Skip to content

Commit c7fbc09

Browse files
lidavidmlidavidm
committed
ci: analyze workflows with zizmor
1 parent 6f5b5fc commit c7fbc09

18 files changed

Lines changed: 277 additions & 196 deletions

‎.github/dependabot.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ updates:
2121
directory: "/"
2222
schedule:
2323
interval: "weekly"
24+
cooldown:
25+
default-days: 7
2426
commit-message:
2527
prefix: "chore: "
2628
groups:
@@ -43,6 +45,8 @@ updates:
4345
patterns:
4446
- "go.opentelemetry.io/otel"
4547
- "go.opentelemetry.io/otel/*"
48+
cooldown:
49+
default-days: 7
4650
- package-ecosystem: "maven"
4751
directory: "/java/"
4852
schedule:
@@ -59,6 +63,8 @@ updates:
5963
- "dep.org.checkerframework*"
6064
- "org.checkerframework:*"
6165
- "org.junit:*"
66+
cooldown:
67+
default-days: 7
6268
- package-ecosystem: "nuget"
6369
directory: "/csharp/"
6470
schedule:
@@ -75,6 +81,8 @@ updates:
7581
- dependency-name: "System.*"
7682
update-types:
7783
- "version-update:semver-major"
84+
cooldown:
85+
default-days: 7
7886
- package-ecosystem: "cargo"
7987
directory: "/rust/"
8088
schedule:
@@ -87,3 +95,5 @@ updates:
8795
patterns:
8896
- "arrow-*"
8997
- "datafusion*"
98+
cooldown:
99+
default-days: 7

‎.github/workflows/asf-allowlist-check.yml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
# under the License.
1717

1818
# See https://github.com/apache/iceberg/blob/main/.github/workflows/asf-allowlist-check.yml
19-
name: "Check actions are on ASF allowlist"
19+
name: "GitHub Actions Checks"
2020

2121
on:
2222
pull_request:
@@ -28,15 +28,28 @@ on:
2828
paths:
2929
- ".github/**"
3030

31+
concurrency:
32+
group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
33+
cancel-in-progress: true
34+
3135
permissions:
3236
contents: read
3337

3438
jobs:
35-
asf-allowlist-check:
39+
gha:
40+
name: "Analyze Actions"
3641
runs-on: ubuntu-slim
3742
steps:
3843
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3944
with:
4045
persist-credentials: false
46+
47+
# Check that actions are pinned and on the ASF allowlist.
4148
# Intentionally unpinned to always use the latest allowlist from the ASF.
4249
- uses: apache/infrastructure-actions/allowlist-check@main # zizmor: ignore[unpinned-uses]
50+
51+
# Analyze workflows with Zizmor
52+
- name: Run zizmor 🌈
53+
uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
54+
with:
55+
advanced-security: false

‎.github/workflows/comment_bot.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,14 @@ on:
2424
- created
2525
- edited
2626

27+
permissions:
28+
contents: read
29+
2730
jobs:
2831
issue_assign:
2932
name: "Assign issue"
3033
permissions:
31-
issues: write
34+
issues: write # needed to comment on the issue
3235
if: github.event.comment.body == 'take'
3336
runs-on: ubuntu-latest
3437
steps:

‎.github/workflows/csharp.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,15 @@ jobs:
5454
os: [ubuntu-latest, windows-2022, macos-15-intel, macos-latest]
5555
steps:
5656
- name: Install C#
57-
uses: actions/setup-dotnet@v5
57+
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
5858
with:
5959
dotnet-version: ${{ matrix.dotnet }}
6060
- name: Checkout ADBC
61-
uses: actions/checkout@v6
61+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6262
with:
6363
fetch-depth: 0
6464
submodules: recursive
65+
persist-credentials: false
6566
- name: Build
6667
shell: bash
6768
run: ci/scripts/csharp_build.sh $(pwd)
@@ -84,12 +85,13 @@ jobs:
8485
timeout-minutes: 30
8586
steps:
8687
- name: Checkout ADBC
87-
uses: actions/checkout@v6
88+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8889
with:
8990
fetch-depth: 0
9091
submodules: recursive
92+
persist-credentials: false
9193
- name: Install .NET 10
92-
uses: actions/setup-dotnet@v5
94+
uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
9395
with:
9496
# NativeAOT for our producer requires net10. Using 10.0.x selects
9597
# the latest available SDK; preview tags may be needed until GA.
@@ -107,7 +109,7 @@ jobs:
107109
csharp/src/Drivers/Apache/Apache.Arrow.Adbc.Drivers.Apache.Native/Apache.Arrow.Adbc.Drivers.Apache.Native.csproj \
108110
-c Release -r win-x64
109111
- name: Install Python
110-
uses: actions/setup-python@v5
112+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
111113
with:
112114
python-version: '3.11'
113115
- name: Install Python dependencies

‎.github/workflows/dev.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
if: github.event_name == 'pull_request'
4848
runs-on: ubuntu-slim
4949
steps:
50-
- uses: actions/checkout@v6
50+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5151
with:
5252
fetch-depth: 1
5353
persist-credentials: false
@@ -73,25 +73,25 @@ jobs:
7373
name: "pre-commit"
7474
runs-on: ubuntu-latest
7575
steps:
76-
- uses: actions/checkout@v6
76+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7777
with:
7878
fetch-depth: 1
7979
persist-credentials: false
8080
- name: Get required Go version
8181
run: |
8282
(. .env && echo "GO_VERSION=${GO}") >> $GITHUB_ENV
83-
- uses: actions/setup-go@v6
83+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
8484
with:
8585
go-version: "${{ env.GO_VERSION }}"
8686
check-latest: true
87-
- uses: actions/setup-python@v6
87+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
8888
with:
8989
python-version: '3.x'
9090
- name: install golangci-lint
9191
run: |
9292
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.49.0
9393
- name: pre-commit (cache)
94-
uses: actions/cache@v5
94+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
9595
with:
9696
path: ~/.cache/pre-commit
9797
key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}

‎.github/workflows/dev_adbc.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,13 @@ jobs:
4545
name: "pre-commit"
4646
runs-on: ubuntu-latest
4747
steps:
48-
- uses: actions/checkout@v6
48+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4949
with:
5050
fetch-depth: 0
5151
persist-credentials: false
5252

5353
- name: Cache Conda
54-
uses: actions/cache@v5
54+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
5555
with:
5656
path: ~/conda_pkgs_dir
5757
key: conda-${{ runner.os }}-${{ steps.get-date.outputs.today }}-${{ env.CACHE_NUMBER }}-${{ hashFiles('ci/**') }}

‎.github/workflows/integration.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
name: "DuckDB Integration Tests"
5858
runs-on: ubuntu-latest
5959
steps:
60-
- uses: actions/checkout@v6
60+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6161
with:
6262
fetch-depth: 0
6363
persist-credentials: false
@@ -66,7 +66,7 @@ jobs:
6666
run: |
6767
echo "today=$(/bin/date -u '+%Y%m%d')" >> $GITHUB_OUTPUT
6868
- name: Cache Conda
69-
uses: actions/cache/restore@v5
69+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
7070
with:
7171
path: ~/conda_pkgs_dir
7272
key: conda-${{ runner.os }}-${{ steps.get-date.outputs.today }}-${{ env.CACHE_NUMBER }}-${{ hashFiles('ci/**') }}
@@ -104,7 +104,7 @@ jobs:
104104
name: "FlightSQL Integration Tests (Dremio, SQLite, and GizmoSQL)"
105105
runs-on: ubuntu-latest
106106
steps:
107-
- uses: actions/checkout@v6
107+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
108108
with:
109109
fetch-depth: 0
110110
persist-credentials: false
@@ -116,7 +116,7 @@ jobs:
116116
run: |
117117
echo "today=$(/bin/date -u '+%Y%m%d')" >> $GITHUB_OUTPUT
118118
- name: Cache Conda
119-
uses: actions/cache/restore@v5
119+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
120120
with:
121121
path: ~/conda_pkgs_dir
122122
key: conda-${{ runner.os }}-${{ steps.get-date.outputs.today }}-${{ env.CACHE_NUMBER }}-${{ hashFiles('ci/**') }}
@@ -131,7 +131,7 @@ jobs:
131131
--file ci/conda_env_cpp.txt \
132132
--file ci/conda_env_python.txt
133133
pip install pytest-error-for-skips
134-
- uses: actions/setup-go@v6
134+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
135135
with:
136136
go-version: "${{ env.GO_VERSION }}"
137137
check-latest: true
@@ -181,7 +181,7 @@ jobs:
181181
# Preinstalled tools use a lot of disk space, free up some space
182182
# https://github.com/actions/runner-images/issues/2840
183183
sudo rm -rf "$AGENT_TOOLSDIRECTORY"
184-
- uses: actions/checkout@v6
184+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
185185
with:
186186
fetch-depth: 0
187187
persist-credentials: false
@@ -190,7 +190,7 @@ jobs:
190190
run: |
191191
echo "today=$(/bin/date -u '+%Y%m%d')" >> $GITHUB_OUTPUT
192192
- name: Cache Conda
193-
uses: actions/cache/restore@v5
193+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
194194
with:
195195
path: ~/conda_pkgs_dir
196196
key: conda-${{ runner.os }}-${{ steps.get-date.outputs.today }}-${{ env.CACHE_NUMBER }}-${{ hashFiles('ci/**') }}
@@ -289,7 +289,7 @@ jobs:
289289
name: "Snowflake Integration Tests"
290290
runs-on: ubuntu-latest
291291
steps:
292-
- uses: actions/checkout@v6
292+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
293293
with:
294294
fetch-depth: 0
295295
persist-credentials: false
@@ -301,7 +301,7 @@ jobs:
301301
run: |
302302
echo "today=$(/bin/date -u '+%Y%m%d')" >> $GITHUB_OUTPUT
303303
- name: Cache Conda
304-
uses: actions/cache/restore@v5
304+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
305305
with:
306306
path: ~/conda_pkgs_dir
307307
key: conda-${{ runner.os }}-${{ steps.get-date.outputs.today }}-${{ env.CACHE_NUMBER }}-${{ hashFiles('ci/**') }}
@@ -318,7 +318,7 @@ jobs:
318318
- name: Work around ASAN issue (GH-1617)
319319
run: |
320320
sudo sysctl vm.mmap_rnd_bits=28
321-
- uses: actions/setup-go@v6
321+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
322322
with:
323323
go-version: "${{ env.GO_VERSION }}"
324324
check-latest: true
@@ -346,14 +346,14 @@ jobs:
346346
name: "FlightSQL C# Interop"
347347
runs-on: ubuntu-latest
348348
steps:
349-
- uses: actions/checkout@v6
349+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
350350
with:
351351
fetch-depth: 0
352352
persist-credentials: false
353353
- name: Get required Go version
354354
run: |
355355
(. .env && echo "GO_VERSION=${GO}") >> $GITHUB_ENV
356-
- uses: actions/setup-go@v6
356+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
357357
with:
358358
go-version: "${{ env.GO_VERSION }}"
359359
check-latest: true

‎.github/workflows/java.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -50,12 +50,12 @@ jobs:
5050
matrix:
5151
java: ['11', '17', '21', '25']
5252
steps:
53-
- uses: actions/checkout@v6
53+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5454
with:
5555
fetch-depth: 0
5656
persist-credentials: false
5757
submodules: recursive
58-
- uses: actions/setup-java@v5
58+
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
5959
with:
6060
cache: "maven"
6161
distribution: "temurin"
@@ -76,12 +76,12 @@ jobs:
7676
matrix:
7777
java: ['21', '25']
7878
steps:
79-
- uses: actions/checkout@v6
79+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8080
with:
8181
fetch-depth: 0
8282
persist-credentials: false
8383
submodules: recursive
84-
- uses: actions/setup-java@v5
84+
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
8585
with:
8686
cache: "maven"
8787
distribution: "temurin"
@@ -116,11 +116,11 @@ jobs:
116116
env:
117117
VCPKG_ROOT: "${{ github.workspace }}/vcpkg"
118118
steps:
119-
- uses: actions/checkout@v6
119+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120120
with:
121121
fetch-depth: 0
122122
persist-credentials: false
123-
- uses: actions/setup-java@v5
123+
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
124124
with:
125125
cache: "maven"
126126
distribution: "temurin"
@@ -132,7 +132,7 @@ jobs:
132132
- name: Install vcpkg
133133
run: |
134134
./ci/scripts/install_vcpkg.sh $VCPKG_ROOT $VCPKG_VERSION
135-
- uses: actions/setup-go@v6
135+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
136136
with:
137137
go-version: "${{ env.GO_VERSION }}"
138138
check-latest: true
@@ -172,7 +172,7 @@ jobs:
172172
ls -laR artifacts
173173
mv artifacts artifacts-${{ matrix.os }}-${{ matrix.arch }}
174174
tar czf artifacts-${{ matrix.os }}-${{ matrix.arch }}.tgz artifacts-${{ matrix.os }}-${{ matrix.arch }}
175-
- uses: actions/upload-artifact@v7
175+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
176176
with:
177177
name: jni-artifacts-${{ matrix.os }}-${{ matrix.arch }}
178178
retention-days: 7
@@ -185,7 +185,7 @@ jobs:
185185
find "$VCPKG_ROOT" -name 'build-*.log' -exec cp '{}' ~/logs ';'
186186
- name: Upload failure logs
187187
if: failure()
188-
uses: actions/upload-artifact@v7
188+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
189189
with:
190190
name: jni-artifacts-${{ matrix.os }}-${{ matrix.arch }}
191191
retention-days: 7
@@ -204,17 +204,17 @@ jobs:
204204
- { java: '11', os: macOS, arch: arm64v8, vcpkg_arch: arm64, runner: macos-latest }
205205
- { java: '25', os: macOS, arch: arm64v8, vcpkg_arch: arm64, runner: macos-latest }
206206
steps:
207-
- uses: actions/checkout@v6
207+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
208208
with:
209209
fetch-depth: 0
210210
persist-credentials: false
211211
submodules: recursive
212-
- uses: actions/download-artifact@v8
212+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
213213
with:
214214
path: artifacts
215215
pattern: jni-artifacts-*
216216
merge-multiple: true
217-
- uses: actions/setup-java@v5
217+
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
218218
with:
219219
cache: "maven"
220220
distribution: "temurin"

0 commit comments

Comments
 (0)