Skip to content

Commit 467e3e6

Browse files
tonistiigitonistiigi
authored
Merge pull request #3742 from crazy-max/zizmor
ci: zizmor workflow
2 parents a7d3578 + d3a40b6 commit 467e3e6

File tree

10 files changed

+96
-102
lines changed

10 files changed

+96
-102
lines changed

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ updates:
55
directory: "/"
66
schedule:
77
interval: "daily"
8+
cooldown:
9+
default-days: 2
810
ignore:
911
# ignore this dependency
1012
# it seems a bug with dependabot as pining to commit sha should not

‎.github/workflows/build.yml‎

Lines changed: 20 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,5 @@
11
name: build
22

3-
# Default to 'contents: read', which grants actions to read commits.
4-
#
5-
# If any permission is set, any permission not included in the list is
6-
# implicitly set to "none".
7-
#
8-
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
93
permissions:
104
contents: read
115

@@ -126,22 +120,22 @@ jobs:
126120
fi
127121
-
128122
name: Checkout
129-
uses: actions/checkout@v6
123+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
130124
with:
131125
fetch-depth: 0
132126
-
133127
name: Set up QEMU
134-
uses: docker/setup-qemu-action@v4
128+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
135129
-
136130
name: Set up Docker Buildx
137-
uses: docker/setup-buildx-action@v4
131+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
138132
with:
139133
version: ${{ env.SETUP_BUILDX_VERSION }}
140134
driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
141135
buildkitd-flags: --debug
142136
-
143137
name: Build test image
144-
uses: docker/bake-action@v7
138+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
145139
with:
146140
source: .
147141
targets: integration-test
@@ -157,7 +151,7 @@ jobs:
157151
-
158152
name: Send to Codecov
159153
if: always()
160-
uses: codecov/codecov-action@v5
154+
uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
161155
with:
162156
directory: ./bin/testreports
163157
flags: integration
@@ -172,7 +166,7 @@ jobs:
172166
-
173167
name: Upload test reports
174168
if: always()
175-
uses: actions/upload-artifact@v7
169+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
176170
with:
177171
name: test-reports-${{ env.TESTREPORTS_NAME }}
178172
path: ./bin/testreports
@@ -196,10 +190,10 @@ jobs:
196190
git config --global core.eol lf
197191
-
198192
name: Checkout
199-
uses: actions/checkout@v6
193+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
200194
-
201195
name: Set up Go
202-
uses: actions/setup-go@v6
196+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
203197
with:
204198
go-version: "${{ env.GO_VERSION }}"
205199
-
@@ -234,7 +228,7 @@ jobs:
234228
-
235229
name: Send to Codecov
236230
if: always()
237-
uses: codecov/codecov-action@v5
231+
uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
238232
with:
239233
directory: ${{ env.TESTREPORTS_DIR }}
240234
env_vars: RUNNER_OS
@@ -250,7 +244,7 @@ jobs:
250244
-
251245
name: Upload test reports
252246
if: always()
253-
uses: actions/upload-artifact@v7
247+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
254248
with:
255249
name: test-reports-${{ env.TESTREPORTS_NAME }}
256250
path: ${{ env.TESTREPORTS_BASEDIR }}
@@ -265,27 +259,27 @@ jobs:
265259
steps:
266260
-
267261
name: Set up Docker Buildx
268-
uses: docker/setup-buildx-action@v4
262+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
269263
with:
270264
version: ${{ env.SETUP_BUILDX_VERSION }}
271265
driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
272266
buildkitd-flags: --debug
273267
-
274268
name: Run
275-
uses: docker/bake-action@v7
269+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
276270
with:
277271
targets: govulncheck
278272
env:
279273
GOVULNCHECK_FORMAT: sarif
280274
-
281275
name: Upload SARIF report
282276
if: ${{ github.ref == 'refs/heads/master' && github.repository == 'docker/buildx' }}
283-
uses: github/codeql-action/upload-sarif@v4
277+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
284278
with:
285279
sarif_file: ${{ env.DESTDIR }}/govulncheck.out
286280

287281
binaries:
288-
uses: docker/github-builder/.github/workflows/bake.yml@v1
282+
uses: docker/github-builder/.github/workflows/bake.yml@70313223e2665c3211b454b3fea6534624e78d64 # v1.4.0
289283
permissions:
290284
contents: read # same as global permission
291285
id-token: write # for signing attestation(s) with GitHub OIDC Token
@@ -307,7 +301,7 @@ jobs:
307301
steps:
308302
-
309303
name: Download artifacts
310-
uses: actions/download-artifact@v8
304+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
311305
with:
312306
path: /tmp/buildx-output
313307
name: ${{ needs.binaries.outputs.artifact-name }}
@@ -350,7 +344,7 @@ jobs:
350344
find . -type f -exec file -e ascii -- {} +
351345
-
352346
name: Upload release binaries
353-
uses: actions/upload-artifact@v7
347+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
354348
with:
355349
name: release
356350
path: ${{ env.DESTDIR }}/*
@@ -366,7 +360,7 @@ jobs:
366360

367361
bin-image:
368362
if: ${{ github.repository == 'docker/buildx' }}
369-
uses: docker/github-builder/.github/workflows/bake.yml@v1
363+
uses: docker/github-builder/.github/workflows/bake.yml@70313223e2665c3211b454b3fea6534624e78d64 # v1.4.0
370364
needs:
371365
- bin-image-prepare
372366
- test-integration
@@ -409,7 +403,7 @@ jobs:
409403
steps:
410404
-
411405
name: Login to DockerHub
412-
uses: docker/login-action@v4
406+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
413407
with:
414408
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
415409
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
@@ -423,7 +417,7 @@ jobs:
423417
image: registry://${{ env.REPO_SLUG }}:master
424418
-
425419
name: Upload SARIF report
426-
uses: github/codeql-action/upload-sarif@v4
420+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
427421
with:
428422
sarif_file: ${{ steps.scout.outputs.result-file }}
429423

@@ -439,7 +433,7 @@ jobs:
439433
steps:
440434
-
441435
name: Download release binaries
442-
uses: actions/download-artifact@v8
436+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
443437
with:
444438
path: ${{ env.DESTDIR }}
445439
name: release

‎.github/workflows/codeql.yml‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,5 @@
11
name: codeql
22

3-
# Default to 'contents: read', which grants actions to read commits.
4-
#
5-
# If any permission is set, any permission not included in the list is
6-
# implicitly set to "none".
7-
#
8-
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
93
permissions:
104
contents: read
115

@@ -29,22 +23,22 @@ jobs:
2923
steps:
3024
-
3125
name: Checkout
32-
uses: actions/checkout@v6
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3327
-
3428
name: Set up Go
35-
uses: actions/setup-go@v6
29+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
3630
with:
3731
go-version: ${{ env.GO_VERSION }}
3832
-
3933
name: Initialize CodeQL
40-
uses: github/codeql-action/init@v4
34+
uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
4135
with:
4236
languages: go
4337
-
4438
name: Autobuild
45-
uses: github/codeql-action/autobuild@v4
39+
uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
4640
-
4741
name: Perform CodeQL Analysis
48-
uses: github/codeql-action/analyze@v4
42+
uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
4943
with:
5044
category: "/language:go"

‎.github/workflows/docs-release.yml‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,5 @@
11
name: docs-release
22

3-
# Default to 'contents: read', which grants actions to read commits.
4-
#
5-
# If any permission is set, any permission not included in the list is
6-
# implicitly set to "none".
7-
#
8-
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
93
permissions:
104
contents: read
115

@@ -33,30 +27,33 @@ jobs:
3327
steps:
3428
-
3529
name: Checkout docs repo
36-
uses: actions/checkout@v6
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3731
with:
3832
token: ${{ secrets.GHPAT_DOCS_DISPATCH }}
3933
repository: docker/docs
4034
ref: main
4135
-
4236
name: Prepare
37+
env:
38+
INPUT_TAG: ${{ github.event.inputs.tag }}
39+
RELEASE_NAME: ${{ github.event.release.name }}
4340
run: |
4441
rm -rf ./data/buildx/*
45-
if [ -n "${{ github.event.inputs.tag }}" ]; then
46-
echo "RELEASE_NAME=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
42+
if [ -n "${INPUT_TAG}" ]; then
43+
echo "RELEASE_NAME=${INPUT_TAG}" >> $GITHUB_ENV
4744
else
48-
echo "RELEASE_NAME=${{ github.event.release.name }}" >> $GITHUB_ENV
45+
echo "RELEASE_NAME=${RELEASE_NAME}" >> $GITHUB_ENV
4946
fi
5047
-
5148
name: Set up Docker Buildx
52-
uses: docker/setup-buildx-action@v4
49+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
5350
with:
5451
version: ${{ env.SETUP_BUILDX_VERSION }}
5552
driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
5653
buildkitd-flags: --debug
5754
-
5855
name: Generate yaml
59-
uses: docker/bake-action@v7
56+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
6057
with:
6158
source: ${{ github.server_url }}/${{ github.repository }}.git#${{ env.RELEASE_NAME }}
6259
targets: update-docs

‎.github/workflows/docs-upstream.yml‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,6 @@
33
# https://github.com/docker/docker.github.io/blob/98c7c9535063ae4cd2cd0a31478a21d16d2f07a3/docker-bake.hcl#L34-L36
44
name: docs-upstream
55

6-
# Default to 'contents: read', which grants actions to read commits.
7-
#
8-
# If any permission is set, any permission not included in the list is
9-
# implicitly set to "none".
10-
#
11-
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
126
permissions:
137
contents: read
148

@@ -39,14 +33,14 @@ jobs:
3933
steps:
4034
-
4135
name: Set up Docker Buildx
42-
uses: docker/setup-buildx-action@v4
36+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
4337
with:
4438
version: ${{ env.SETUP_BUILDX_VERSION }}
4539
driver-opts: image=${{ env.SETUP_BUILDKIT_IMAGE }}
4640
buildkitd-flags: --debug
4741
-
4842
name: Build reference YAML docs
49-
uses: docker/bake-action@v7
43+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
5044
with:
5145
targets: update-docs
5246
provenance: false
@@ -58,14 +52,14 @@ jobs:
5852
DOCS_FORMATS: yaml
5953
-
6054
name: Upload reference YAML docs
61-
uses: actions/upload-artifact@v7
55+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
6256
with:
6357
name: docs-yaml
6458
path: /tmp/buildx-docs/out/reference
6559
retention-days: 1
6660

6761
validate:
68-
uses: docker/docs/.github/workflows/validate-upstream.yml@main
62+
uses: docker/docs/.github/workflows/validate-upstream.yml@8f0cf552fd0a69bcd19bb3f53a17a346b399673c # main
6963
needs:
7064
- docs-yaml
7165
with:

0 commit comments

Comments
 (0)