Skip to content

Commit e600eab

Browse files
setchysetchy
committed
feat: add zizmor and actionlint
Signed-off-by: Adam Setch <adam.setch@outlook.com>
1 parent 3c0d09d commit e600eab

File tree

12 files changed

+167
-45
lines changed

12 files changed

+167
-45
lines changed

‎.github/workflows/build.yml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,26 @@ name: Build
22

33
on:
44
workflow_call:
5+
secrets:
6+
OAUTH_CLIENT_ID:
7+
required: true
8+
# Signing certificates
9+
CSC_LINK:
10+
required: true
11+
WIN_CSC_LINK:
12+
required: true
13+
CSC_KEY_PASSWORD:
14+
required: true
15+
WIN_CSC_KEY_PASSWORD:
16+
required: true
517

6-
permissions:
7-
contents: read
18+
permissions: {}
819

920
jobs:
1021
build:
11-
name: Build ${{ matrix.platform }} (electron-builder)
22+
name: Build ${{ matrix.platform }} [electron-builder]
23+
permissions:
24+
contents: read
1225
strategy:
1326
matrix:
1427
include:

‎.github/workflows/ci.yml‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,30 +8,45 @@ on:
88
branches:
99
- main
1010

11-
permissions:
12-
contents: read
11+
permissions: {}
1312

1413
jobs:
1514
prepare: # macOS code-signing only works on `push` events and not `pull_request` events
1615
if: ${{ !startsWith(github.head_ref, 'release/v') }}
1716
name: Prepare CI
1817
runs-on: ubuntu-latest
18+
permissions: {}
1919
steps:
20-
- run: echo Running CI for branch ${{ github.head_ref }}
20+
- run: echo "Running CI for branch ${GITHUB_HEAD_REF}"
21+
env:
22+
GITHUB_HEAD_REF: ${{ github.head_ref }}
2123

2224
lint:
2325
name: Lint App
2426
uses: ./.github/workflows/lint.yml
2527
needs: prepare
28+
permissions:
29+
contents: read
2630

2731
tests:
2832
name: Tests
2933
uses: ./.github/workflows/test.yml
3034
needs: lint
31-
secrets: inherit
35+
permissions:
36+
contents: read
37+
secrets:
38+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
3239

3340
build:
3441
name: Build
3542
uses: ./.github/workflows/build.yml
3643
needs: tests
37-
secrets: inherit
44+
permissions:
45+
contents: read
46+
secrets:
47+
OAUTH_CLIENT_ID: ${{ secrets.OAUTH_CLIENT_ID }}
48+
# Signing certificates
49+
CSC_LINK: ${{ secrets.CSC_LINK }}
50+
WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
51+
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
52+
WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}

‎.github/workflows/lint.yml‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,14 @@ name: Lint
33
on:
44
workflow_call:
55

6-
permissions:
7-
contents: read
6+
permissions: {}
87

98
jobs:
10-
lint:
11-
name: biomejs
9+
lint-code:
10+
name: Lint Code [biomejs]
1211
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
1314

1415
steps:
1516
- name: Checkout
@@ -22,3 +23,19 @@ jobs:
2223

2324
- name: Run linter
2425
run: pnpm lint:check
26+
27+
lint-actions:
28+
name: Lint GitHub Actions [actionlint]
29+
runs-on: ubuntu-latest
30+
permissions:
31+
contents: read
32+
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
36+
with:
37+
persist-credentials: false
38+
sparse-checkout: .github/
39+
40+
- name: GitHub Actions linter
41+
uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667

‎.github/workflows/milestone.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,24 +7,24 @@ on:
77
types:
88
- closed
99

10-
permissions:
11-
pull-requests: write
10+
permissions: {}
1211

1312
jobs:
1413
add-milestone:
1514
if: github.event.pull_request.merged == true
1615
runs-on: ubuntu-latest
16+
permissions:
17+
pull-requests: write
1718
steps:
18-
- name: Authenticate GitHub CLI
19-
run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
20-
2119
- name: Get open milestone
2220
id: milestone
2321
run: |
2422
milestone=$(gh api repos/${{ github.repository }}/milestones \
2523
--jq '.[] | select(.state=="open") | .title' | head -n 1)
2624
echo "Found milestone: $milestone"
27-
echo "milestone=$milestone" >> $GITHUB_OUTPUT
25+
echo "milestone=$milestone" >> "$GITHUB_OUTPUT"
26+
env:
27+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2828

2929
- name: Add milestone to PR
3030
if: steps.milestone.outputs.milestone != ''
@@ -34,3 +34,4 @@ jobs:
3434
--milestone "${STEPS_MILESTONE_OUTPUTS_MILESTONE}"
3535
env:
3636
STEPS_MILESTONE_OUTPUTS_MILESTONE: ${{ steps.milestone.outputs.milestone }}
37+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/publish.yml‎

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,35 @@ name: Publish
22

33
on:
44
workflow_call:
5+
secrets:
6+
OAUTH_CLIENT_ID:
7+
required: true
8+
# Signing certificates
9+
CSC_LINK:
10+
required: true
11+
WIN_CSC_LINK:
12+
required: true
13+
CSC_KEY_PASSWORD:
14+
required: true
15+
WIN_CSC_KEY_PASSWORD:
16+
required: true
17+
# macOS specific
18+
APPLE_ID_USERNAME:
19+
required: true
20+
APPLE_ID_PASSWORD:
21+
required: true
22+
APPLE_ID_TEAM_ID:
23+
required: true
524
workflow_dispatch: # For manually running release process to verify code-signing of artifacts
625

7-
permissions:
8-
contents: write
26+
permissions: {}
927

1028
jobs:
1129
prepare:
1230
name: Prepare draft release
1331
runs-on: ubuntu-latest
32+
permissions:
33+
contents: write
1434
steps:
1535
- name: Checkout
1636
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
@@ -29,17 +49,21 @@ jobs:
2949
shell: bash
3050

3151
- name: Create draft release
32-
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
33-
with:
34-
name: "${{ env.RELEASE_TAG }}"
35-
tag_name: "${{ env.RELEASE_TAG }}"
36-
draft: true
37-
body: '# <img src="https://github.com/gitify-app/gitify/blob/3554605d32a6c08a3d4ec17b02b90e2dd276a152/assets/images/tray-active%402x.png" /> Gitify ${{ env.RELEASE_TAG }}'
38-
generate_release_notes: true
52+
run: |
53+
gh release create "${RELEASE_TAG}" \
54+
--title "${RELEASE_TAG}" \
55+
--draft \
56+
--notes "# <img src="https://github.com/gitify-app/gitify/blob/3554605d32a6c08a3d4ec17b02b90e2dd276a152/assets/images/tray-active%402x.png" /> Gitify ${RELEASE_TAG}" \
57+
--generate-notes
58+
env:
59+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
60+
RELEASE_TAG: ${{ env.RELEASE_TAG }}
3961

4062
release:
41-
name: Publish ${{ matrix.platform }} (electron-builder)
63+
name: Publish ${{ matrix.platform }} [electron-builder]
4264
needs: prepare
65+
permissions:
66+
contents: write
4367
strategy:
4468
matrix:
4569
include:

‎.github/workflows/release.yml‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,38 @@ on:
55
branches:
66
- release/v*.*.* # macOS code-signing only works on `push` events and not `pull_request` events
77

8-
permissions:
9-
contents: read
8+
permissions: {}
109

1110
jobs:
1211
lint:
1312
name: Lint App
1413
uses: ./.github/workflows/lint.yml
14+
permissions:
15+
contents: read
1516

1617
tests:
1718
name: Tests
1819
uses: ./.github/workflows/test.yml
1920
needs: lint
20-
secrets: inherit
21+
permissions:
22+
contents: read
23+
secrets:
24+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2125

2226
publish:
2327
name: Publish
2428
uses: ./.github/workflows/publish.yml
2529
needs: tests
26-
secrets: inherit
2730
permissions:
2831
contents: write
32+
secrets:
33+
OAUTH_CLIENT_ID: ${{ secrets.OAUTH_CLIENT_ID }}
34+
# Signing certificates
35+
CSC_LINK: ${{ secrets.CSC_LINK }}
36+
WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
37+
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
38+
WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
39+
# macOS specific
40+
APPLE_ID_USERNAME: ${{ secrets.APPLE_ID_USERNAME }}
41+
APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
42+
APPLE_ID_TEAM_ID: ${{ secrets.APPLE_ID_TEAM_ID }}

‎.github/workflows/renovate.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@ on:
1010
paths:
1111
- renovate.json
1212

13-
permissions:
14-
contents: read
13+
permissions: {}
1514

1615
jobs:
1716
renovate-config-validator:
@@ -22,6 +21,7 @@ jobs:
2221
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2322
with:
2423
persist-credentials: false
24+
sparse-checkout: renovate.json
2525

2626
- uses: ./.github/actions/setup-node
2727
with:

‎.github/workflows/test.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,18 @@ name: Test
22

33
on:
44
workflow_call:
5+
secrets:
6+
SONAR_TOKEN:
7+
required: true
58

6-
permissions:
7-
contents: read
9+
permissions: {}
810

911
jobs:
1012
run-unit-tests:
1113
name: Run Tests
1214
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
1317

1418
steps:
1519
- name: Checkout
@@ -36,6 +40,8 @@ jobs:
3640
name: SonarQube Cloud Analysis
3741
runs-on: ubuntu-latest
3842
needs: run-unit-tests
43+
permissions:
44+
contents: read
3945
# Only analyze PRs from the same repository. Limitation of SonarQube Cloud
4046
if: github.event.pull_request.head.repo.fork == false
4147

‎.github/workflows/triage.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Triage PR
22

33
on:
4-
pull_request_target:
4+
pull_request:
55
branches:
66
- main
77
types:
@@ -11,16 +11,14 @@ on:
1111
- synchronize
1212
- ready_for_review
1313

14-
permissions:
15-
contents: read # the config file
16-
pull-requests: write # for labeling pull requests (on: pull_request_target or on: pull_request)
17-
statuses: write # to generate status
18-
checks: write # to generate status
14+
permissions: {}
1915

2016
jobs:
2117
pr-title:
2218
name: Validate PR title
2319
runs-on: ubuntu-latest
20+
permissions:
21+
pull-requests: read
2422
steps:
2523
- uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
2624
env:
@@ -29,5 +27,10 @@ jobs:
2927
pr-labeler:
3028
name: Auto-label PR
3129
runs-on: ubuntu-latest
30+
permissions:
31+
contents: read # the config file
32+
pull-requests: write # for labeling pull requests (on: pull_request_target or on: pull_request)
33+
statuses: write # to generate status
34+
checks: write # to generate status
3235
steps:
3336
- uses: fuxingloh/multi-labeler@b15a54460c38f54043fa75f7b08a0e2aa5b94b5b # v4.0.0

‎.github/workflows/website.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,12 @@ on:
66
types:
77
- published # For running on release publish
88

9-
permissions:
10-
contents: read
9+
permissions: {}
1110

1211
jobs:
1312
redeploy-website:
1413
name: Deploy Website
1514
runs-on: ubuntu-latest
15+
permissions: {}
1616
steps:
1717
- run: curl -X POST -d {} ${{ secrets.NETLIFY_BUILD_HOOK_URL }}

0 commit comments

Comments
 (0)