Skip to content
Merged
Changes from 1 commit
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
32951b8
Add an Actionlint workflow.
johnbillion Feb 10, 2025
908465e
Add Octoscan, Zizmor, and Poutine.
johnbillion Feb 10, 2025
a93c6c9
Replace inline expressions with environment variables.
johnbillion Feb 10, 2025
8480d4e
Be explicit about credential use when checking out a repo.
johnbillion Feb 10, 2025
26e53c3
Be strict about quoting environment variables.
johnbillion Feb 10, 2025
45a258f
Update Zizmor.
johnbillion Feb 11, 2025
571dc91
Update upload-sarif.
johnbillion Feb 11, 2025
4d489d2
Disable the dangerous-write rule in Octoscan for now, to reduce the n…
johnbillion Feb 11, 2025
5ddbdd3
Add some more quoting to prevent word splitting.
johnbillion Feb 11, 2025
5ed7adf
These are false positives.
johnbillion Feb 11, 2025
d1426f7
o_O
johnbillion Feb 11, 2025
5f09ce6
Disable permissions for all available scopes by default.
johnbillion Feb 11, 2025
8450599
Add explicit permissions for all jobs.
johnbillion Feb 11, 2025
354cd3d
Remove use of the npm cache during the build.
johnbillion Feb 11, 2025
e32c9b0
Not much we can do about local actions.
johnbillion Feb 11, 2025
d6f5a6d
Replace some more inline expressions with environment variables.
johnbillion Feb 11, 2025
17c4dd3
Merge branch 'trunk' into harden-workflows
johnbillion Mar 2, 2025
8977e1f
Remove another inline expression.
johnbillion Mar 2, 2025
2ca9e32
Another round of updates to address shellcheck concerns.
johnbillion Mar 2, 2025
2678d27
Don't redirect to the same file that's being read.
johnbillion Mar 2, 2025
9b437c9
The `-ignore` flag is, ironically, being ignored. Let's see if the is…
johnbillion Mar 2, 2025
02a3fbf
More adjustments to the actionlint config.
johnbillion Mar 3, 2025
28655e8
Whoops.
johnbillion Mar 3, 2025
c1e6cbb
Update zizmor for one final check.
johnbillion Mar 3, 2025
471fa67
Everything is green, so we'll remove Octoscan, Zizmor, and Poutine. U…
johnbillion Mar 3, 2025
a781612
Merge branch 'trunk' into harden-workflows
johnbillion Apr 22, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Everything is green, so we'll remove Octoscan, Zizmor, and Poutine. U…
…se of these will be proposed separately.
  • Loading branch information
johnbillion committed Mar 3, 2025
commit 471fa6790be9810436b6baa6a7cb11344f0de6ab
79 changes: 0 additions & 79 deletions .github/workflows/reusable-workflow-lint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -35,82 +35,3 @@ jobs:
uses: docker://rhysd/actionlint:1.7.7
with:
args: '-color -verbose'

octoscan:
name: Octoscan
runs-on: ubuntu-latest
permissions:
security-events: write
actions: read
contents: read
timeout-minutes: 10
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

- name: Run octoscan
id: octoscan
uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0
with:
filter_triggers: ''
# dangerous-write: Valid but ignored because we have to use these writes
# dangerous-checkout: Three false positives
# local-action: Not much we can do about this
disable_rules: dangerous-write,dangerous-checkout,local-action

- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
with:
sarif_file: ${{steps.octoscan.outputs.sarif_output}}
category: octoscan

zizmor:
name: Zizmor
runs-on: ubuntu-latest
permissions:
security-events: write
actions: read
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

- name: Install the latest version of uv
uses: astral-sh/setup-uv@b5f58b2abc5763ade55e4e9d0fe52cd1ff7979ca # v5.2.1

# https://github.com/woodruffw/zizmor
- name: Run zizmor
run: uvx zizmor@1.4.1 --format sarif . > results.sarif
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
with:
sarif_file: results.sarif
category: zizmor

poutine:
name: Poutine
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

- name: Run Poutine
uses: boostsecurityio/poutine-action@84c0a0d32e8d57ae12651222be1eb15351429228 # v0.15.2

- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
with:
sarif_file: results.sarif
category: poutine
Loading