Skip to content

Commit 1827383

Browse files
adibarraadibarra
authored
feat: add zizmor and resolve alerts (#555)
1 parent bc6f79f commit 1827383

11 files changed

Lines changed: 130 additions & 11 deletions

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ updates:
55
schedule:
66
interval: 'weekly'
77
day: 'monday'
8+
cooldown:
9+
default-days: 1
810
open-pull-requests-limit: 2
911
labels:
1012
- 'type/dependencies'
@@ -28,6 +30,8 @@ updates:
2830
schedule:
2931
interval: 'weekly'
3032
day: 'monday'
33+
cooldown:
34+
default-days: 1
3135
open-pull-requests-limit: 2
3236
labels:
3337
- 'type/dependencies'

‎.github/workflows/cache-refresh.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,23 @@ name: Cache Refresh
33
on:
44
workflow_dispatch:
55

6+
permissions: {}
7+
8+
concurrency:
9+
group: ${{ github.workflow }}
10+
cancel-in-progress: true
11+
612
jobs:
713
refresh:
14+
name: Refresh cache
815
timeout-minutes: 5
916
runs-on: ubuntu-latest
1017
permissions:
1118
contents: read
1219
steps:
1320
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
21+
with:
22+
persist-credentials: false
1423
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
1524
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
1625
with:

‎.github/workflows/claude.yml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ on:
1010
pull_request:
1111
types: [opened, synchronize, ready_for_review]
1212

13+
permissions: {}
14+
1315
# Single source of truth for the models. Bumping either is a one-line change.
1416
env:
1517
CLAUDE_MODEL: claude-opus-4-8
@@ -155,11 +157,11 @@ jobs:
155157
DATABASE_DRIVER: neon
156158
DATABASE_SSL: 'true'
157159
permissions:
158-
contents: write
159-
pull-requests: write
160-
issues: write
161-
actions: read
162-
id-token: write
160+
contents: write # Commit and push implementation changes
161+
pull-requests: write # Update pull requests and progress
162+
issues: write # Update issue comments and progress
163+
actions: read # Inspect workflow runs and checks
164+
id-token: write # Authenticate the Claude Code action with OIDC
163165
# Serialize @claude runs on the same issue/PR (incl. reviews — shared group with the
164166
# review job) so back-to-back triggers don't clobber each other.
165167
concurrency:
@@ -172,6 +174,8 @@ jobs:
172174
with:
173175
fetch-depth: 0
174176
token: ${{ secrets.PAT }}
177+
# The implementation agent commits and pushes its changes.
178+
persist-credentials: true
175179

176180
- name: Setup pnpm
177181
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
@@ -358,9 +362,9 @@ jobs:
358362
DATABASE_SSL: 'true'
359363
permissions:
360364
contents: read
361-
pull-requests: write
362-
actions: read
363-
id-token: write
365+
pull-requests: write # Post pull-request review comments
366+
actions: read # Inspect workflow runs and checks
367+
id-token: write # Authenticate the Claude Code action with OIDC
364368
concurrency:
365369
group: claude-${{ github.event.pull_request.number || github.event.issue.number }}
366370
cancel-in-progress: false

‎.github/workflows/db-backup.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,23 @@ on:
55
- cron: '0 0 * * 1' # Every Monday at midnight UTC
66
workflow_dispatch:
77

8+
permissions: {}
9+
10+
concurrency:
11+
group: ${{ github.workflow }}
12+
cancel-in-progress: false
13+
814
jobs:
915
backup:
16+
name: Back up database
1017
timeout-minutes: 120
1118
runs-on: blacksmith-32vcpu-ubuntu-2404
1219
permissions:
13-
contents: write
20+
contents: write # Create the database dump release
1421
steps:
1522
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
23+
with:
24+
persist-credentials: false
1625
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
1726
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
1827
with:

‎.github/workflows/ingest-agentic-results.yml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,15 @@ on:
4444
- production
4545
- dev
4646

47+
permissions: {}
48+
49+
concurrency:
50+
group: ${{ github.workflow }}-${{ github.event.client_payload.run-id || inputs.run-id }}
51+
cancel-in-progress: false
52+
4753
jobs:
4854
ingest:
55+
name: Ingest agentic benchmark results
4956
# Blob-heavy: uploading trace-replay sidecars for a ~20-point sweep takes
5057
# far longer than a fixed-seq-len ingest.
5158
timeout-minutes: 60
@@ -58,6 +65,8 @@ jobs:
5865
run: sleep 300
5966

6067
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
68+
with:
69+
persist-credentials: false
6170
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
6271
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
6372
with:
@@ -184,8 +193,10 @@ jobs:
184193
- name: Check for unmapped entities
185194
if: always()
186195
id: unmapped
196+
env:
197+
UNMAPPED_ENTITIES_FILE: ${{ github.workspace }}/unmapped-entities.json
187198
run: |
188-
f="${{ github.workspace }}/unmapped-entities.json"
199+
f="$UNMAPPED_ENTITIES_FILE"
189200
if [ -f "$f" ]; then
190201
echo "found=true" >> "$GITHUB_OUTPUT"
191202
models=$(jq -r '.models // [] | join(", ")' "$f")

‎.github/workflows/ingest-results.yml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,15 @@ on:
44
repository_dispatch:
55
types: [ingest-results]
66

7+
permissions: {}
8+
9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.event.client_payload.run-id }}
11+
cancel-in-progress: false
12+
713
jobs:
814
ingest:
15+
name: Ingest benchmark results
916
timeout-minutes: 15
1017
runs-on: ubuntu-latest
1118
permissions:
@@ -15,6 +22,8 @@ jobs:
1522
run: sleep 300
1623

1724
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
25+
with:
26+
persist-credentials: false
1827
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
1928
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2029
with:
@@ -143,8 +152,10 @@ jobs:
143152
- name: Check for unmapped entities
144153
if: always()
145154
id: unmapped
155+
env:
156+
UNMAPPED_ENTITIES_FILE: ${{ github.workspace }}/unmapped-entities.json
146157
run: |
147-
f="${{ github.workspace }}/unmapped-entities.json"
158+
f="$UNMAPPED_ENTITIES_FILE"
148159
if [ -f "$f" ]; then
149160
echo "found=true" >> "$GITHUB_OUTPUT"
150161
models=$(jq -r '.models // [] | join(", ")' "$f")

‎.github/workflows/lint.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,24 @@ on:
55
branches: [main, master]
66
types: [opened, synchronize, ready_for_review]
77

8+
permissions: {}
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
12+
cancel-in-progress: true
13+
814
jobs:
915
oxc:
16+
name: Lint and format
1017
if: ${{ !github.event.pull_request.draft }}
1118
timeout-minutes: 5
1219
runs-on: ubuntu-latest
1320
permissions:
1421
contents: read
1522
steps:
1623
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
24+
with:
25+
persist-credentials: false
1726
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
1827
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
1928
with:

‎.github/workflows/tests-e2e.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,24 @@ on:
1414
- 'pnpm-workspace.yaml'
1515
- 'tsconfig.json'
1616

17+
permissions: {}
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
21+
cancel-in-progress: true
22+
1723
jobs:
1824
component-tests:
25+
name: Component tests
1926
if: ${{ !github.event.pull_request.draft }}
2027
timeout-minutes: 15
2128
runs-on: blacksmith-8vcpu-ubuntu-2404
2229
permissions:
2330
contents: read
2431
steps:
2532
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
33+
with:
34+
persist-credentials: false
2635
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
2736
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2837
with:
@@ -49,6 +58,7 @@ jobs:
4958
CI: true
5059

5160
cypress:
61+
name: E2E (${{ matrix.browser }}, shard ${{ matrix.shard }})
5262
if: ${{ !github.event.pull_request.draft }}
5363
timeout-minutes: 15
5464
runs-on: blacksmith-8vcpu-ubuntu-2404
@@ -64,6 +74,8 @@ jobs:
6474
shard: [1, 2, 3, 4]
6575
steps:
6676
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
77+
with:
78+
persist-credentials: false
6779
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
6880
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
6981
with:

‎.github/workflows/tests-unit.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,24 @@ on:
1414
- 'pnpm-workspace.yaml'
1515
- 'tsconfig.json'
1616

17+
permissions: {}
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
21+
cancel-in-progress: true
22+
1723
jobs:
1824
vitest:
25+
name: Typecheck and unit tests
1926
if: ${{ !github.event.pull_request.draft }}
2027
timeout-minutes: 10
2128
runs-on: blacksmith-4vcpu-ubuntu-2404
2229
permissions:
2330
contents: read
2431
steps:
2532
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
33+
with:
34+
persist-credentials: false
2635
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
2736
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2837
with:

‎.github/workflows/zizmor.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Zizmor
2+
3+
on:
4+
pull_request:
5+
branches: [main, master]
6+
types: [opened, synchronize, ready_for_review]
7+
paths:
8+
- '.github/dependabot.yml'
9+
- '.github/zizmor.yml'
10+
- '.github/workflows/**'
11+
- '.github/actions/**'
12+
- 'action.yml'
13+
- 'action.yaml'
14+
15+
permissions: {}
16+
17+
concurrency:
18+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
19+
cancel-in-progress: true
20+
21+
jobs:
22+
zizmor:
23+
name: Audit GitHub Actions
24+
if: ${{ !github.event.pull_request.draft }}
25+
timeout-minutes: 5
26+
runs-on: ubuntu-latest
27+
permissions:
28+
contents: read
29+
steps:
30+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
31+
with:
32+
persist-credentials: false
33+
- name: Install uv
34+
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
35+
- name: Audit workflows
36+
run: uvx --exclude-newer P1D zizmor@latest --strict-collection --pedantic --no-ignores .

0 commit comments

Comments
 (0)