Skip to content

Commit 0ff73c2

Browse files
morganchen12morganchen12
committed
fix zizmor findings
1 parent 7781a66 commit 0ff73c2

3 files changed

Lines changed: 63 additions & 31 deletions

File tree

‎.github/workflows/agent-evals.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,11 @@ jobs:
2626
env:
2727
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
2828
steps:
29-
- uses: actions/checkout@v4
30-
- uses: actions/setup-node@v3
29+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
30+
with:
31+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
32+
persist-credentials: true # zizmor: ignore[artipacked]
33+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
3134
with:
3235
node-version: ${{ matrix.node-version }}
3336
cache: npm

‎.github/workflows/functions.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,15 @@ jobs:
2323
deploy:
2424
runs-on: ubuntu-latest
2525
steps:
26-
- uses: actions/checkout@v3
27-
- uses: actions/setup-node@v3
26+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
27+
with:
28+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
29+
persist-credentials: true # zizmor: ignore[artipacked]
30+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
2831
with:
2932
node-version: "24"
3033

31-
- uses: google-github-actions/auth@v0
34+
- uses: google-github-actions/auth@09cecabe1f169596b81c2ef22b40faff87acc460 # ratchet:google-github-actions/auth@v0
3235
with:
3336
credentials_json: "${{ secrets.CF3_INTEGRATION_TEST_GOOGLE_CREDENTIALS }}"
3437
create_credentials_file: true

‎.github/workflows/node-test.yml‎

Lines changed: 52 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,12 @@ jobs:
2929
node-version:
3030
- "24"
3131
steps:
32-
- uses: actions/checkout@v4
32+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
3333
with:
3434
fetch-depth: 0
35-
- uses: actions/setup-node@v3
35+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
36+
persist-credentials: true # zizmor: ignore[artipacked]
37+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
3638
with:
3739
node-version: ${{ matrix.node-version }}
3840
cache: npm
@@ -52,8 +54,11 @@ jobs:
5254
- "22"
5355
- "24"
5456
steps:
55-
- uses: actions/checkout@v4
56-
- uses: actions/setup-node@v3
57+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
58+
with:
59+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
60+
persist-credentials: true # zizmor: ignore[artipacked]
61+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
5762
with:
5863
node-version: ${{ matrix.node-version }}
5964
cache: npm
@@ -67,7 +72,7 @@ jobs:
6772
working-directory: firebase-vscode
6873
- run: npm run test:unit
6974
working-directory: firebase-vscode
70-
- uses: codecov/codecov-action@v5
75+
- uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # ratchet:codecov/codecov-action@v5
7176
if: matrix.node-version == '24'
7277

7378
# vscode_integration:
@@ -135,8 +140,11 @@ jobs:
135140
node-version:
136141
- "24"
137142
steps:
138-
- uses: actions/checkout@v4
139-
- uses: actions/setup-node@v3
143+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
144+
with:
145+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
146+
persist-credentials: true # zizmor: ignore[artipacked]
147+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
140148
with:
141149
node-version: ${{ matrix.node-version }}
142150
cache: npm
@@ -157,15 +165,18 @@ jobs:
157165
- "22"
158166
- "24"
159167
steps:
160-
- uses: actions/checkout@v4
161-
- uses: actions/setup-node@v3
168+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
169+
with:
170+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
171+
persist-credentials: true # zizmor: ignore[artipacked]
172+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
162173
with:
163174
node-version: ${{ matrix.node-version }}
164175
cache: npm
165176
cache-dependency-path: npm-shrinkwrap.json
166177

167178
- name: Cache ESLint
168-
uses: actions/cache@v4
179+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # ratchet:actions/cache@v4
169180
with:
170181
path: .eslintcache
171182
key: eslint-${{ runner.os }}-node${{ matrix.node-version }}-${{ hashFiles('**/*.ts', '**/*.js') }}
@@ -176,7 +187,7 @@ jobs:
176187
- run: npm ci
177188
- run: npm test -- -- --forbid-only
178189

179-
- uses: codecov/codecov-action@v5
190+
- uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # ratchet:codecov/codecov-action@v5
180191
if: matrix.node-version == '24'
181192
with:
182193
files: ./.coverage/lcov.info
@@ -218,24 +229,27 @@ jobs:
218229
- node-version: "22"
219230
script: "npm run test:storage-emulator-integration"
220231
steps:
221-
- uses: actions/checkout@v4
222-
- uses: actions/setup-node@v3
232+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
233+
with:
234+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
235+
persist-credentials: true # zizmor: ignore[artipacked]
236+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
223237
with:
224238
node-version: ${{ matrix.node-version }}
225239
cache: npm
226240
cache-dependency-path: npm-shrinkwrap.json
227241
- name: Setup Java JDK
228-
uses: actions/setup-java@v3.3.0
242+
uses: actions/setup-java@860f60056505705214d223b91ed7a30f173f6142 # ratchet:actions/setup-java@v3.3.0
229243
with:
230244
java-version: 21
231245
distribution: temurin
232246
- name: Setup Chrome
233-
uses: browser-actions/setup-chrome@v1.7.2
247+
uses: browser-actions/setup-chrome@facf10a55b9caf92e0cc749b4f82bf8220989148 # ratchet:browser-actions/setup-chrome@v1.7.2
234248
with:
235249
install-dependencies: true
236250
install-chromedriver: true
237251
- name: Cache firebase emulators
238-
uses: actions/cache@v3
252+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
239253
with:
240254
path: ${{ env.FIREBASE_EMULATORS_PATH }}
241255
key: ${{ runner.os }}-firebase-emulators-${{ hashFiles('emulator-cache/**') }}
@@ -288,20 +302,23 @@ jobs:
288302
script: "npm run test:functions-discover"
289303
steps:
290304
- name: Setup Java JDK
291-
uses: actions/setup-java@v3.3.0
305+
uses: actions/setup-java@860f60056505705214d223b91ed7a30f173f6142 # ratchet:actions/setup-java@v3.3.0
292306
with:
293307
java-version: 21
294308
distribution: temurin
295309

296-
- uses: actions/checkout@v4
297-
- uses: actions/setup-node@v3
310+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
311+
with:
312+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
313+
persist-credentials: true # zizmor: ignore[artipacked]
314+
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
298315
with:
299316
node-version: ${{ matrix.node-version }}
300317
cache: npm
301318
cache-dependency-path: npm-shrinkwrap.json
302319

303320
- name: Cache firebase emulators
304-
uses: actions/cache@v3
321+
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # ratchet:actions/cache@v3
305322
with:
306323
path: ${{ env.FIREBASE_EMULATORS_PATH }}
307324
key: ${{ runner.os }}-firebase-emulators-${{ hashFiles('emulator-cache/**') }}
@@ -325,9 +342,12 @@ jobs:
325342
- "24"
326343

327344
steps:
328-
- uses: actions/checkout@v4
345+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
346+
with:
347+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
348+
persist-credentials: true # zizmor: ignore[artipacked]
329349
- name: Use Node.js ${{ matrix.node-version }}
330-
uses: actions/setup-node@v3
350+
uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
331351
with:
332352
node-version: ${{ matrix.node-version }}
333353
- run: npm i -g npm@11.9
@@ -344,9 +364,12 @@ jobs:
344364
- "24"
345365

346366
steps:
347-
- uses: actions/checkout@v4
367+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
368+
with:
369+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
370+
persist-credentials: true # zizmor: ignore[artipacked]
348371
- name: Use Node.js ${{ matrix.node-version }}
349-
uses: actions/setup-node@v3
372+
uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
350373
with:
351374
node-version: ${{ matrix.node-version }}
352375
- run: npm i -g npm@11.9
@@ -363,9 +386,12 @@ jobs:
363386
- "24"
364387

365388
steps:
366-
- uses: actions/checkout@v4
389+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
390+
with:
391+
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
392+
persist-credentials: true # zizmor: ignore[artipacked]
367393
- name: Use Node.js ${{ matrix.node-version }}
368-
uses: actions/setup-node@v3
394+
uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # ratchet:actions/setup-node@v3
369395
with:
370396
node-version: ${{ matrix.node-version }}
371397
cache: npm

0 commit comments

Comments
 (0)