
- name: ccache
1003-
uses: hendrikmuhs/ccache-action@v1.2
1019+
uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
10041020
with:
10051021
key: ${{ github.job }}-${{ matrix.os }}-${{ matrix.xcode }}
10061022
verbose: 2
@@ -1027,7 +1043,9 @@ jobs:
10271043
CFLAGS: -Wall -Werror -march=native -fp-model precise
10281044
CXXFLAGS: -Wall -Werror -march=native -fp-model precise
10291045
steps:
1030-
- uses: actions/checkout@v6
1046+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1047+
with:
1048+
persist-credentials: false
10311049
- name: CPU Information
10321050
run: cat /proc/cpuinfo
10331051
- name: Install APT Dependencies

‎.github/workflows/cmake.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ on:
1010
branches:
1111
- 'master'
1212

13+
permissions: {}
14+
1315
concurrency:
1416
group: cmake-${{ github.event.pull_request.number || github.ref }}
1517
cancel-in-progress: true
@@ -24,9 +26,11 @@ jobs:
2426
os: [macos-latest, ubuntu-latest, ubuntu-24.04-arm, windows-latest, windows-11-arm]
2527

2628
steps:
27-
- uses: actions/checkout@v6
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
30+
with:
31+
persist-credentials: false
2832

29-
- uses: ilammy/msvc-dev-cmd@v1
33+
- uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
3034

3135
- name: Configure SIMDe
3236
run: cmake -G Ninja -S . -B build

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ jobs:
1414
name: Analyze
1515
runs-on: ubuntu-latest
1616

17+
permissions:
18+
security-events: write
19+
1720
strategy:
1821
fail-fast: false
1922
matrix:
@@ -25,11 +28,13 @@ jobs:
2528

2629
steps:
2730
- name: Checkout repository
28-
uses: actions/checkout@v6
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
32+
with:
33+
persist-credentials: false
2934

3035
# Initializes the CodeQL tools for scanning.
3136
- name: Initialize CodeQL
32-
uses: github/codeql-action/init@v4
37+
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
3338
with:
3439
languages: ${{ matrix.language }}
3540
trap-caching: false
@@ -40,4 +45,4 @@ jobs:
4045
"$HOME/.local/bin/meson" setup build
4146
4247
- name: Perform CodeQL Analysis
43-
uses: github/codeql-action/analyze@v4
48+
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4

0 commit comments

Comments
 (0)