Skip to content

Commit 3c46c8f

Browse files
bmartybmarty
authored
Merge pull request #95 from matrix-org/bma/zizmor
Add zizmor check and fix existing issues
2 parents 8a50221 + 9a73141 commit 3c46c8f

3 files changed

Lines changed: 97 additions & 51 deletions

File tree

‎.github/workflows/release_crypto.yml‎

Lines changed: 33 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
description: 'The new version for the crypto library.'
1212
required: true
1313

14+
permissions: {}
15+
1416
jobs:
1517
build_targets:
1618
strategy:
@@ -29,20 +31,22 @@ jobs:
2931

3032
steps:
3133
- name: Checkout this repo
32-
uses: actions/checkout@v6
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
35+
with:
36+
persist-credentials: false
3337

3438
- name: Configure git user
3539
run: |
3640
git config user.name github-actions
3741
git config user.email github-actions@github.com
3842
39-
- uses: Swatinem/rust-cache@v2
43+
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
4044
with:
4145
save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'main' }}
4246
cache-on-failure: true
4347

4448
- name: Set up JDK 17
45-
uses: actions/setup-java@v5
49+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
4650
with:
4751
java-version: '17'
4852
distribution: 'temurin' # See 'Supported distributions' for available options
@@ -62,13 +66,13 @@ jobs:
6266
fi
6367
6468
- name: Install android sdk
65-
uses: malinskiy/action-android/install-sdk@release/0.1.4
69+
uses: malinskiy/action-android/install-sdk@fa103ef30331e95f266418a6a97e98f61f626887 # v0.1.7
6670

6771
- name: Install Rust
68-
uses: dtolnay/rust-toolchain@stable
72+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
6973

7074
- name: Install Protoc
71-
uses: arduino/setup-protoc@v1
75+
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
7276
with:
7377
repo-token: ${{ secrets.GITHUB_TOKEN }}
7478

@@ -84,7 +88,7 @@ jobs:
8488
run: cargo install cargo-ndk
8589

8690
- name: Set up Python 3
87-
uses: actions/setup-python@v6
91+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
8892
with:
8993
python-version: '3.x'
9094

@@ -96,20 +100,25 @@ jobs:
96100
97101
- name: Run build script
98102
run: |
99-
python3 ./scripts/build-rust-for-target.py --module CRYPTO --version ${{ github.event.inputs.sdk-version }} --ref ${{ github.event.inputs.rust-checkout-ref }} --target ${{ matrix.target }}
103+
python3 ./scripts/build-rust-for-target.py --module CRYPTO --version ${GITHUB_EVENT_INPUTS_SDK_VERSION} --ref ${GITHUB_EVENT_INPUTS_RUST_CHECKOUT_REF} --target ${{ matrix.target }}
104+
env:
105+
GITHUB_EVENT_INPUTS_SDK_VERSION: ${{ github.event.inputs.sdk-version }}
106+
GITHUB_EVENT_INPUTS_RUST_CHECKOUT_REF: ${{ github.event.inputs.rust-checkout-ref }}
100107

101108
- name: Set linkable git ref
102109
id: set_linkable_ref
103110
run: |
104-
pushd ${{ env.RUST_SDK_PATH }}
105-
COMMIT_HASH=$(git rev-parse --verify ${{ github.event.inputs.rust-checkout-ref }}^{})
111+
pushd ${RUST_SDK_PATH}
112+
COMMIT_HASH=$(git rev-parse --verify ${GITHUB_EVENT_INPUTS_RUST_CHECKOUT_REF}^{})
106113
echo linkable_ref=$COMMIT_HASH >> $GITHUB_OUTPUT
107114
echo "Using commit hash $COMMIT_HASH"
108115
popd
116+
env:
117+
GITHUB_EVENT_INPUTS_RUST_CHECKOUT_REF: ${{ github.event.inputs.rust-checkout-ref }}
109118

110119
- name: Upload target artifacts
111120
if: success() || failure()
112-
uses: actions/upload-artifact@v6
121+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
113122
with:
114123
name: targets-${{ matrix.target }}
115124
if-no-files-found: error
@@ -120,7 +129,7 @@ jobs:
120129
# The FFI bindings will be identical for the 4 architectures, so upload as artifact
121130
# only once.
122131
if: (success() || failure()) && matrix.target == 'x86_64-linux-android'
123-
uses: actions/upload-artifact@v6
132+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
124133
with:
125134
name: ffi-bindings
126135
if-no-files-found: error
@@ -138,37 +147,39 @@ jobs:
138147

139148
steps:
140149
- name: Checkout this repo
141-
uses: actions/checkout@v6
150+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
151+
with:
152+
persist-credentials: false
142153

143154
- name: Configure git user
144155
run: |
145156
git config user.name github-actions
146157
git config user.email github-actions@github.com
147158
148159
- name: Download target artifacts to their right folders
149-
uses: actions/download-artifact@v7
160+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0@v7
150161
with:
151162
pattern: targets-*
152163
merge-multiple: true
153164
path: crypto/crypto-android/src/main/jniLibs/
154165

155166
- name: Download FFI bindings to their package
156-
uses: actions/download-artifact@v7
167+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0@v7
157168
with:
158169
name: ffi-bindings
159170
path: crypto/crypto-android/src/main/kotlin/
160171

161172
- name: Set up JDK 17
162-
uses: actions/setup-java@v5
173+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
163174
with:
164175
java-version: '17'
165176
distribution: 'temurin' # See 'Supported distributions' for available options
166177

167178
- name: Install android sdk
168-
uses: malinskiy/action-android/install-sdk@release/0.1.4
179+
uses: malinskiy/action-android/install-sdk@fa103ef30331e95f266418a6a97e98f61f626887 # v0.1.7
169180

170181
- name: Set up Python 3
171-
uses: actions/setup-python@v6
182+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
172183
with:
173184
python-version: '3.x'
174185

@@ -187,12 +198,14 @@ jobs:
187198
SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
188199
SONATYPE_STAGING_PROFILE_ID: ${{ secrets.SONATYPE_STAGING_PROFILE_ID }}
189200
GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
201+
GITHUB_EVENT_INPUTS_SDK_VERSION: ${{ github.event.inputs.sdk-version }}
202+
NEEDS_BUILD_TARGETS_OUTPUTS_LINKABLE_REF: ${{ needs.build_targets.outputs.linkable_ref }}
190203
run: |
191-
python3 ./scripts/publish_release.py --module CRYPTO --version ${{ github.event.inputs.sdk-version }} --linkable-ref ${{ needs.build_targets.outputs.linkable_ref }}
204+
python3 ./scripts/publish_release.py --module CRYPTO --version ${GITHUB_EVENT_INPUTS_SDK_VERSION} --linkable-ref ${NEEDS_BUILD_TARGETS_OUTPUTS_LINKABLE_REF}
192205
193206
- name: Upload AAR results
194207
if: success() || failure()
195-
uses: actions/upload-artifact@v6
208+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
196209
with:
197210
name: sdk-android-release
198211
if-no-files-found: error

‎.github/workflows/release_sdk_parallel.yml‎

Lines changed: 44 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
description: 'The new version for the sdk library.'
1212
required: true
1313

14+
permissions: {}
15+
1416
jobs:
1517
build_targets:
1618
strategy:
@@ -31,20 +33,22 @@ jobs:
3133

3234
steps:
3335
- name: Checkout this repo
34-
uses: actions/checkout@v6
36+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
37+
with:
38+
persist-credentials: false
3539

3640
- name: Configure git user
3741
run: |
3842
git config user.name github-actions
3943
git config user.email github-actions@github.com
4044
41-
- uses: Swatinem/rust-cache@v2
45+
- uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
4246
with:
4347
save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'main' }}
4448
cache-on-failure: true
4549

4650
- name: Set up JDK 17
47-
uses: actions/setup-java@v5
51+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
4852
with:
4953
java-version: '17'
5054
distribution: 'temurin' # See 'Supported distributions' for available options
@@ -65,17 +69,17 @@ jobs:
6569
6670
- name: Check objcopy is present
6771
run: |
68-
ls ${{ env.ANDROID_NDK_HOME }}/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-objcopy
69-
echo LLVM_OBJCOPY=${{ env.ANDROID_NDK_HOME }}/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-objcopy >> $GITHUB_ENV
72+
ls ${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-objcopy
73+
echo LLVM_OBJCOPY=${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-objcopy >> $GITHUB_ENV
7074
7175
- name: Install android sdk
72-
uses: malinskiy/action-android/install-sdk@release/0.1.4
76+
uses: malinskiy/action-android/install-sdk@fa103ef30331e95f266418a6a97e98f61f626887 # v0.1.7
7377

7478
- name: Install Rust
75-
uses: dtolnay/rust-toolchain@stable
79+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
7680

7781
- name: Install Protoc
78-
uses: arduino/setup-protoc@v1
82+
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
7983
with:
8084
repo-token: ${{ secrets.GITHUB_TOKEN }}
8185

@@ -91,7 +95,7 @@ jobs:
9195
run: cargo install cargo-ndk
9296

9397
- name: Set up Python 3
94-
uses: actions/setup-python@v6
98+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
9599
with:
96100
python-version: '3.x'
97101

@@ -103,42 +107,47 @@ jobs:
103107
104108
- name: Run build script
105109
run: |
106-
python3 ./scripts/build-rust-for-target.py --module SDK --version ${{ github.event.inputs.sdk-version }} --ref ${{ github.event.inputs.rust-checkout-ref }} --target ${{ matrix.target }}
110+
python3 ./scripts/build-rust-for-target.py --module SDK --version ${GITHUB_EVENT_INPUTS_SDK_VERSION} --ref ${GITHUB_EVENT_INPUTS_RUST_CHECKOUT_REF} --target ${{ matrix.target }}
111+
env:
112+
GITHUB_EVENT_INPUTS_SDK_VERSION: ${{ github.event.inputs.sdk-version }}
113+
GITHUB_EVENT_INPUTS_RUST_CHECKOUT_REF: ${{ github.event.inputs.rust-checkout-ref }}
107114

108115
- name: Extract debug symbols
109116
run: |
110-
pushd ${{ env.RUST_SDK_PATH }}/target/${{ matrix.target }}/dist
117+
pushd ${RUST_SDK_PATH}/target/${{ matrix.target }}/dist
111118
echo "Original library with debug info:"
112119
ls -lh libmatrix_sdk_ffi.so
113120
echo "Extracting debug symbols"
114-
${{ env.LLVM_OBJCOPY }} --only-keep-debug libmatrix_sdk_ffi.so libmatrix_sdk_ffi.so.debug
121+
${LLVM_OBJCOPY} --only-keep-debug libmatrix_sdk_ffi.so libmatrix_sdk_ffi.so.debug
115122
ls -lh libmatrix_sdk_ffi.so.debug
116123
echo "Stripping debug symbols from libmatrix_sdk_ffi.so"
117-
${{ env.LLVM_OBJCOPY }} --strip-debug --strip-unneeded libmatrix_sdk_ffi.so
124+
${LLVM_OBJCOPY} --strip-debug --strip-unneeded libmatrix_sdk_ffi.so
118125
echo "Done stripping debug symbols"
119126
ls -lh libmatrix_sdk_ffi.so
120127
echo "Link debug symbols to stripped binary"
121-
${{ env.LLVM_OBJCOPY }} --add-gnu-debuglink=libmatrix_sdk_ffi.so.debug libmatrix_sdk_ffi.so
128+
${LLVM_OBJCOPY} --add-gnu-debuglink=libmatrix_sdk_ffi.so.debug libmatrix_sdk_ffi.so
122129
popd
123130
echo "Replacing built file with stripped one"
124131
EXISTING_FILE=$(find sdk/sdk-android/src/main/jniLibs/ -name libmatrix_sdk_ffi.so)
125-
cp ${{ env.RUST_SDK_PATH }}/target/${{ matrix.target }}/dist/libmatrix_sdk_ffi.so $EXISTING_FILE
132+
cp ${RUST_SDK_PATH}/target/${{ matrix.target }}/dist/libmatrix_sdk_ffi.so $EXISTING_FILE
126133
ls -lh $EXISTING_FILE
127134
mkdir -p debuginfo/${{ matrix.target }}
128-
cp ${{ env.RUST_SDK_PATH }}/target/${{ matrix.target }}/dist/libmatrix_sdk_ffi.so.debug debuginfo/${{ matrix.target }}/
135+
cp ${RUST_SDK_PATH}/target/${{ matrix.target }}/dist/libmatrix_sdk_ffi.so.debug debuginfo/${{ matrix.target }}/
129136
130137
- name: Set linkable git ref
131138
id: set_linkable_ref
132139
run: |
133-
pushd ${{ env.RUST_SDK_PATH }}
134-
COMMIT_HASH=$(git rev-parse --verify ${{ github.event.inputs.rust-checkout-ref }}^{})
140+
pushd ${RUST_SDK_PATH}
141+
COMMIT_HASH=$(git rev-parse --verify ${GITHUB_EVENT_INPUTS_RUST_CHECKOUT_REF}^{})
135142
echo linkable_ref=$COMMIT_HASH >> $GITHUB_OUTPUT
136143
echo "Using commit hash $COMMIT_HASH"
137144
popd
145+
env:
146+
GITHUB_EVENT_INPUTS_RUST_CHECKOUT_REF: ${{ github.event.inputs.rust-checkout-ref }}
138147

139148
- name: Upload target artifacts
140149
if: success() || failure()
141-
uses: actions/upload-artifact@v6
150+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
142151
with:
143152
name: targets-${{ matrix.target }}
144153
if-no-files-found: error
@@ -147,7 +156,7 @@ jobs:
147156

148157
- name: Upload debug info
149158
if: success() || failure()
150-
uses: actions/upload-artifact@v6
159+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
151160
with:
152161
name: debuginfo-${{ matrix.target }}
153162
if-no-files-found: error
@@ -158,7 +167,7 @@ jobs:
158167
# The FFI bindings will be identical for the 4 architectures, so upload as artifact
159168
# only once.
160169
if: (success() || failure()) && matrix.target == 'x86_64-linux-android'
161-
uses: actions/upload-artifact@v6
170+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
162171
with:
163172
name: ffi-bindings
164173
if-no-files-found: error
@@ -176,37 +185,39 @@ jobs:
176185

177186
steps:
178187
- name: Checkout this repo
179-
uses: actions/checkout@v6
188+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
189+
with:
190+
persist-credentials: false
180191

181192
- name: Configure git user
182193
run: |
183194
git config user.name github-actions
184195
git config user.email github-actions@github.com
185196
186197
- name: Download target artifacts to their right folders
187-
uses: actions/download-artifact@v7
198+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0@v7
188199
with:
189200
pattern: targets-*
190201
merge-multiple: true
191202
path: sdk/sdk-android/src/main/jniLibs/
192203

193204
- name: Download FFI bindings to their package
194-
uses: actions/download-artifact@v7
205+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0@v7
195206
with:
196207
name: ffi-bindings
197208
path: sdk/sdk-android/src/main/kotlin/
198209

199210
- name: Set up JDK 17
200-
uses: actions/setup-java@v5
211+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
201212
with:
202213
java-version: '17'
203214
distribution: 'temurin' # See 'Supported distributions' for available options
204215

205216
- name: Install android sdk
206-
uses: malinskiy/action-android/install-sdk@release/0.1.4
217+
uses: malinskiy/action-android/install-sdk@fa103ef30331e95f266418a6a97e98f61f626887 # v0.1.7
207218

208219
- name: Set up Python 3
209-
uses: actions/setup-python@v6
220+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
210221
with:
211222
python-version: '3.x'
212223

@@ -225,27 +236,29 @@ jobs:
225236
SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
226237
SONATYPE_STAGING_PROFILE_ID: ${{ secrets.SONATYPE_STAGING_PROFILE_ID }}
227238
GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
239+
GITHUB_EVENT_INPUTS_SDK_VERSION: ${{ github.event.inputs.sdk-version }}
240+
NEEDS_BUILD_TARGETS_OUTPUTS_LINKABLE_REF: ${{ needs.build_targets.outputs.linkable_ref }}
228241
run: |
229-
python3 ./scripts/publish_release.py --module SDK --version ${{ github.event.inputs.sdk-version }} --linkable-ref ${{ needs.build_targets.outputs.linkable_ref }}
242+
python3 ./scripts/publish_release.py --module SDK --version ${GITHUB_EVENT_INPUTS_SDK_VERSION} --linkable-ref ${NEEDS_BUILD_TARGETS_OUTPUTS_LINKABLE_REF}
230243
231244
- name: Upload AAR results
232245
if: success() || failure()
233-
uses: actions/upload-artifact@v6
246+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
234247
with:
235248
name: sdk-android-release
236249
if-no-files-found: error
237250
path: ./sdk/sdk-android/build/**/*.aar
238251
retention-days: 7
239252

240253
- name: Download debug info
241-
uses: actions/download-artifact@v7
254+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0@v7
242255
with:
243256
pattern: debuginfo-*
244257
merge-multiple: true
245258
path: ./debuginfo
246259

247260
- name: Setup Sentry CLI
248-
uses: matbour/setup-sentry-cli@v1
261+
uses: matbour/setup-sentry-cli@3e938c54b3018bdd019973689ef984e033b0454b # v2.0.0
249262
with:
250263
version: latest # optional if 'latest'
251264
url: https://sentry.tools.element.io

0 commit comments

Comments
 (0)