Skip to content

Commit 5f95694

Browse files
aagbotemiaagbotemi
authored
ci: add zizmor github actions security analysis workflow
1 parent 94e437f commit 5f95694

12 files changed

Lines changed: 102 additions & 2 deletions

‎.github/workflows/audit.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ jobs:
1818
steps:
1919
- name: "Check out PR branch"
2020
uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
2123

2224
- name: "Run audit"
2325
run: |

‎.github/workflows/cont_integration.yml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ on:
77
paths:
88
- "bdk-ffi/**"
99

10+
permissions: {}
11+
1012
jobs:
1113
build-test:
1214
name: "Build and test"
@@ -22,9 +24,14 @@ jobs:
2224
steps:
2325
- name: "Checkout"
2426
uses: actions/checkout@v4
27+
with:
28+
persist-credentials: false
2529

2630
- name: "Generate cache key"
27-
run: echo "${{ matrix.rust.version }} ${{ matrix.features }}" | tee .cache_key
31+
env:
32+
MATRIX_RUST_VERSION: ${{ matrix.rust.version }}
33+
MATRIX_FEATURES: ${{ matrix.features }}
34+
run: echo "$MATRIX_RUST_VERSION $MATRIX_FEATURES" | tee .cache_key
2835

2936
- name: "Cache"
3037
uses: actions/cache@v3
@@ -36,7 +43,9 @@ jobs:
3643
key: ${{ runner.os }}-cargo-${{ hashFiles('.cache_key') }}-${{ hashFiles('**/Cargo.toml','**/Cargo.lock') }}
3744

3845
- name: "Set default toolchain"
39-
run: rustup default ${{ matrix.rust.version }}
46+
env:
47+
MATRIX_RUST_VERSION: ${{ matrix.rust.version }}
48+
run: rustup default $MATRIX_RUST_VERSION
4049

4150
- name: "Set profile"
4251
run: rustup set profile minimal
@@ -67,6 +76,8 @@ jobs:
6776
steps:
6877
- name: "Checkout"
6978
uses: actions/checkout@v4
79+
with:
80+
persist-credentials: false
7081

7182
- name: "Set default toolchain"
7283
run: rustup default nightly

‎.github/workflows/kotlin-api-docs.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,16 @@ name: Build JVM and Android API Docs Websites
22

33
on: workflow_dispatch
44

5+
permissions: {}
6+
57
jobs:
68
deploy:
79
runs-on: ubuntu-24.04
810
steps:
911
- name: "Checkout"
1012
uses: actions/checkout@v3
13+
with:
14+
persist-credentials: false
1115

1216
- name: "Set up JDK 17"
1317
uses: actions/setup-java@v2

‎.github/workflows/live-tests.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,17 @@ on:
44
schedule:
55
- cron: '0 0 * * 0' # Once per week
66

7+
permissions: {}
8+
79
jobs:
810
jvm-tests:
911
name: "Build and test JVM library on Linux"
1012
runs-on: ubuntu-24.04
1113
steps:
1214
- name: "Checkout publishing branch"
1315
uses: actions/checkout@v4
16+
with:
17+
persist-credentials: false
1418

1519
- name: "Cache"
1620
uses: actions/cache@v3
@@ -42,6 +46,8 @@ jobs:
4246
steps:
4347
- name: "Checkout"
4448
uses: actions/checkout@v4
49+
with:
50+
persist-credentials: false
4551

4652
- name: "Build Swift package"
4753
working-directory: bdk-swift
@@ -71,6 +77,7 @@ jobs:
7177
uses: actions/checkout@v4
7278
with:
7379
submodules: true
80+
persist-credentials: false
7481

7582
- name: "Install Rust 1.84.1"
7683
uses: actions-rs/toolchain@v1

‎.github/workflows/publish-android.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,16 @@ on: [workflow_dispatch]
33

44
# The default Android NDK on the ubuntu-24.04 image is 25.2.9519653
55

6+
permissions: {}
7+
68
jobs:
79
build:
810
runs-on: ubuntu-24.04
911
steps:
1012
- name: "Check out PR branch"
1113
uses: actions/checkout@v4
14+
with:
15+
persist-credentials: false
1216

1317
- name: "Cache"
1418
uses: actions/cache@v3

‎.github/workflows/publish-jvm.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
name: Publish bdk-jvm to Maven Central
22
on: [workflow_dispatch]
33

4+
permissions: {}
5+
46
jobs:
57
build-macOS-native-libs:
68
name: "Create M1 and x86_64 native binaries"
79
runs-on: macos-14
810
steps:
911
- name: "Checkout publishing branch"
1012
uses: actions/checkout@v4
13+
with:
14+
persist-credentials: false
1115

1216
- name: "Cache"
1317
uses: actions/cache@v3
@@ -42,6 +46,8 @@ jobs:
4246
steps:
4347
- name: "Checkout publishing branch"
4448
uses: actions/checkout@v4
49+
with:
50+
persist-credentials: false
4551

4652
- name: "Set up JDK"
4753
uses: actions/setup-java@v4
@@ -67,6 +73,8 @@ jobs:
6773
steps:
6874
- name: "Checkout publishing branch"
6975
uses: actions/checkout@v4
76+
with:
77+
persist-credentials: false
7078

7179
- name: "Cache"
7280
uses: actions/cache@v3

‎.github/workflows/publish-python.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: Publish bdkpython to PyPI
22
on: [workflow_dispatch]
33

4+
permissions: {}
5+
46
jobs:
57
build-manylinux_2_28-x86_64-wheels:
68
name: "Build Manylinux 2.28 x86_64 wheel"
@@ -26,6 +28,7 @@ jobs:
2628
uses: actions/checkout@v4
2729
with:
2830
submodules: true
31+
persist-credentials: false
2932

3033
- name: "Install Rust 1.84.1"
3134
uses: actions-rs/toolchain@v1
@@ -64,6 +67,7 @@ jobs:
6467
uses: actions/checkout@v4
6568
with:
6669
submodules: true
70+
persist-credentials: false
6771

6872
- name: "Install Python"
6973
uses: actions/setup-python@v4
@@ -103,6 +107,7 @@ jobs:
103107
uses: actions/checkout@v4
104108
with:
105109
submodules: true
110+
persist-credentials: false
106111

107112
- name: "Install Python"
108113
uses: actions/setup-python@v4
@@ -141,6 +146,8 @@ jobs:
141146
uses: actions/checkout@v4
142147
with:
143148
submodules: true
149+
persist-credentials: false
150+
144151
- uses: actions/setup-python@v4
145152
with:
146153
python-version: ${{ matrix.python }}
@@ -167,6 +174,8 @@ jobs:
167174
steps:
168175
- name: "Checkout"
169176
uses: actions/checkout@v4
177+
with:
178+
persist-credentials: false
170179

171180
- name: "Download artifacts in dist/ directory"
172181
uses: actions/download-artifact@v4

‎.github/workflows/test-android.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ on:
1212

1313
# The default Android NDK on the ubuntu-24.04 image is 25.2.9519653
1414

15+
permissions: {}
16+
1517
jobs:
1618
build:
1719
runs-on: ubuntu-24.04
@@ -21,6 +23,8 @@ jobs:
2123

2224
- name: "Check out PR branch"
2325
uses: actions/checkout@v4
26+
with:
27+
persist-credentials: false
2428

2529
- name: "Cache"
2630
uses: actions/cache@v3

‎.github/workflows/test-jvm.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,16 @@ on:
1010
- "bdk-ffi/**"
1111
- "bdk-jvm/**"
1212

13+
permissions: {}
14+
1315
jobs:
1416
build:
1517
runs-on: ubuntu-24.04
1618
steps:
1719
- name: "Check out PR branch"
1820
uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
1923

2024
- name: "Cache"
2125
uses: actions/cache@v3

‎.github/workflows/test-python.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ on:
1010
- "bdk-ffi/**"
1111
- "bdk-python/**"
1212

13+
permissions: {}
14+
1315
jobs:
1416
build-manylinux_2_28-x86_64-wheels:
1517
name: "Build and test Manylinux 2.28 x86_64 wheels"
@@ -35,6 +37,7 @@ jobs:
3537
uses: actions/checkout@v4
3638
with:
3739
submodules: true
40+
persist-credentials: false
3841

3942
- name: "Install Rust 1.84.1"
4043
uses: actions-rs/toolchain@v1
@@ -80,6 +83,7 @@ jobs:
8083
uses: actions/checkout@v4
8184
with:
8285
submodules: true
86+
persist-credentials: false
8387

8488
- name: "Install Python"
8589
uses: actions/setup-python@v4
@@ -125,6 +129,8 @@ jobs:
125129
uses: actions/checkout@v4
126130
with:
127131
submodules: true
132+
persist-credentials: false
133+
128134
- uses: actions/setup-python@v4
129135
with:
130136
python-version: ${{ matrix.python }}
@@ -168,6 +174,7 @@ jobs:
168174
uses: actions/checkout@v4
169175
with:
170176
submodules: true
177+
persist-credentials: false
171178

172179
- name: "Install Python"
173180
uses: actions/setup-python@v4
@@ -204,6 +211,7 @@ jobs:
204211
uses: actions/checkout@v4
205212
with:
206213
submodules: true
214+
persist-credentials: false
207215

208216
- name: "Install Ruff"
209217
run: curl -LsSf https://astral.sh/ruff/install.sh | sh

0 commit comments

Comments
 (0)