Skip to content

Commit 9ebda35

Browse files
flavorjonesflavorjones
committed
ci: address zizmor artipacked and template-injection
1 parent 96e45c5 commit 9ebda35

File tree

4 files changed

+43
-3
lines changed

4 files changed

+43
-3
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ jobs:
4141
BUNDLE_WITHOUT: "" # we need rubocop, obviously
4242
steps:
4343
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44+
with:
45+
persist-credentials: false
4446
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
4547
with:
4648
ruby-version: "4.0"
@@ -52,6 +54,8 @@ jobs:
5254
runs-on: ubuntu-latest
5355
steps:
5456
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
57+
with:
58+
persist-credentials: false
5559
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
5660
with:
5761
ruby-version: "4.0"
@@ -83,6 +87,8 @@ jobs:
8387
git config --system core.autocrlf false
8488
git config --system core.eol lf
8589
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
90+
with:
91+
persist-credentials: false
8692
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
8793
with:
8894
ruby-version: ${{ matrix.ruby }}
@@ -111,6 +117,8 @@ jobs:
111117
dnf group install -y "C Development Tools and Libraries"
112118
dnf install -y ruby ruby-devel patch
113119
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120+
with:
121+
persist-credentials: false
114122
- run: bundle install
115123
- run: bundle exec rake compile -- --disable-system-libraries
116124
- run: bundle exec rake test
@@ -121,6 +129,8 @@ jobs:
121129
runs-on: ubuntu-latest
122130
steps:
123131
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
132+
with:
133+
persist-credentials: false
124134
- uses: vmactions/freebsd-vm@4807432c7cab1c3f97688665332c0b932062d31f # v1.4.3
125135
with:
126136
usesh: true
@@ -151,6 +161,8 @@ jobs:
151161
git config --system core.autocrlf false
152162
git config --system core.eol lf
153163
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
164+
with:
165+
persist-credentials: false
154166
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
155167
with:
156168
ruby-version: ${{ matrix.ruby }}
@@ -167,6 +179,8 @@ jobs:
167179
runs-on: ubuntu-latest
168180
steps:
169181
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
182+
with:
183+
persist-credentials: false
170184
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
171185
with:
172186
ruby-version: "4.0"
@@ -190,6 +204,8 @@ jobs:
190204
rcd_image_version: ${{ steps.rcd_image_version.outputs.rcd_image_version }}
191205
steps:
192206
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
207+
with:
208+
persist-credentials: false
193209
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
194210
with:
195211
path: ports/archives
@@ -208,6 +224,8 @@ jobs:
208224
runs-on: ubuntu-latest
209225
steps:
210226
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
227+
with:
228+
persist-credentials: false
211229
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
212230
with:
213231
path: ports/archives
@@ -238,6 +256,8 @@ jobs:
238256
runs-on: ${{ matrix.os }}-latest
239257
steps:
240258
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
259+
with:
260+
persist-credentials: false
241261
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
242262
with:
243263
ruby-version: ${{ matrix.ruby }}
@@ -271,14 +291,18 @@ jobs:
271291
runs-on: ubuntu-latest
272292
steps:
273293
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
294+
with:
295+
persist-credentials: false
274296
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning]
275297
with:
276298
path: ports/archives
277299
key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }}
278300
- run: |
279301
docker run --rm -v $PWD:/work -w /work \
280-
ghcr.io/rake-compiler/rake-compiler-dock-image:${{ needs.native_setup.outputs.rcd_image_version }}-mri-${{ matrix.platform }} \
302+
ghcr.io/rake-compiler/rake-compiler-dock-image:${NEEDS_NATIVE_SETUP_OUTPUTS_RCD_IMAGE_VERSION}-mri-${{ matrix.platform }} \
281303
./bin/test-gem-build gems ${{ matrix.platform }}
304+
env:
305+
NEEDS_NATIVE_SETUP_OUTPUTS_RCD_IMAGE_VERSION: ${{ needs.native_setup.outputs.rcd_image_version }}
282306
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
283307
with:
284308
name: "cruby-${{ matrix.platform }}-gem"
@@ -317,17 +341,21 @@ jobs:
317341
runs-on: ${{ matrix.runner || 'ubuntu-latest' }}
318342
steps:
319343
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
344+
with:
345+
persist-credentials: false
320346
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
321347
with:
322348
name: cruby-${{ matrix.platform }}-gem
323349
path: gems
324350
- run: |
325351
docker run --rm -v $PWD:/work -w /work \
326-
${{ matrix.docker_platform}} ruby:${{ matrix.ruby }}${{ matrix.docker_tag }} \
352+
${{ matrix.docker_platform }} ruby:${MATRIX_RUBY}${{ matrix.docker_tag }} \
327353
sh -c "
328354
${{ matrix.bootstrap }}
329355
./bin/test-gem-install ./gems
330356
"
357+
env:
358+
MATRIX_RUBY: ${{ matrix.ruby }}
331359
332360
test_the_rest:
333361
name: "${{ matrix.platform }} ${{ matrix.ruby }}"
@@ -347,6 +375,8 @@ jobs:
347375
runs-on: ${{ matrix.os }}
348376
steps:
349377
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
378+
with:
379+
persist-credentials: false
350380
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
351381
with:
352382
ruby-version: "${{ matrix.ruby }}"
@@ -371,9 +401,11 @@ jobs:
371401
- { ruby: "4.0", flavor: "alpine" }
372402
runs-on: ubuntu-latest
373403
container:
374-
image: ruby:${{matrix.ruby}}-${{matrix.flavor}}
404+
image: ruby:${{ matrix.ruby }}-${{ matrix.flavor }}
375405
steps:
376406
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
407+
with:
408+
persist-credentials: false
377409
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
378410
with:
379411
name: cruby-x86_64-linux-musl-gem

‎.github/workflows/downstream.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
28+
with:
29+
persist-credentials: false
2830
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
2931
with:
3032
ruby-version: "4.0"

‎.github/workflows/rdoc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ jobs:
2424
runs-on: ubuntu-latest
2525
steps:
2626
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
with:
28+
persist-credentials: false
2729
- uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
2830
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0
2931
with:

‎.github/workflows/upstream.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ jobs:
2121
runs-on: ubuntu-latest
2222
steps:
2323
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24+
with:
25+
persist-credentials: false
2426
- run: |
2527
git clone --depth=1 https://github.com/sqlite/sqlite
2628
git -C sqlite log -n1
@@ -44,6 +46,8 @@ jobs:
4446
runs-on: ${{matrix.os}}
4547
steps:
4648
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
49+
with:
50+
persist-credentials: false
4751
- uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
4852
with:
4953
ruby-version: ${{matrix.ruby}}

0 commit comments

Comments
 (0)