From b6367b0843e4fd1629675a9a5efcb60940954910 Mon Sep 17 00:00:00 2001 From: Michael McQuade Date: Fri, 2 Oct 2026 22:03:21 -0500 Subject: [PATCH] chore(ci): pin actions to commit SHAs and lint workflows with zizmor Every action is pinned to a commit SHA and checkouts no longer persist the token. release-please gets its write permissions on the job only, plus a timeout and a concurrency group. A new workflows job runs zizmor so these rules stay enforced. govulncheck is installed at a fixed version, and Dependabot waits 7 days before proposing a new release. --- .github/dependabot.yml | 4 +++ .github/workflows/ci.yml | 39 +++++++++++++++++++++------- .github/workflows/codeql.yml | 15 ++++++----- .github/workflows/release-please.yml | 17 ++++++++---- 4 files changed, 54 insertions(+), 21 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f3495dd..2924e3b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,8 @@ updates: directory: / schedule: interval: weekly + cooldown: + default-days: 7 open-pull-requests-limit: 5 commit-message: prefix: "chore(deps)" @@ -17,6 +19,8 @@ updates: directory: / schedule: interval: weekly + cooldown: + default-days: 7 commit-message: prefix: "chore(deps)" groups: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5690742..0547cdb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,9 +24,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -49,10 +51,25 @@ jobs: - name: vet run: go vet ./... - - uses: golangci/golangci-lint-action@v9 + - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.12.2 + workflows: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + # Findings fail the job instead of going to code scanning, which would + # need security-events: write and is unavailable to fork pull requests. + - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + with: + advanced-security: false + annotations: true + test: strategy: fail-fast: false @@ -61,9 +78,11 @@ jobs: runs-on: ${{ matrix.os }} timeout-minutes: 20 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -84,7 +103,7 @@ jobs: go tool cover -func=coverage.out | tail -n 20 >> "$GITHUB_STEP_SUMMARY" echo '```' >> "$GITHUB_STEP_SUMMARY" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: matrix.os == 'ubuntu-latest' with: name: coverage @@ -95,17 +114,19 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # Deliberately not go.mod's version: govulncheck reports standard-library # advisories against the toolchain it runs with, and the go directive names # the minimum supported release rather than the one to build with. - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: stable cache: true - name: govulncheck run: | - go install golang.org/x/vuln/cmd/govulncheck@latest + go install golang.org/x/vuln/cmd/govulncheck@v1.8.0 govulncheck ./... diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index da96780..160200e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -21,23 +21,24 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 permissions: - security-events: write - actions: read + security-events: write # upload results to code scanning steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: go queries: security-and-quality - - uses: github/codeql-action/autobuild@v4 + - uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: /language:go diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 96848e5..7d7037f 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -1,16 +1,23 @@ +name: release-please + on: push: branches: - canary -permissions: - contents: write - pull-requests: write +permissions: {} -name: release-please +# Queue rather than cancel: an interrupted run can leave a release half created. +concurrency: + group: release-please + cancel-in-progress: false jobs: release-please: runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: write # create the tag and GitHub release + pull-requests: write # open and update the release PR steps: - - uses: googleapis/release-please-action@v5 + - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0