Skip to content

Commit 8c3c0a0

Browse files
flavorjonesflavorjones
authored
Merge pull request #689 from sparklemotion/harden-github-actions
Harden GitHub actions
2 parents 7ac5edf + 9ebda35 commit 8c3c0a0

File tree

4 files changed

+110
-66
lines changed

4 files changed

+110
-66
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 81 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ on:
1717
branches:
1818
- '*'
1919

20+
permissions:
21+
contents: read
22+
2023
env:
2124
BUNDLE_WITHOUT: "development"
2225

@@ -37,22 +40,25 @@ jobs:
3740
env:
3841
BUNDLE_WITHOUT: "" # we need rubocop, obviously
3942
steps:
40-
- uses: actions/checkout@v6
41-
- uses: ruby/setup-ruby@d3e3bd032ad2222a8ac878bbccf2aba78864e134
43+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4244
with:
43-
ruby-version: "3.4"
44-
bundler-cache: true
45+
persist-credentials: false
46+
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
47+
with:
48+
ruby-version: "4.0"
49+
bundler-cache: true # zizmor: ignore[cache-poisoning]
4550
- run: bundle exec rake rubocop
4651

4752
basic:
4853
needs: rubocop
4954
runs-on: ubuntu-latest
5055
steps:
51-
- uses: actions/checkout@v6
52-
- uses: ruby/setup-ruby-pkgs@v1
56+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5357
with:
54-
setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134
55-
ruby-version: "3.4"
58+
persist-credentials: false
59+
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
60+
with:
61+
ruby-version: "4.0"
5662
bundler-cache: true
5763
apt-get: libsqlite3-dev
5864
- run: bundle exec rake compile -- --enable-system-libraries
@@ -80,17 +86,18 @@ jobs:
8086
run: |
8187
git config --system core.autocrlf false
8288
git config --system core.eol lf
83-
- uses: actions/checkout@v6
84-
- uses: ruby/setup-ruby-pkgs@v1
89+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
90+
with:
91+
persist-credentials: false
92+
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
8593
with:
86-
setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134
8794
ruby-version: ${{ matrix.ruby }}
8895
bundler-cache: true
8996
apt-get: libsqlite3-dev
9097
mingw: sqlite3
9198
vcpkg: sqlite3
9299
- if: matrix.syslib == 'disable'
93-
uses: actions/cache@v5
100+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
94101
with:
95102
path: ports
96103
key: ports-${{ matrix.os }}-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
@@ -109,7 +116,9 @@ jobs:
109116
- run: |
110117
dnf group install -y "C Development Tools and Libraries"
111118
dnf install -y ruby ruby-devel patch
112-
- uses: actions/checkout@v6
119+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120+
with:
121+
persist-credentials: false
113122
- run: bundle install
114123
- run: bundle exec rake compile -- --disable-system-libraries
115124
- run: bundle exec rake test
@@ -119,8 +128,10 @@ jobs:
119128
name: "FreeBSD"
120129
runs-on: ubuntu-latest
121130
steps:
122-
- uses: actions/checkout@v6
123-
- uses: vmactions/freebsd-vm@v1
131+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
132+
with:
133+
persist-credentials: false
134+
- uses: vmactions/freebsd-vm@4807432c7cab1c3f97688665332c0b932062d31f # v1.4.3
124135
with:
125136
usesh: true
126137
copyback: false
@@ -149,10 +160,11 @@ jobs:
149160
run: |
150161
git config --system core.autocrlf false
151162
git config --system core.eol lf
152-
- uses: actions/checkout@v6
153-
- uses: ruby/setup-ruby-pkgs@v1
163+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
164+
with:
165+
persist-credentials: false
166+
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
154167
with:
155-
setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134
156168
ruby-version: ${{ matrix.ruby }}
157169
bundler-cache: true
158170
apt-get: libsqlcipher-dev
@@ -166,14 +178,15 @@ jobs:
166178
needs: basic
167179
runs-on: ubuntu-latest
168180
steps:
169-
- uses: actions/checkout@v6
170-
- uses: ruby/setup-ruby-pkgs@v1
181+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
182+
with:
183+
persist-credentials: false
184+
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
171185
with:
172-
setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134
173-
ruby-version: "3.4"
186+
ruby-version: "4.0"
174187
bundler-cache: true
175188
apt-get: valgrind
176-
- uses: actions/cache@v5
189+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
177190
with:
178191
path: ports
179192
key: ports-ubuntu-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
@@ -190,15 +203,17 @@ jobs:
190203
outputs:
191204
rcd_image_version: ${{ steps.rcd_image_version.outputs.rcd_image_version }}
192205
steps:
193-
- uses: actions/checkout@v6
194-
- uses: actions/cache@v5
206+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
207+
with:
208+
persist-credentials: false
209+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
195210
with:
196211
path: ports/archives
197212
key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
198-
- uses: ruby/setup-ruby@d3e3bd032ad2222a8ac878bbccf2aba78864e134
213+
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
199214
with:
200-
ruby-version: "3.4"
201-
bundler-cache: true
215+
ruby-version: "4.0"
216+
bundler-cache: true # zizmor: ignore[cache-poisoning]
202217
- run: bundle exec ruby ./ext/sqlite3/extconf.rb --download-dependencies
203218
- id: rcd_image_version
204219
run: bundle exec ruby -e 'require "rake_compiler_dock"; puts "rcd_image_version=#{RakeCompilerDock::IMAGE_VERSION}"' >> $GITHUB_OUTPUT
@@ -208,17 +223,19 @@ jobs:
208223
name: "build source"
209224
runs-on: ubuntu-latest
210225
steps:
211-
- uses: actions/checkout@v6
212-
- uses: actions/cache@v5
226+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
227+
with:
228+
persist-credentials: false
229+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
213230
with:
214231
path: ports/archives
215232
key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
216-
- uses: ruby/setup-ruby@d3e3bd032ad2222a8ac878bbccf2aba78864e134
233+
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
217234
with:
218-
ruby-version: "3.4"
219-
bundler-cache: true
235+
ruby-version: "4.0"
236+
bundler-cache: true # zizmor: ignore[cache-poisoning]
220237
- run: ./bin/test-gem-build gems ruby
221-
- uses: actions/upload-artifact@v7
238+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
222239
with:
223240
name: source-gem
224241
path: gems
@@ -238,14 +255,15 @@ jobs:
238255
- { os: macos, syslib: enable, compile_flags: "--with-opt-dir=$(brew --prefix sqlite3)" }
239256
runs-on: ${{ matrix.os }}-latest
240257
steps:
241-
- uses: actions/checkout@v6
242-
- uses: ruby/setup-ruby-pkgs@v1
258+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
259+
with:
260+
persist-credentials: false
261+
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
243262
with:
244-
setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134
245263
ruby-version: ${{ matrix.ruby }}
246264
apt-get: libsqlite3-dev pkg-config
247265
mingw: sqlite3
248-
- uses: actions/download-artifact@v8
266+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
249267
with:
250268
name: source-gem
251269
path: gems
@@ -272,16 +290,20 @@ jobs:
272290
- x86_64-linux-musl
273291
runs-on: ubuntu-latest
274292
steps:
275-
- uses: actions/checkout@v6
276-
- uses: actions/cache@v5
293+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
294+
with:
295+
persist-credentials: false
296+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
277297
with:
278298
path: ports/archives
279299
key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
280300
- run: |
281301
docker run --rm -v $PWD:/work -w /work \
282-
ghcr.io/rake-compiler/rake-compiler-dock-image:${{ needs.native_setup.outputs.rcd_image_version }}-mri-${{ matrix.platform }} \
302+
ghcr.io/rake-compiler/rake-compiler-dock-image:${NEEDS_NATIVE_SETUP_OUTPUTS_RCD_IMAGE_VERSION}-mri-${{ matrix.platform }} \
283303
./bin/test-gem-build gems ${{ matrix.platform }}
284-
- uses: actions/upload-artifact@v7
304+
env:
305+
NEEDS_NATIVE_SETUP_OUTPUTS_RCD_IMAGE_VERSION: ${{ needs.native_setup.outputs.rcd_image_version }}
306+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
285307
with:
286308
name: "cruby-${{ matrix.platform }}-gem"
287309
path: gems
@@ -318,18 +340,22 @@ jobs:
318340
- { runner: ubuntu-latest, platform: x86-linux-musl, docker_platform: "--platform=linux/386" }
319341
runs-on: ${{ matrix.runner || 'ubuntu-latest' }}
320342
steps:
321-
- uses: actions/checkout@v6
322-
- uses: actions/download-artifact@v8
343+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
344+
with:
345+
persist-credentials: false
346+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
323347
with:
324348
name: cruby-${{ matrix.platform }}-gem
325349
path: gems
326350
- run: |
327351
docker run --rm -v $PWD:/work -w /work \
328-
${{ matrix.docker_platform}} ruby:${{ matrix.ruby }}${{ matrix.docker_tag }} \
352+
${{ matrix.docker_platform }} ruby:${MATRIX_RUBY}${{ matrix.docker_tag }} \
329353
sh -c "
330354
${{ matrix.bootstrap }}
331355
./bin/test-gem-install ./gems
332356
"
357+
env:
358+
MATRIX_RUBY: ${{ matrix.ruby }}
333359
334360
test_the_rest:
335361
name: "${{ matrix.platform }} ${{ matrix.ruby }}"
@@ -348,11 +374,13 @@ jobs:
348374
platform: x64-mingw-ucrt
349375
runs-on: ${{ matrix.os }}
350376
steps:
351-
- uses: actions/checkout@v6
352-
- uses: ruby/setup-ruby@d3e3bd032ad2222a8ac878bbccf2aba78864e134
377+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
378+
with:
379+
persist-credentials: false
380+
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
353381
with:
354382
ruby-version: "${{ matrix.ruby }}"
355-
- uses: actions/download-artifact@v8
383+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
356384
with:
357385
name: cruby-${{ matrix.platform }}-gem
358386
path: gems
@@ -373,10 +401,12 @@ jobs:
373401
- { ruby: "4.0", flavor: "alpine" }
374402
runs-on: ubuntu-latest
375403
container:
376-
image: ruby:${{matrix.ruby}}-${{matrix.flavor}}
404+
image: ruby:${{ matrix.ruby }}-${{ matrix.flavor }}
377405
steps:
378-
- uses: actions/checkout@v6
379-
- uses: actions/download-artifact@v8
406+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
407+
with:
408+
persist-credentials: false
409+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
380410
with:
381411
name: cruby-x86_64-linux-musl-gem
382412
path: gems

‎.github/workflows/downstream.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,23 @@ on:
1717
branches:
1818
- '*'
1919

20+
permissions:
21+
contents: read
22+
2023
jobs:
2124
activerecord:
2225
runs-on: ubuntu-latest
2326
steps:
24-
- uses: actions/checkout@v6
25-
- uses: ruby/setup-ruby-pkgs@v1
27+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
28+
with:
29+
persist-credentials: false
30+
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
2631
with:
27-
ruby-version: "3.4"
32+
ruby-version: "4.0"
2833
bundler: latest
2934
bundler-cache: true
3035
apt-get: sqlite3 # active record test suite uses the sqlite3 cli
31-
- uses: actions/cache@v5
36+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
3237
with:
3338
path: ports
3439
key: ports-ubuntu-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}

‎.github/workflows/rdoc.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,15 +23,17 @@ jobs:
2323
url: ${{ steps.deployment.outputs.page_url }}
2424
runs-on: ubuntu-latest
2525
steps:
26-
- uses: actions/checkout@v6
27-
- uses: actions/configure-pages@v5
28-
- uses: ruby/setup-ruby@v1
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
with:
28+
persist-credentials: false
29+
- uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
30+
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
2931
with:
3032
ruby-version: "4.0"
31-
bundler-cache: true
33+
bundler-cache: true # zizmor: ignore[cache-poisoning]
3234
- run: bundle exec rdoc
33-
- uses: actions/upload-pages-artifact@v4
35+
- uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
3436
with:
3537
path: 'doc'
36-
- uses: actions/deploy-pages@v4
38+
- uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
3739
id: deployment

‎.github/workflows/upstream.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,20 @@ on:
1313
paths:
1414
- .github/workflows/upstream.yml # this file
1515

16+
permissions:
17+
contents: read
18+
1619
jobs:
1720
sqlite-head:
1821
runs-on: ubuntu-latest
1922
steps:
20-
- uses: actions/checkout@v6
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24+
with:
25+
persist-credentials: false
2126
- run: |
2227
git clone --depth=1 https://github.com/sqlite/sqlite
2328
git -C sqlite log -n1
24-
- uses: ruby/setup-ruby-pkgs@v1
29+
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
2530
with:
2631
ruby-version: "3.3"
2732
bundler-cache: true
@@ -40,14 +45,16 @@ jobs:
4045

4146
runs-on: ${{matrix.os}}
4247
steps:
43-
- uses: actions/checkout@v6
44-
- uses: ruby/setup-ruby-pkgs@v1
48+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
49+
with:
50+
persist-credentials: false
51+
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
4552
with:
4653
ruby-version: ${{matrix.ruby}}
4754
bundler-cache: true
4855
apt-get: libsqlite3-dev
4956
- if: matrix.lib == 'packaged'
50-
uses: actions/cache@v5
57+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
5158
with:
5259
path: ports
5360
key: ports-${{matrix.os}}-${{hashFiles('ext/sqlite3/extconf.rb','dependencies.yml')}}

0 commit comments

Comments
 (0)