Skip to content

Commit f7f4c9e

Browse files
nperez0111nperez0111
authored
build: apply zizmor recommended fixes (#2764)
1 parent 1a65508 commit f7f4c9e

6 files changed

Lines changed: 102 additions & 43 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,3 +55,5 @@ updates:
5555
- "react-dom"
5656
- "yjs"
5757
- "y-prosemirror"
58+
cooldown:
59+
default-days: 7

‎.github/workflows/build.yml‎

Lines changed: 31 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
pull_request:
77
types: [opened, synchronize, reopened, edited]
88

9+
permissions:
10+
contents: read
11+
912
env:
1013
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
1114
NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN: ${{ secrets.NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN }}
@@ -18,23 +21,24 @@ jobs:
1821
runs-on: ubuntu-latest
1922
timeout-minutes: 60
2023
steps:
21-
- uses: actions/checkout@v6
24+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2225
with:
2326
fetch-depth: 100
27+
persist-credentials: false
2428

2529
- name: Install pnpm
26-
uses: pnpm/action-setup@v5
30+
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
2731

28-
- uses: nrwl/nx-set-shas@v5
32+
- uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5
2933

30-
- uses: actions/setup-node@v6
34+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3135
with:
3236
cache: "pnpm"
3337
cache-dependency-path: "**/pnpm-lock.yaml"
3438
node-version-file: ".nvmrc"
3539

3640
- name: Cache NX
37-
uses: actions/cache@v5
41+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
3842
with:
3943
path: .nx/cache
4044
key: nx-${{ env.NX_BRANCH }}-${{ env.NX_RUN_GROUP }}-${{ github.sha }}
@@ -59,7 +63,7 @@ jobs:
5963
run: NEXTJS_TEST_MODE=build npx vitest run tests/src/unit/nextjs/serverUtil.test.ts
6064

6165
- name: Upload webpack stats artifact (editor)
62-
uses: relative-ci/agent-upload-artifact-action@v2
66+
uses: relative-ci/agent-upload-artifact-action@a2b5741b4f7e6a989c84ec1a3059696b23c152e5 # v2
6367
with:
6468
webpackStatsFile: ./playground/dist/webpack-stats.json
6569
artifactName: relative-ci-artifacts-editor
@@ -73,23 +77,24 @@ jobs:
7377
runs-on: ubuntu-latest
7478
timeout-minutes: 30
7579
steps:
76-
- uses: actions/checkout@v6
80+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7781
with:
7882
fetch-depth: 100
83+
persist-credentials: false
7984

8085
- name: Install pnpm
81-
uses: pnpm/action-setup@v5
86+
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
8287

83-
- uses: nrwl/nx-set-shas@v5
88+
- uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5
8489

85-
- uses: actions/setup-node@v6
90+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
8691
with:
8792
cache: "pnpm"
8893
cache-dependency-path: "**/pnpm-lock.yaml"
8994
node-version-file: ".nvmrc"
9095

9196
- name: Cache NX
92-
uses: actions/cache@v5
97+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
9398
with:
9499
path: .nx/cache
95100
key: nx-playwright-${{ env.NX_BRANCH }}-${{ env.NX_RUN_GROUP }}-${{ github.sha }}
@@ -105,7 +110,7 @@ jobs:
105110
run: pnpm run build
106111

107112
- name: Upload build artifacts
108-
uses: actions/upload-artifact@v7
113+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
109114
with:
110115
name: playwright-build
111116
path: |
@@ -127,21 +132,22 @@ jobs:
127132
shardIndex: [1, 2]
128133
shardTotal: [2]
129134
steps:
130-
- uses: actions/checkout@v6
135+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
131136
with:
132137
fetch-depth: 100
138+
persist-credentials: false
133139

134140
- name: Install pnpm
135-
uses: pnpm/action-setup@v5
141+
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
136142

137-
- uses: actions/setup-node@v6
143+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
138144
with:
139145
cache: "pnpm"
140146
cache-dependency-path: "**/pnpm-lock.yaml"
141147
node-version-file: ".nvmrc"
142148

143149
- name: Download build artifacts
144-
uses: actions/download-artifact@v8
150+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
145151
with:
146152
name: playwright-build
147153

@@ -153,15 +159,15 @@ jobs:
153159
HOME=/root PLAYWRIGHT_CONFIG="--project ${{ matrix.browser }} --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}" pnpm run e2e
154160
155161
- name: Upload blob report
156-
uses: actions/upload-artifact@v7
162+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
157163
if: ${{ !cancelled() }}
158164
with:
159165
name: blob-report-${{ matrix.browser }}-${{ matrix.shardIndex }}
160166
path: tests/blob-report/
161167
retention-days: 1
162168

163169
- name: Upload HTML report
164-
uses: actions/upload-artifact@v7
170+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
165171
if: ${{ !cancelled() }}
166172
with:
167173
name: playwright-report-${{ matrix.browser }}-${{ matrix.shardIndex }}
@@ -174,12 +180,14 @@ jobs:
174180
needs: playwright
175181
runs-on: ubuntu-latest
176182
steps:
177-
- uses: actions/checkout@v6
183+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
184+
with:
185+
persist-credentials: false
178186

179187
- name: Install pnpm
180-
uses: pnpm/action-setup@v5
188+
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
181189

182-
- uses: actions/setup-node@v6
190+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
183191
with:
184192
cache: "pnpm"
185193
cache-dependency-path: "**/pnpm-lock.yaml"
@@ -189,7 +197,7 @@ jobs:
189197
run: pnpm install
190198

191199
- name: Download blob reports
192-
uses: actions/download-artifact@v8
200+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
193201
with:
194202
path: tests/all-blob-reports
195203
pattern: blob-report-*
@@ -200,7 +208,7 @@ jobs:
200208
working-directory: tests
201209

202210
- name: Upload merged HTML report
203-
uses: actions/upload-artifact@v7
211+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
204212
with:
205213
name: playwright-report-merged
206214
path: tests/playwright-report/

‎.github/workflows/fresh-install-tests.yml‎

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
- cron: "0 2 * * *" # Daily at 02:00 UTC
1616
workflow_dispatch: # Allow manual runs
1717

18+
permissions:
19+
contents: read
20+
1821
env:
1922
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
2023
pnpm_config_store_dir: ./node_modules/.pnpm-store
@@ -27,14 +30,16 @@ jobs:
2730

2831
steps:
2932
- id: checkout
30-
uses: actions/checkout@v6
33+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
34+
with:
35+
persist-credentials: false
3136

3237
- id: install_pnpm
3338
name: Install pnpm
34-
uses: pnpm/action-setup@v5
39+
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
3540

3641
- id: setup_node
37-
uses: actions/setup-node@v6
42+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3843
with:
3944
node-version-file: ".nvmrc"
4045
# Intentionally no pnpm cache — we want fresh prod dep resolution
@@ -99,28 +104,36 @@ jobs:
99104
RUN_NUMBER: ${{ github.run_number }}
100105
RUN_ATTEMPT: ${{ github.run_attempt }}
101106
BRANCH: ${{ github.ref_name }}
107+
STEPS_CHECKOUT_OUTCOME: ${{ steps.checkout.outcome }}
108+
STEPS_INSTALL_PNPM_OUTCOME: ${{ steps.install_pnpm.outcome }}
109+
STEPS_SETUP_NODE_OUTCOME: ${{ steps.setup_node.outcome }}
110+
STEPS_INSTALL_DEPENDENCIES_OUTCOME: ${{ steps.install_dependencies.outcome }}
111+
STEPS_UPDATE_PROD_DEPS_OUTCOME: ${{ steps.update_prod_deps.outcome }}
112+
STEPS_DEDUPE_DEPS_OUTCOME: ${{ steps.dedupe_deps.outcome }}
113+
STEPS_BUILD_PACKAGES_OUTCOME: ${{ steps.build_packages.outcome }}
114+
STEPS_RUN_UNIT_TESTS_OUTCOME: ${{ steps.run_unit_tests.outcome }}
102115
run: |
103116
if [ -z "$SLACK_WEBHOOK_URL" ]; then
104117
echo "SLACK_WEBHOOK_URL is not configured; skipping Slack notification."
105118
exit 0
106119
fi
107120
108121
failed_step="Unknown step"
109-
if [ "${{ steps.checkout.outcome }}" = "failure" ]; then
122+
if [ "${STEPS_CHECKOUT_OUTCOME}" = "failure" ]; then
110123
failed_step="Checkout repository"
111-
elif [ "${{ steps.install_pnpm.outcome }}" = "failure" ]; then
124+
elif [ "${STEPS_INSTALL_PNPM_OUTCOME}" = "failure" ]; then
112125
failed_step="Install pnpm"
113-
elif [ "${{ steps.setup_node.outcome }}" = "failure" ]; then
126+
elif [ "${STEPS_SETUP_NODE_OUTCOME}" = "failure" ]; then
114127
failed_step="Setup Node.js"
115-
elif [ "${{ steps.install_dependencies.outcome }}" = "failure" ]; then
128+
elif [ "${STEPS_INSTALL_DEPENDENCIES_OUTCOME}" = "failure" ]; then
116129
failed_step="Install dependencies"
117-
elif [ "${{ steps.update_prod_deps.outcome }}" = "failure" ]; then
130+
elif [ "${STEPS_UPDATE_PROD_DEPS_OUTCOME}" = "failure" ]; then
118131
failed_step="Update prod deps of published packages"
119-
elif [ "${{ steps.dedupe_deps.outcome }}" = "failure" ]; then
132+
elif [ "${STEPS_DEDUPE_DEPS_OUTCOME}" = "failure" ]; then
120133
failed_step="Dedupe transitive dependencies"
121-
elif [ "${{ steps.build_packages.outcome }}" = "failure" ]; then
134+
elif [ "${STEPS_BUILD_PACKAGES_OUTCOME}" = "failure" ]; then
122135
failed_step="Build packages"
123-
elif [ "${{ steps.run_unit_tests.outcome }}" = "failure" ]; then
136+
elif [ "${STEPS_RUN_UNIT_TESTS_OUTCOME}" = "failure" ]; then
124137
failed_step="Run unit tests"
125138
fi
126139

‎.github/workflows/publish.yaml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -29,39 +29,42 @@ jobs:
2929
attestations: write
3030
timeout-minutes: 10
3131
steps:
32-
- uses: actions/checkout@v6
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3333
with:
3434
ref: ${{ inputs.version }}
3535
fetch-depth: 100
36+
persist-credentials: false
3637
- name: Display version being published
3738
run: |
38-
echo "Publishing version: ${{ inputs.version }}"
39+
echo "Publishing version: ${INPUTS_VERSION}"
40+
env:
41+
INPUTS_VERSION: ${{ inputs.version }}
3942

4043
- run: jq '.packageManager' package.json | tr -d '"pnpm@'
4144
id: package-manager-version
4245

4346
- name: Install pnpm
44-
uses: pnpm/action-setup@v5
47+
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
4548
with:
4649
version: ${{ steps.package-manager-version.outputs.stdout }}
4750

48-
- uses: nrwl/nx-set-shas@v5
51+
- uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5
4952

50-
- uses: actions/setup-node@v6
53+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 # zizmor: ignore[cache-poisoning]
5154
with:
52-
cache: "pnpm"
53-
cache-dependency-path: "**/pnpm-lock.yaml"
55+
# No pnpm cache -- correctness over speed for publish workflows
5456
node-version-file: ".nvmrc"
5557

5658
- name: Cache NX
57-
uses: actions/cache@v5
59+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
5860
with:
5961
path: .nx/cache
6062
key: nx-${{ env.NX_BRANCH }}-${{ env.NX_RUN_GROUP }}-${{ github.sha }}
6163
restore-keys: |
6264
nx-${{ env.NX_BRANCH }}-${{ env.NX_RUN_GROUP }}-
6365
nx-${{ env.NX_BRANCH }}-
6466
nx-
67+
lookup-only: true
6568

6669
- name: Install Dependencies & Build
6770
run: pnpm install && pnpm build

‎.github/workflows/relative-ci.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,24 @@
11
name: RelativeCI
22

33
on:
4+
# zizmor: ignore[dangerous-triggers] -- workflow_run is the recommended pattern
5+
# for RelativeCI; this workflow only downloads artifacts and reports bundle stats.
46
workflow_run:
57
workflows: ["build"]
68
types:
79
- completed
810

11+
permissions:
12+
actions: read
13+
contents: read
14+
915
jobs:
1016
build:
1117
runs-on: ubuntu-latest
18+
if: github.event.workflow_run.conclusion == 'success'
1219
steps:
1320
- name: Send bundle stats and build information to RelativeCI (editor)
14-
uses: relative-ci/agent-action@v2
21+
uses: relative-ci/agent-action@fcf45416581928e8dd62eded78ce98c78e5149f8 # v3.2.3
1522
with:
1623
artifactName: relative-ci-artifacts-editor
1724
key: ${{ secrets.RELATIVE_CI_KEY }}

‎.github/workflows/zizmor.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: GitHub Actions Security Analysis with zizmor
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions: {}
10+
11+
jobs:
12+
zizmor:
13+
name: Run zizmor
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
contents: read
18+
actions: read
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run zizmor
26+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

0 commit comments

Comments
 (0)