Repository navigation
Bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 (#1086) #425
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Ruby | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read # checkout only, nothing else | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0 | |
| with: | |
| ruby-version: "3.4" | |
| bundler-cache: true | |
| - name: Audit dependencies | |
| run: bundle exec bundle-audit check --update | |
| - name: Audit Ruby runtime | |
| # CVE-2026-41316 is an ERB flaw fixed in Ruby 4.0.3 and not yet backported. | |
| # Ignored on affected rubies only. See: | |
| # https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316/ | |
| # https://github.com/advisories/GHSA-q339-8rmv-2mhv | |
| run: | | |
| ignore="" | |
| if ruby -e 'exit 1 unless Gem::Version.new(RUBY_VERSION) < Gem::Version.new("4.0.3")'; then | |
| ignore="--ignore CVE-2026-41316" | |
| fi | |
| bundle exec ruby-audit check $ignore | |
| zizmor: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Audit workflows | |
| uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 | |
| with: | |
| advanced-security: false # fail the build on findings instead of uploading SARIF | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0 | |
| with: | |
| ruby-version: "3.4" | |
| bundler-cache: true | |
| - name: RuboCop | |
| run: bundle exec rubocop --format github | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ['3.0', 3.1, 3.2, 3.3, 3.4, '4.0', truffleruby, head, truffleruby-head] | |
| # Head builds exist to surface upstream regressions early. | |
| # They should not block the build. | |
| continue-on-error: ${{ matrix.ruby == 'head' || matrix.ruby == 'truffleruby-head' }} | |
| env: | |
| RAILS_ENV: test | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0 | |
| with: | |
| ruby-version: ${{ matrix.ruby }} | |
| bundler-cache: true # bundle installs and caches dependencies | |
| - name: Run tests | |
| run: bundle exec rake --trace | |
| - name: Upload coverage to Coveralls | |
| if: matrix.ruby == '3.4' | |
| uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8 | |
| with: | |
| file: coverage/.resultset.json | |
| format: simplecov | |
| integration: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0 | |
| with: | |
| ruby-version: "3.4" | |
| bundler-cache: true | |
| - name: Run integration tests | |
| run: bundle exec rake spec:integration |