Add zizmor audit And fix findings. Drive-by: fix windows build
diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml index f6713bb..db647f4 100644 --- a/.github/workflows/build_test.yml +++ b/.github/workflows/build_test.yml
@@ -112,13 +112,11 @@ - name: cmake-win64:msvc-rel build_system: cmake - cmake_generator: Visual Studio 17 2022 cmake_config: Release os: windows-latest - name: cmake-win64:msvc-dbg build_system: cmake - cmake_generator: Visual Studio 17 2022 cmake_config: Debug os: windows-latest @@ -235,6 +233,7 @@ with: submodules: false fetch-depth: 1 + persist-credentials: false - name: Configure / Build / Test with CMake if: ${{ matrix.build_system == 'cmake' }} @@ -245,7 +244,6 @@ [ ! -z '${{ matrix.c_compiler || '' }}' ] && CMAKE_OPTIONS+=(-DCMAKE_C_COMPILER='${{ matrix.c_compiler }}') [ ! -z '${{ matrix.cxx_compiler || '' }}' ] && CMAKE_OPTIONS+=(-DCMAKE_CXX_COMPILER='${{ matrix.cxx_compiler }}') [ ! -z '${{ matrix.sanitizer || '' }}' ] && CMAKE_OPTIONS+=(-DENABLE_SANITIZER='${{ matrix.sanitizer }}') - [ ! -z '${{ matrix.cmake_generator || '' }}' ] && export CMAKE_GENERATOR='${{ matrix.cmake_generator }}' declare -a CMAKE_BUILD_OPTIONS=() [ ! -z '${{ matrix.cmake_config || '' }}' ] && CMAKE_BUILD_OPTIONS+=(--config '${{ matrix.cmake_config }}') declare -a CMAKE_TEST_OPTIONS=() @@ -356,6 +354,7 @@ with: submodules: false fetch-depth: 1 + persist-credentials: false - name: Build / Test run: |
diff --git a/.github/workflows/build_test_wasm.yml b/.github/workflows/build_test_wasm.yml index 0c8b07c..0595f6b 100644 --- a/.github/workflows/build_test_wasm.yml +++ b/.github/workflows/build_test_wasm.yml
@@ -43,6 +43,7 @@ with: submodules: true fetch-depth: 1 + persist-credentials: false - name: Install node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d9fa1a5..4286653 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml
@@ -41,6 +41,8 @@ - name: Checkout repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 2129dcb..fe030b5 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml
@@ -36,17 +36,24 @@ - name: Checkout repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Install tools run: | eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" - brew install buildifier ruff typos-cli + brew install buildifier ruff typos-cli zizmor - name: Check typos run: | eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" ./scripts/check_typos.sh + - name: Audit workflows + run: | + eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" + zizmor ./.github/workflows + - name: Lint Python code run: | eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
diff --git a/.github/workflows/publish_to_bcr.yaml b/.github/workflows/publish_to_bcr.yaml index a0d9ef5..06d0708 100644 --- a/.github/workflows/publish_to_bcr.yaml +++ b/.github/workflows/publish_to_bcr.yaml
@@ -19,7 +19,7 @@ contents: write id-token: write attestations: write - uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v2 + uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@005a51c75c5027e54477d290a21aa57e0a1a65f5 # 2026.07.03 with: tag_name: ${{ inputs.tag_name }} registry_fork: ${{ inputs.registry_fork }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index bb32037..e38c9e4 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml
@@ -73,21 +73,25 @@ with: submodules: false fetch-depth: 1 + persist-credentials: false - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + if: github.event_name != 'release' id: cache-vcpkg with: path: vcpkg key: release-${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.triplet }} + # TODO(eustas): remove when https://github.com/zizmorcore/zizmor/issues/2071 is fixed + lookup-only: ${{ startsWith(github.ref, 'refs/tags/') }} - name: Download vcpkg - if: steps.cache-vcpkg.outputs.cache-hit != 'true' + if: github.event_name == 'release' || steps.cache-vcpkg.outputs.cache-hit != 'true' shell: 'powershell' run: | Invoke-WebRequest -Uri "https://github.com/microsoft/vcpkg/archive/refs/tags/${{ env.VCPKG_VERSION }}.zip" -OutFile "vcpkg.zip" - name: Bootstrap vcpkg - if: steps.cache-vcpkg.outputs.cache-hit != 'true' + if: github.event_name == 'release' || steps.cache-vcpkg.outputs.cache-hit != 'true' shell: 'bash' run: | set -x @@ -154,6 +158,7 @@ with: submodules: false fetch-depth: 1 + persist-credentials: false - name: Compress testdata run: | @@ -180,6 +185,7 @@ with: submodules: false fetch-depth: 1 + persist-credentials: false - name: Download all artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 @@ -190,8 +196,9 @@ - name: Publish assets env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }} run: | - gh release upload ${{ github.event.release.tag_name }} ./release_assets/* + gh release upload ${GITHUB_EVENT_RELEASE_TAG_NAME} ./release_assets/* archive_build: needs: publish_release_assets @@ -212,6 +219,7 @@ with: submodules: false fetch-depth: 1 + persist-credentials: false - name: Archive run: |