Skip to content

Commit 02be228

Browse files
silverwindclaudebircniGiteaBot
authored
ci: add zizmor to lint-actions (#37720)
Adds [zizmor](https://docs.zizmor.sh/) to `make lint-actions` with `--min-confidence=medium`. Fixes the remaining findings: - Pin floating-tag service images in `pull-db-tests.yml` to `tag@sha256:digest` - Move `github.ref` / `github.ref_name` (and surrounding secrets/step outputs for consistency) out of `run:` into `env:` --- This PR was written with the help of Claude Opus 4.7 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-authored-by: Giteabot <teabot@gitea.io>
1 parent 4e837fe commit 02be228

8 files changed

Lines changed: 75 additions & 23 deletions

File tree

‎.github/workflows/pull-compliance.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,10 +52,12 @@ jobs:
5252

5353
- run: make lint-spell
5454

55-
- if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
55+
- if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
5656
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
57+
with:
58+
python-version: 3.14
5759
- if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
58-
run: uv python install 3.14 && make deps-py lint-templates lint-yaml
60+
run: make deps-py lint-templates lint-yaml
5961

6062
- if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.swagger == 'true' || needs.files-changed.outputs.json == 'true'
6163
run: make deps-frontend lint-md lint-swagger lint-json

‎.github/workflows/pull-db-tests.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
ports:
2828
- "5432:5432"
2929
ldap:
30-
image: gitea/test-openldap:latest
30+
image: gitea/test-openldap:latest@sha256:4ac633b01d684e6b2a458cc0c8530c92f9b3702f6e040ce5f365607df34fbda0
3131
ports:
3232
- "389:389"
3333
- "636:636"
@@ -118,7 +118,7 @@ jobs:
118118
ports:
119119
- "7700:7700"
120120
redis:
121-
image: redis
121+
image: redis:latest@sha256:94ea4f5ccdaa6b154df99a792986ecb3ffbb3fe7722a197220477f1f3e65f9fe
122122
options: >- # wait until redis has started
123123
--health-cmd "redis-cli ping"
124124
--health-interval 5s
@@ -134,7 +134,7 @@ jobs:
134134
ports:
135135
- "9000:9000"
136136
devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
137-
image: mcr.microsoft.com/azure-storage/azurite:latest
137+
image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
138138
ports:
139139
- 10000:10000
140140
steps:
@@ -191,7 +191,7 @@ jobs:
191191
ports:
192192
- "9200:9200"
193193
smtpimap:
194-
image: tabascoterrier/docker-imap-devel:latest
194+
image: tabascoterrier/docker-imap-devel:latest@sha256:3fb7cf50b47693e7b80f6f74abea2def4d7386016931d61359864de8a0aba551
195195
ports:
196196
- "25:25"
197197
- "143:143"
@@ -235,7 +235,7 @@ jobs:
235235
ports:
236236
- "1433:1433"
237237
devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
238-
image: mcr.microsoft.com/azure-storage/azurite:latest
238+
image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
239239
ports:
240240
- 10000:10000
241241
steps:

‎.github/workflows/release-nightly.yml‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,20 @@ jobs:
4040
gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
4141
passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
4242
- name: sign binaries
43+
env:
44+
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
45+
GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
4346
run: |
4447
for f in dist/release/*; do
45-
echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
48+
echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
4649
done
4750
# clean branch name to get the folder name in S3
4851
- name: Get cleaned branch name
4952
id: clean_name
53+
env:
54+
REF: ${{ github.ref }}
5055
run: |
51-
REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
56+
REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
5257
echo "Cleaned name is ${REF_NAME}"
5358
echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
5459
- name: configure aws
@@ -58,8 +63,11 @@ jobs:
5863
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
5964
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
6065
- name: upload binaries to s3
66+
env:
67+
AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
68+
BRANCH: ${{ steps.clean_name.outputs.branch }}
6169
run: |
62-
aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
70+
aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
6371
6472
nightly-container:
6573
runs-on: namespace-profile-gitea-release-docker
@@ -75,8 +83,10 @@ jobs:
7583
- uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
7684
- name: Get cleaned branch name
7785
id: clean_name
86+
env:
87+
REF: ${{ github.ref }}
7888
run: |
79-
REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
89+
REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
8090
echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
8191
- uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
8292
id: meta

‎.github/workflows/release-tag-rc.yml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,20 @@ jobs:
4141
gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
4242
passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
4343
- name: sign binaries
44+
env:
45+
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
46+
GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
4447
run: |
4548
for f in dist/release/*; do
46-
echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
49+
echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
4750
done
4851
# clean branch name to get the folder name in S3
4952
- name: Get cleaned branch name
5053
id: clean_name
54+
env:
55+
REF: ${{ github.ref }}
5156
run: |
52-
REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
57+
REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
5358
echo "Cleaned name is ${REF_NAME}"
5459
echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
5560
- name: configure aws
@@ -59,17 +64,21 @@ jobs:
5964
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
6065
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
6166
- name: upload binaries to s3
67+
env:
68+
AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
69+
BRANCH: ${{ steps.clean_name.outputs.branch }}
6270
run: |
63-
aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
71+
aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
6472
- name: Install GH CLI
6573
uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
6674
with:
6775
gh-cli-version: 2.39.1
6876
- name: create github release
69-
run: |
70-
gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --draft --notes-from-tag dist/release/*
7177
env:
7278
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
79+
TAG: ${{ github.ref_name }}
80+
run: |
81+
gh release create "$TAG" --title "$TAG" --draft --notes-from-tag dist/release/*
7382
7483
container:
7584
runs-on: namespace-profile-gitea-release-docker

‎.github/workflows/release-tag-version.yml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -44,15 +44,20 @@ jobs:
4444
gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
4545
passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
4646
- name: sign binaries
47+
env:
48+
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
49+
GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
4750
run: |
4851
for f in dist/release/*; do
49-
echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
52+
echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
5053
done
5154
# clean branch name to get the folder name in S3
5255
- name: Get cleaned branch name
5356
id: clean_name
57+
env:
58+
REF: ${{ github.ref }}
5459
run: |
55-
REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
60+
REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
5661
echo "Cleaned name is ${REF_NAME}"
5762
echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
5863
- name: configure aws
@@ -62,17 +67,21 @@ jobs:
6267
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
6368
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
6469
- name: upload binaries to s3
70+
env:
71+
AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
72+
BRANCH: ${{ steps.clean_name.outputs.branch }}
6573
run: |
66-
aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
74+
aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
6775
- name: Install GH CLI
6876
uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
6977
with:
7078
gh-cli-version: 2.39.1
7179
- name: create github release
72-
run: |
73-
gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --notes-from-tag dist/release/*
7480
env:
7581
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
82+
TAG: ${{ github.ref_name }}
83+
run: |
84+
gh release create "$TAG" --title "$TAG" --notes-from-tag dist/release/*
7685
7786
container:
7887
runs-on: namespace-profile-gitea-release-docker

‎Makefile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -344,8 +344,9 @@ lint-editorconfig:
344344
@$(GO) run $(EDITORCONFIG_CHECKER_PACKAGE) $(EDITORCONFIG_FILES)
345345

346346
.PHONY: lint-actions
347-
lint-actions: ## lint action workflow files
348-
$(GO) run $(ACTIONLINT_PACKAGE)
347+
lint-actions: .venv ## lint action workflow files
348+
@$(GO) run $(ACTIONLINT_PACKAGE)
349+
@uv run --frozen zizmor --quiet --min-confidence=medium .github
349350

350351
.PHONY: lint-templates
351352
lint-templates: .venv node_modules ## lint template files

‎pyproject.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ requires-python = ">=3.10"
77
dev = [
88
"djlint==1.36.4",
99
"yamllint==1.38.0",
10+
"zizmor==1.25.1",
1011
]
1112

1213
[tool.djlint]

‎uv.lock‎

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)