Skip to content

fix: address zizmor security findings #140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Daniel-Aaron-Bloom wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix: address zizmor security findings #140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fd0fe25
fix: address zizmor security findings in workflow files
Daniel-Aaron-Bloom Jun 5, 2026
4bf72be
fix: address remaining zizmor findings (cooldown default, bot-conditi…
Daniel-Aaron-Bloom Jun 5, 2026
e2678e8
fix: correct dependabot-cooldown field name and bot-conditions check
Daniel-Aaron-Bloom Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ updates:
directory: "/"
schedule:
interval: "daily"
cooldown:
default-days: 7
# Always bump the lower bound in package.json to match the new version,
# preventing version drift within groups (e.g. ^4.0.10 staying behind ^4.0.12)
versioning-strategy: increase
Expand Down
10 changes: 7 additions & 3 deletions .github/workflows/dependabot-overrides.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Update SDK Overrides

on:
pull_request_target:
pull_request:
paths:
- "package.json"

Expand All @@ -11,14 +11,15 @@ permissions:

jobs:
update-overrides:
if: github.actor == 'dependabot[bot]'
if: github.event.pull_request.user.login == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
- name: Checkout PR branch
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ github.head_ref }}
token: ${{ secrets.GITHUB_TOKEN }}
persist-credentials: false

- name: Update overrides to match SDK version
run: |
Expand Down Expand Up @@ -52,9 +53,12 @@ jobs:

- name: Commit updated overrides
if: steps.diff.outputs.changed == 'true'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git add package.json
git commit -m "chore: sync overrides with @wormhole-foundation/sdk version"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
git push
3 changes: 1 addition & 2 deletions .github/workflows/sdk-type-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ permissions:

jobs:
typecheck-latest:
uses: wormhole-foundation/workflows/.github/workflows/wormhole-demo-typecheck.yml@main
secrets: inherit
uses: wormhole-foundation/workflows/.github/workflows/wormhole-demo-typecheck.yml@30ad77bad7253e603b820f3037045fa0590e4151 # main

@djb15 djb15 Jun 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pinned to the version before the zizmor fixes

with:
package_manager: yarn
Loading