lee/bottom
1
0
Fork 0
mirror of https://github.com/ClementTsang/bottom.git synced 2026-08-24 04:16:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: run zizmor on GHA workflows (#2201)

Browse Source 
Use zizmor to protect our workflows a bit better. Done buy running zizmor ./ --fix=unsafe-only.

We should also probably add zizmor to our CI pipeline.
This commit is contained in:
Clement Tsang
2026-08-17 23:19:42 -04:00
committed by GitHub
parent 0b22ee4c43
commit bb741a81da
12 changed files with 82 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/audit.yml
+2
View File
@@ -29,6 +29,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Enable Rust cache
uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
.github/workflows/build_releases.yml
+22 -7
View File
@@ -173,6 +173,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
persist-credentials: false
# TODO: Make this and the toolchain step a separate wrapper action?
- name: Read Rust version
@@ -237,11 +238,13 @@ jobs:
shell: bash
run: |
mkdir -p signed
if [[ ${{ inputs.caller }} == "nightly" ]]; then
if [[ ${INPUTS_CALLER} == "nightly" ]]; then
echo "slug=test-signing" >> $GITHUB_OUTPUT
else
echo "slug=release-signing" >> $GITHUB_OUTPUT
fi
env:
INPUTS_CALLER: ${{ inputs.caller }}
- name: Upload unsigned Windows artifact
id: upload-unsigned-artifact
@@ -292,7 +295,7 @@ jobs:
shell: bash
run: |
mkdir release
mv ${{ env.ASSET }} release/
mv ${ASSET} release/
- name: Compress completion files
if: matrix.info.generate-other-artifacts == true
@@ -345,6 +348,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
persist-credentials: false
- name: Install Net-Framework-Core
shell: powershell
@@ -444,6 +448,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
persist-credentials: false
- name: Read Rust version
shell: bash
@@ -529,7 +534,9 @@ jobs:
shell: bash
run: |
mkdir release
mv ${{ steps.verify.outputs.DEB_FILE }} release/
mv ${STEPS_VERIFY_OUTPUTS_DEB_FILE} release/
env:
STEPS_VERIFY_OUTPUTS_DEB_FILE: ${{ steps.verify.outputs.DEB_FILE }}
- name: Save release as artifact
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
@@ -554,6 +561,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
persist-credentials: false
- name: Read Rust version
shell: bash
@@ -614,14 +622,18 @@ jobs:
- name: Check generated rpm file signatures
run: |
rpm --checksig --verbose ${{ steps.verify.outputs.RPM_FILE }}
rpm --checksig --verbose ${STEPS_VERIFY_OUTPUTS_RPM_FILE}
# Validate modern signature digest exist, see https://github.com/ClementTsang/bottom/issues/1848
rpm --checksig --verbose ${{ steps.verify.outputs.RPM_FILE }} | grep -q "SHA256"
rpm --checksig --verbose ${STEPS_VERIFY_OUTPUTS_RPM_FILE} | grep -q "SHA256"
env:
STEPS_VERIFY_OUTPUTS_RPM_FILE: ${{ steps.verify.outputs.RPM_FILE }}
- name: Test installing generated rpm file
run: |
yum localinstall -y ${{ steps.verify.outputs.RPM_FILE }}
yum localinstall -y ${STEPS_VERIFY_OUTPUTS_RPM_FILE}
btm -V
env:
STEPS_VERIFY_OUTPUTS_RPM_FILE: ${{ steps.verify.outputs.RPM_FILE }}
- name: Delete generated rpm folder
run: |
@@ -637,7 +649,9 @@ jobs:
shell: bash
run: |
mkdir release
mv ${{ steps.verify.outputs.RPM_FILE }} release/
mv ${STEPS_VERIFY_OUTPUTS_RPM_FILE} release/
env:
STEPS_VERIFY_OUTPUTS_RPM_FILE: ${{ steps.verify.outputs.RPM_FILE }}
- name: Save release as artifact
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
@@ -663,6 +677,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
persist-credentials: false
- name: Read Rust version
shell: bash
.github/workflows/ci.yml
+4
View File
@@ -77,6 +77,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Read Rust version
shell: bash
@@ -280,6 +282,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Read Rust version
shell: bash
.github/workflows/clear_workflow_cache.yml
+8 -4
View File
@@ -26,20 +26,24 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
persist-credentials: false
# We run each script twice with a small delay in between to try and catch everything.
- name: Clear cache
run: |
if [[ -n "${{ github.event.schedule }}" ]]; then
if [[ -n "${GITHUB_EVENT_SCHEDULE}" ]]; then
python ./scripts/clear_cache.py keep-main
sleep 5
python ./scripts/clear_cache.py keep-main
elif [[ -z "${{ github.event.inputs.id }}" ]]; then
elif [[ -z "${GITHUB_EVENT_INPUTS_ID}" ]]; then
python ./scripts/clear_cache.py ${{ github.event.pull_request.number }}
sleep 5
python ./scripts/clear_cache.py ${{ github.event.pull_request.number }}
else
python ./scripts/clear_cache.py ${{ github.event.inputs.id }}
python ./scripts/clear_cache.py ${GITHUB_EVENT_INPUTS_ID}
sleep 5
python ./scripts/clear_cache.py ${{ github.event.inputs.id }}
python ./scripts/clear_cache.py ${GITHUB_EVENT_INPUTS_ID}
fi
env:
GITHUB_EVENT_SCHEDULE: ${{ github.event.schedule }}
GITHUB_EVENT_INPUTS_ID: ${{ github.event.inputs.id }}
.github/workflows/coverage.yml
+2
View File
@@ -50,6 +50,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Read Rust version
shell: bash
.github/workflows/deployment.yml
+15 -8
View File
@@ -29,16 +29,18 @@ jobs:
- name: Get the release version from the tag
if: env.VERSION == ''
run: |
if [[ -n "${{ github.event.inputs.tag }}" ]]; then
if [[ -n "${GITHUB_EVENT_INPUTS_TAG}" ]]; then
echo "Manual run against a tag; overriding actual tag in the environment..."
echo "VERSION=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
echo "VERSION=${GITHUB_EVENT_INPUTS_TAG}" >> $GITHUB_ENV
else
echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
fi
env:
GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
- name: Validate version environment variable
run: |
echo "Version being built against is version ${{ env.VERSION }}"!
echo "Version being built against is version ${VERSION}"!
build-release:
needs: [initialize]
@@ -60,15 +62,18 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
persist-credentials: false
- name: Set release version
shell: bash
run: |
echo "RELEASE_VERSION=${{ needs.initialize.outputs.version }}" >> $GITHUB_ENV
echo "RELEASE_VERSION=${NEEDS_INITIALIZE_OUTPUTS_VERSION}" >> $GITHUB_ENV
env:
NEEDS_INITIALIZE_OUTPUTS_VERSION: ${{ needs.initialize.outputs.version }}
- name: Validate release version
run: |
echo "Release version: ${{ env.RELEASE_VERSION }}"
echo "Release version: ${RELEASE_VERSION}"
- name: Get release artifacts
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@@ -79,7 +84,7 @@ jobs:
- name: Execute choco packaging script
run: |
python "./scripts/windows/choco/choco_packager.py" "./release/bottom_x86_64-pc-windows-msvc.zip" ${{ env.RELEASE_VERSION }} "./scripts/windows/choco/bottom.nuspec.template" "./scripts/windows/choco/chocolateyinstall.ps1.template" "bottom.nuspec" "tools/chocolateyinstall.ps1" "tools/"
python "./scripts/windows/choco/choco_packager.py" "./release/bottom_x86_64-pc-windows-msvc.zip" ${RELEASE_VERSION} "./scripts/windows/choco/bottom.nuspec.template" "./scripts/windows/choco/chocolateyinstall.ps1.template" "bottom.nuspec" "tools/chocolateyinstall.ps1" "tools/"
zip -r choco.zip "bottom.nuspec" "tools"
- name: Move release file into release directory
@@ -104,11 +109,13 @@ jobs:
- name: Set release version
shell: bash
run: |
echo "RELEASE_VERSION=${{ needs.initialize.outputs.version }}" >> $GITHUB_ENV
echo "RELEASE_VERSION=${NEEDS_INITIALIZE_OUTPUTS_VERSION}" >> $GITHUB_ENV
env:
NEEDS_INITIALIZE_OUTPUTS_VERSION: ${{ needs.initialize.outputs.version }}
- name: Validate release version
run: |
echo "Release version: ${{ env.RELEASE_VERSION }}"
echo "Release version: ${RELEASE_VERSION}"
- name: Get release artifacts
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
.github/workflows/docs.yml
+8 -4
View File
@@ -39,6 +39,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
@@ -53,13 +54,16 @@ jobs:
- name: Build and deploy docs with mike
run: |
cd docs
if [[ -n "${{ inputs.alias }}" ]]; then
mike deploy --push ${{ inputs.version }} --update-aliases ${{ inputs.alias }}
elif [[ "${{ inputs.version }}" == "nightly" ]]; then
mike deploy --push ${{ inputs.version }}
if [[ -n "${INPUTS_ALIAS}" ]]; then
mike deploy --push ${INPUTS_VERSION} --update-aliases ${INPUTS_ALIAS}
elif [[ "${INPUTS_VERSION}" == "nightly" ]]; then
mike deploy --push ${INPUTS_VERSION}
else
mike deploy --push nightly
fi
env:
INPUTS_ALIAS: ${{ inputs.alias }}
INPUTS_VERSION: ${{ inputs.version }}
publish-gh-pages:
needs: [build-documentation]
.github/workflows/nightly.yml
+5 -2
View File
@@ -38,13 +38,15 @@ jobs:
- name: Check if mock
run: |
if [[ -z "${{ github.event.inputs.isMock }}" ]]; then
if [[ -z "${GITHUB_EVENT_INPUTS_ISMOCK}" ]]; then
echo "This is a scheduled nightly run."
elif [[ "${{ github.event.inputs.isMock }}" == "true" ]]; then
elif [[ "${GITHUB_EVENT_INPUTS_ISMOCK}" == "true" ]]; then
echo "This is a mock run."
else
echo "This is NOT a mock run. Watch for the generated files!"
fi
env:
GITHUB_EVENT_INPUTS_ISMOCK: ${{ github.event.inputs.isMock }}
build-release:
needs: initialize-job
@@ -71,6 +73,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
persist-credentials: false
- name: Get release artifacts
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
.github/workflows/post_release.yml
+13 -7
View File
@@ -29,17 +29,20 @@ jobs:
steps:
- name: Get the release version from the tag
run: |
if [[ -n "${{ github.event.inputs.tag }}" ]]; then
if [[ -n "${GITHUB_EVENT_INPUTS_TAG}" ]]; then
echo "Manual run against a tag; overriding actual tag in the environment..."
echo "VERSION=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
echo "VERSION=${GITHUB_EVENT_INPUTS_TAG}" >> "$GITHUB_ENV"
else
echo "VERSION=${{ github.event.release.tag_name }}" >> "$GITHUB_ENV"
echo "VERSION=${GITHUB_EVENT_RELEASE_TAG_NAME}" >> "$GITHUB_ENV"
fi
env:
GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
- name: Make sure you're not on master/main/nightly
run: |
echo ${{ env.VERSION }}
if [[ ${{ env.VERSION }} == "master" || ${{ env.VERSION }} == "main" || ${{ env.VERSION }} == "nightly" ]]; then
echo ${VERSION}
if [[ ${VERSION} == "master" || ${VERSION} == "main" || ${VERSION} == "nightly" ]]; then
exit 1
fi
@@ -62,11 +65,13 @@ jobs:
- name: Set release version
shell: bash
run: |
echo "RELEASE_VERSION=${{ needs.initialize.outputs.version }}" >> $GITHUB_ENV
echo "RELEASE_VERSION=${NEEDS_INITIALIZE_OUTPUTS_VERSION}" >> $GITHUB_ENV
env:
NEEDS_INITIALIZE_OUTPUTS_VERSION: ${{ needs.initialize.outputs.version }}
- name: Validate release version
run: |
echo "Release version: ${{ env.RELEASE_VERSION }}"
echo "Release version: ${RELEASE_VERSION}"
- name: Trigger choco
run: |
curl -X POST https://api.github.com/repos/ClementTsang/choco-bottom/dispatches \
@@ -85,6 +90,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
id: auth
.github/workflows/publish_github_pages.yml
+1
View File
@@ -20,6 +20,7 @@ jobs:
ref: gh-pages
submodules: recursive
fetch-depth: 1
persist-credentials: false
- name: Upload artifact
id: upload
.github/workflows/test_docs.yml
+1
View File
@@ -35,6 +35,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
.github/workflows/validate_schema.yml
+1
View File
@@ -44,6 +44,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with: