Skip to content

Commit 04d922f

Browse files
setchysetchy
authored
feat(actions): add zizmor and actionlint#636 (#2763)
* fix(actions): zizmor fixes Signed-off-by: Adam Setch <adam.setch@outlook.com> * feat: add zizmor and actionlint Signed-off-by: Adam Setch <adam.setch@outlook.com> * feat: add zizmor and actionlint Signed-off-by: Adam Setch <adam.setch@outlook.com> --------- Signed-off-by: Adam Setch <adam.setch@outlook.com>
1 parent a58a56e commit 04d922f

File tree

12 files changed

+185
-48
lines changed

12 files changed

+185
-48
lines changed

‎.github/workflows/build.yml‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,26 @@ name: Build
22

33
on:
44
workflow_call:
5+
secrets:
6+
OAUTH_CLIENT_ID:
7+
required: true
8+
# Signing certificates
9+
CSC_LINK:
10+
required: true
11+
WIN_CSC_LINK:
12+
required: true
13+
CSC_KEY_PASSWORD:
14+
required: true
15+
WIN_CSC_KEY_PASSWORD:
16+
required: true
517

6-
permissions:
7-
contents: read
18+
permissions: {}
819

920
jobs:
1021
build:
11-
name: Build ${{ matrix.platform }} (electron-builder)
22+
name: Build ${{ matrix.platform }} [electron-builder]
23+
permissions:
24+
contents: read
1225
strategy:
1326
matrix:
1427
include:
@@ -32,6 +45,8 @@ jobs:
3245
steps:
3346
- name: Checkout
3447
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
48+
with:
49+
persist-credentials: false
3550

3651
- name: Setup Node.js
3752
uses: ./.github/actions/setup-node

‎.github/workflows/ci.yml‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,30 +8,45 @@ on:
88
branches:
99
- main
1010

11-
permissions:
12-
contents: read
11+
permissions: {}
1312

1413
jobs:
1514
prepare: # macOS code-signing only works on `push` events and not `pull_request` events
1615
if: ${{ !startsWith(github.head_ref, 'release/v') }}
1716
name: Prepare CI
1817
runs-on: ubuntu-latest
18+
permissions: {}
1919
steps:
20-
- run: echo Running CI for branch ${{ github.head_ref }}
20+
- run: echo "Running CI for branch ${GITHUB_HEAD_REF}"
21+
env:
22+
GITHUB_HEAD_REF: ${{ github.head_ref }}
2123

2224
lint:
2325
name: Lint App
2426
uses: ./.github/workflows/lint.yml
2527
needs: prepare
28+
permissions:
29+
contents: read
2630

2731
tests:
2832
name: Tests
2933
uses: ./.github/workflows/test.yml
3034
needs: lint
31-
secrets: inherit
35+
permissions:
36+
contents: read
37+
secrets:
38+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
3239

3340
build:
3441
name: Build
3542
uses: ./.github/workflows/build.yml
3643
needs: tests
37-
secrets: inherit
44+
permissions:
45+
contents: read
46+
secrets:
47+
OAUTH_CLIENT_ID: ${{ secrets.OAUTH_CLIENT_ID }}
48+
# Signing certificates
49+
CSC_LINK: ${{ secrets.CSC_LINK }}
50+
WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
51+
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
52+
WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}

‎.github/workflows/lint.yml‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,39 @@ name: Lint
33
on:
44
workflow_call:
55

6-
permissions:
7-
contents: read
6+
permissions: {}
87

98
jobs:
10-
lint:
11-
name: biomejs
9+
lint-code:
10+
name: Lint Code [biomejs]
1211
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
1314

1415
steps:
1516
- name: Checkout
1617
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
18+
with:
19+
persist-credentials: false
1720

1821
- name: Setup Node.js
1922
uses: ./.github/actions/setup-node
2023

2124
- name: Run linter
2225
run: pnpm lint:check
26+
27+
lint-actions:
28+
name: Lint GitHub Actions [actionlint]
29+
runs-on: ubuntu-latest
30+
permissions:
31+
contents: read
32+
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
36+
with:
37+
persist-credentials: false
38+
sparse-checkout: .github/
39+
40+
- name: GitHub Actions linter
41+
uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667

‎.github/workflows/milestone.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,28 +7,31 @@ on:
77
types:
88
- closed
99

10-
permissions:
11-
pull-requests: write
10+
permissions: {}
1211

1312
jobs:
1413
add-milestone:
1514
if: github.event.pull_request.merged == true
1615
runs-on: ubuntu-latest
16+
permissions:
17+
pull-requests: write
1718
steps:
18-
- name: Authenticate GitHub CLI
19-
run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
20-
2119
- name: Get open milestone
2220
id: milestone
2321
run: |
2422
milestone=$(gh api repos/${{ github.repository }}/milestones \
2523
--jq '.[] | select(.state=="open") | .title' | head -n 1)
2624
echo "Found milestone: $milestone"
27-
echo "milestone=$milestone" >> $GITHUB_OUTPUT
25+
echo "milestone=$milestone" >> "$GITHUB_OUTPUT"
26+
env:
27+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2828

2929
- name: Add milestone to PR
3030
if: steps.milestone.outputs.milestone != ''
3131
run: |
3232
gh pr edit ${{ github.event.pull_request.number }} \
3333
--repo ${{ github.repository }} \
34-
--milestone "${{ steps.milestone.outputs.milestone }}"
34+
--milestone "${STEPS_MILESTONE_OUTPUTS_MILESTONE}"
35+
env:
36+
STEPS_MILESTONE_OUTPUTS_MILESTONE: ${{ steps.milestone.outputs.milestone }}
37+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/publish.yml‎

Lines changed: 40 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,42 +2,68 @@ name: Publish
22

33
on:
44
workflow_call:
5+
secrets:
6+
OAUTH_CLIENT_ID:
7+
required: true
8+
# Signing certificates
9+
CSC_LINK:
10+
required: true
11+
WIN_CSC_LINK:
12+
required: true
13+
CSC_KEY_PASSWORD:
14+
required: true
15+
WIN_CSC_KEY_PASSWORD:
16+
required: true
17+
# macOS specific
18+
APPLE_ID_USERNAME:
19+
required: true
20+
APPLE_ID_PASSWORD:
21+
required: true
22+
APPLE_ID_TEAM_ID:
23+
required: true
524
workflow_dispatch: # For manually running release process to verify code-signing of artifacts
625

7-
permissions:
8-
contents: write
26+
permissions: {}
927

1028
jobs:
1129
prepare:
1230
name: Prepare draft release
1331
runs-on: ubuntu-latest
32+
permissions:
33+
contents: write
1434
steps:
1535
- name: Checkout
1636
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
37+
with:
38+
persist-credentials: false
1739

1840
- name: Parse release branch
1941
if: startsWith(github.ref, 'refs/heads/release/')
2042
run: |
2143
# Extract the branch name (e.g. release/v1.2.3[-meta])
2244
ref=${GITHUB_REF#refs/heads/}
23-
echo "RELEASE_BRANCH=$ref" >> $GITHUB_ENV
45+
echo "RELEASE_BRANCH=$ref" >> "$GITHUB_ENV"
2446
# Also export a RELEASE_TAG by removing the `release/` prefix (keeps leading 'v')
2547
tag=${ref#release/}
26-
echo "RELEASE_TAG=$tag" >> $GITHUB_ENV
48+
echo "RELEASE_TAG=$tag" >> "$GITHUB_ENV"
2749
shell: bash
2850

2951
- name: Create draft release
30-
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
31-
with:
32-
name: "${{ env.RELEASE_TAG }}"
33-
tag_name: "${{ env.RELEASE_TAG }}"
34-
draft: true
35-
body: '# <img src="https://github.com/gitify-app/gitify/blob/3554605d32a6c08a3d4ec17b02b90e2dd276a152/assets/images/tray-active%402x.png" /> Gitify ${{ env.RELEASE_TAG }}'
36-
generate_release_notes: true
52+
run: |
53+
gh release create "${RELEASE_TAG}" \
54+
--title "${RELEASE_TAG}" \
55+
--draft \
56+
--notes "# <img src=\"https://github.com/gitify-app/gitify/blob/3554605d32a6c08a3d4ec17b02b90e2dd276a152/assets/images/tray-active%402x.png\" /> Gitify ${RELEASE_TAG}" \
57+
--generate-notes
58+
env:
59+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
60+
RELEASE_TAG: ${{ env.RELEASE_TAG }}
3761

3862
release:
39-
name: Publish ${{ matrix.platform }} (electron-builder)
63+
name: Publish ${{ matrix.platform }} [electron-builder]
4064
needs: prepare
65+
permissions:
66+
contents: write
4167
strategy:
4268
matrix:
4369
include:
@@ -61,6 +87,8 @@ jobs:
6187
steps:
6288
- name: Checkout
6389
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
90+
with:
91+
persist-credentials: false
6492

6593
- name: Setup Node.js
6694
uses: ./.github/actions/setup-node

‎.github/workflows/release.yml‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,38 @@ on:
55
branches:
66
- release/v*.*.* # macOS code-signing only works on `push` events and not `pull_request` events
77

8-
permissions:
9-
contents: read
8+
permissions: {}
109

1110
jobs:
1211
lint:
1312
name: Lint App
1413
uses: ./.github/workflows/lint.yml
14+
permissions:
15+
contents: read
1516

1617
tests:
1718
name: Tests
1819
uses: ./.github/workflows/test.yml
1920
needs: lint
20-
secrets: inherit
21+
permissions:
22+
contents: read
23+
secrets:
24+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2125

2226
publish:
2327
name: Publish
2428
uses: ./.github/workflows/publish.yml
2529
needs: tests
26-
secrets: inherit
2730
permissions:
2831
contents: write
32+
secrets:
33+
OAUTH_CLIENT_ID: ${{ secrets.OAUTH_CLIENT_ID }}
34+
# Signing certificates
35+
CSC_LINK: ${{ secrets.CSC_LINK }}
36+
WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
37+
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
38+
WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
39+
# macOS specific
40+
APPLE_ID_USERNAME: ${{ secrets.APPLE_ID_USERNAME }}
41+
APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
42+
APPLE_ID_TEAM_ID: ${{ secrets.APPLE_ID_TEAM_ID }}

‎.github/workflows/renovate.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@ on:
1010
paths:
1111
- renovate.json
1212

13-
permissions:
14-
contents: read
13+
permissions: {}
1514

1615
jobs:
1716
renovate-config-validator:
@@ -20,6 +19,9 @@ jobs:
2019
steps:
2120
- name: Checkout
2221
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
sparse-checkout: renovate.json
2325

2426
- uses: ./.github/actions/setup-node
2527
with:

‎.github/workflows/test.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,24 @@ name: Test
22

33
on:
44
workflow_call:
5+
secrets:
6+
SONAR_TOKEN:
7+
required: true
58

6-
permissions:
7-
contents: read
9+
permissions: {}
810

911
jobs:
1012
run-unit-tests:
1113
name: Run Tests
1214
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
1317

1418
steps:
1519
- name: Checkout
1620
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21+
with:
22+
persist-credentials: false
1723

1824
- name: Setup Node.js
1925
uses: ./.github/actions/setup-node
@@ -34,6 +40,8 @@ jobs:
3440
name: SonarQube Cloud Analysis
3541
runs-on: ubuntu-latest
3642
needs: run-unit-tests
43+
permissions:
44+
contents: read
3745
# Only analyze PRs from the same repository. Limitation of SonarQube Cloud
3846
if: github.event.pull_request.head.repo.fork == false
3947

@@ -42,6 +50,7 @@ jobs:
4250
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4351
with:
4452
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
53+
persist-credentials: false
4554

4655
- name: Setup Node.js
4756
uses: ./.github/actions/setup-node

0 commit comments

Comments
 (0)