Skip to content

Commit 93c1236

Browse files
cpovirkDagger Team
cpovirk
authored and
Dagger Team
committed
Address zizmor findings:
- [`persist-credentials: false`](https://docs.zizmor.sh/audits/#artipacked) - [pinning `uses`](https://docs.zizmor.sh/audits/#unpinned-uses) - [shell syntax for environment variables instead of template expansions](https://docs.zizmor.sh/audits/#template-injection) - [excessive permissions](https://docs.zizmor.sh/audits/#excessive-permissions) There may be other findings, but these are the easy one. RELNOTES=n/a PiperOrigin-RevId: 957369925
1 parent 5e71f63 commit 93c1236

2 files changed

Lines changed: 74 additions & 31 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,18 @@ jobs:
3030
name: 'Validate Dagger version'
3131
runs-on: ubuntu-latest
3232
steps:
33-
- uses: actions/checkout@v4
33+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
34+
with:
35+
persist-credentials: false
3436
- uses: ./.github/actions/prechecks
3537
bazel-build:
3638
name: 'Bazel build'
3739
needs: validate-latest-dagger-version
3840
runs-on: ubuntu-latest
3941
steps:
40-
- uses: actions/checkout@v4
42+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
43+
with:
44+
persist-credentials: false
4145
- uses: ./.github/actions/bazel-build
4246
bazel-test:
4347
name: 'Bazel tests'
@@ -46,22 +50,28 @@ jobs:
4650
group: large-runner-group
4751
labels: ubuntu-22.04-16core
4852
steps:
49-
- uses: actions/checkout@v4
53+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
54+
with:
55+
persist-credentials: false
5056
- uses: ./.github/actions/bazel-test
5157
gradle-build:
5258
name: 'Gradle build'
5359
runs-on:
5460
group: large-runner-group
5561
labels: ubuntu-22.04-16core
5662
steps:
57-
- uses: actions/checkout@v4
63+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
64+
with:
65+
persist-credentials: false
5866
- uses: ./.github/actions/gradle-build
5967
artifact-verification-tests:
6068
name: 'Artifact verification tests'
6169
needs: bazel-build
6270
runs-on: ubuntu-latest
6371
steps:
64-
- uses: actions/checkout@v4
72+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
73+
with:
74+
persist-credentials: false
6575
- uses: ./.github/actions/artifact-verification-tests
6676
run-artifact-java-local-tests:
6777
name: 'Artifact Java local tests (Java ${{ matrix.java }}, Kotlin ${{ matrix.kotlin }})'
@@ -82,7 +92,9 @@ jobs:
8292
USE_KOTLIN_VERSION: ${{ matrix.kotlin }}
8393
USE_KSP_VERSION: ${{ matrix.ksp }}
8494
steps:
85-
- uses: actions/checkout@v4
95+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
96+
with:
97+
persist-credentials: false
8698
- uses: ./.github/actions/artifact-java-local-tests
8799
artifact-java-local-tests:
88100
name: 'Artifact Java local tests'
@@ -95,7 +107,9 @@ jobs:
95107
needs: bazel-build
96108
runs-on: ubuntu-latest
97109
steps:
98-
- uses: actions/checkout@v4
110+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
111+
with:
112+
persist-credentials: false
99113
- uses: ./.github/actions/test-gradle-plugin
100114
run-artifact-android-local-tests:
101115
name: 'Artifact Android local tests (AGP ${{ matrix.agp }}, Java ${{ matrix.java }}, Kotlin ${{ matrix.kotlin }})'
@@ -119,7 +133,9 @@ jobs:
119133
USE_KOTLIN_VERSION: ${{ matrix.kotlin }}
120134
USE_KSP_VERSION: ${{ matrix.ksp }}
121135
steps:
122-
- uses: actions/checkout@v4
136+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
137+
with:
138+
persist-credentials: false
123139
- uses: ./.github/actions/artifact-android-local-tests
124140
artifact-android-local-tests:
125141
name: 'Artifact Android local tests'
@@ -138,7 +154,9 @@ jobs:
138154
matrix:
139155
api-level: [23, 26, 30]
140156
steps:
141-
- uses: actions/checkout@v4
157+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
158+
with:
159+
persist-credentials: false
142160
- uses: ./.github/actions/artifact-android-emulator-tests
143161
timeout-minutes: 35
144162
with:
@@ -160,17 +178,19 @@ jobs:
160178
contents: write
161179
steps:
162180
- name: 'Install Java ${{ env.USE_JAVA_VERSION_FOR_BAZEL }}'
163-
uses: actions/setup-java@v4
181+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
164182
with:
165183
distribution: '${{ env.USE_JAVA_DISTRIBUTION }}'
166184
java-version: '${{ env.USE_JAVA_VERSION_FOR_BAZEL }}'
167185
server-id: sonatype-central-snapshots
168186
server-username: CI_DEPLOY_USERNAME
169187
server-password: CI_DEPLOY_PASSWORD
170188
- name: 'Check out repository'
171-
uses: actions/checkout@v4
189+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
190+
with:
191+
persist-credentials: false
172192
- name: 'Cache local Maven repository'
173-
uses: actions/cache@v4
193+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
174194
with:
175195
path: |
176196
~/.m2/repository
@@ -179,14 +199,14 @@ jobs:
179199
restore-keys: |
180200
${{ runner.os }}-maven-
181201
- name: 'Cache Bazel files'
182-
uses: actions/cache@v4
202+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
183203
with:
184204
path: ~/.cache/bazel_github # The bazel cache path set in .bazelrc.
185205
key: ${{ runner.os }}-bazel-build-${{ github.sha }}
186206
restore-keys: |
187207
${{ runner.os }}-bazel-build-
188208
- name: 'Cache Gradle files'
189-
uses: actions/cache@v4
209+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
190210
with:
191211
path: |
192212
~/.gradle/caches
@@ -221,7 +241,9 @@ jobs:
221241
needs: bazel-build
222242
runs-on: ubuntu-latest
223243
steps:
224-
- uses: actions/checkout@v4
244+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
245+
with:
246+
persist-credentials: false
225247
- uses: ./.github/actions/build-gradle-plugin
226248
with:
227249
agp: '+'
@@ -238,5 +260,7 @@ jobs:
238260
]
239261
runs-on: ubuntu-latest
240262
steps:
241-
- uses: actions/checkout@v4
263+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
264+
with:
265+
persist-credentials: false
242266
- uses: ./.github/actions/cleanup-caches

‎.github/workflows/release.yml‎

Lines changed: 34 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ concurrency:
1212
group: ${{ github.workflow }}-${{ github.ref }}
1313
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
1414

15+
permissions:
16+
contents: read
17+
1518
env:
1619
USE_AGP_VERSION: '9.0.0'
1720
USE_JAVA_DISTRIBUTION: 'zulu'
@@ -29,14 +32,18 @@ jobs:
2932
name: 'Validate Dagger version'
3033
runs-on: ubuntu-latest
3134
steps:
32-
- uses: actions/checkout@v4
35+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
36+
with:
37+
persist-credentials: false
3338
- uses: ./.github/actions/prechecks
3439
bazel-build:
3540
name: 'Bazel build'
3641
needs: validate-latest-dagger-version
3742
runs-on: ubuntu-latest
3843
steps:
39-
- uses: actions/checkout@v4
44+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
45+
with:
46+
persist-credentials: false
4047
- uses: ./.github/actions/bazel-build
4148
bazel-test:
4249
name: 'Bazel tests'
@@ -45,35 +52,45 @@ jobs:
4552
group: large-runner-group
4653
labels: ubuntu-22.04-16core
4754
steps:
48-
- uses: actions/checkout@v4
55+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
56+
with:
57+
persist-credentials: false
4958
- uses: ./.github/actions/bazel-test
5059
artifact-verification-tests:
5160
name: 'Artifact verification tests'
5261
needs: bazel-build
5362
runs-on: ubuntu-latest
5463
steps:
55-
- uses: actions/checkout@v4
64+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
65+
with:
66+
persist-credentials: false
5667
- uses: ./.github/actions/artifact-verification-tests
5768
artifact-java-local-tests:
5869
name: 'Artifact Java local tests'
5970
needs: bazel-build
6071
runs-on: ubuntu-latest
6172
steps:
62-
- uses: actions/checkout@v4
73+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
74+
with:
75+
persist-credentials: false
6376
- uses: ./.github/actions/artifact-java-local-tests
6477
test-gradle-plugin:
6578
name: 'Test Hilt Gradle plugin'
6679
needs: bazel-build
6780
runs-on: ubuntu-latest
6881
steps:
69-
- uses: actions/checkout@v4
82+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
83+
with:
84+
persist-credentials: false
7085
- uses: ./.github/actions/test-gradle-plugin
7186
artifact-android-local-tests:
7287
name: 'Artifact Android local tests'
7388
needs: bazel-build
7489
runs-on: ubuntu-latest
7590
steps:
76-
- uses: actions/checkout@v4
91+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
92+
with:
93+
persist-credentials: false
7794
- uses: ./.github/actions/artifact-android-local-tests
7895
publish-artifacts:
7996
name: 'Publish Artifact'
@@ -89,7 +106,7 @@ jobs:
89106
contents: write
90107
steps:
91108
- name: 'Install Java ${{ env.USE_JAVA_VERSION_FOR_BAZEL }}'
92-
uses: actions/setup-java@v4
109+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
93110
with:
94111
distribution: '${{ env.USE_JAVA_DISTRIBUTION }}'
95112
java-version: '${{ env.USE_JAVA_VERSION_FOR_BAZEL }}'
@@ -99,9 +116,11 @@ jobs:
99116
gpg-private-key: ${{ secrets.CI_GPG_PRIVATE_KEY }}
100117
gpg-passphrase: CI_GPG_PASSPHRASE
101118
- name: 'Check out repository'
102-
uses: actions/checkout@v4
119+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
120+
with:
121+
persist-credentials: false
103122
- name: 'Cache local Maven repository'
104-
uses: actions/cache@v4
123+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
105124
with:
106125
path: |
107126
~/.m2/repository
@@ -110,14 +129,14 @@ jobs:
110129
restore-keys: |
111130
${{ runner.os }}-maven-
112131
- name: 'Cache Bazel files'
113-
uses: actions/cache@v4
132+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
114133
with:
115134
path: ~/.cache/bazel_github # The bazel cache path set in .bazelrc.
116135
key: ${{ runner.os }}-bazel-build-${{ github.sha }}
117136
restore-keys: |
118137
${{ runner.os }}-bazel-build-
119138
- name: 'Cache Gradle files'
120-
uses: actions/cache@v4
139+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
121140
with:
122141
path: |
123142
~/.gradle/caches
@@ -129,7 +148,7 @@ jobs:
129148
run: |
130149
util/deploy-all.sh \
131150
"gpg:sign-and-deploy-file" \
132-
"${{ env.DAGGER_RELEASE_VERSION }}" \
151+
"${DAGGER_RELEASE_VERSION}" \
133152
"-DrepositoryId=sonatype-central-staging" \
134153
"-Durl=https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/"
135154
shell: bash
@@ -148,10 +167,10 @@ jobs:
148167
git config --global user.name "Dagger Team"
149168
shell: bash
150169
- name: 'Publish tagged release'
151-
run: util/publish-tagged-release.sh ${{ env.DAGGER_RELEASE_VERSION }}
170+
run: util/publish-tagged-release.sh ${DAGGER_RELEASE_VERSION}
152171
shell: bash
153172
- name: 'Publish tagged docs'
154-
run: util/publish-tagged-docs.sh ${{ env.DAGGER_RELEASE_VERSION }}
173+
run: util/publish-tagged-docs.sh ${DAGGER_RELEASE_VERSION}
155174
shell: bash
156175
env:
157176
GH_TOKEN: ${{ github.token }}

0 commit comments

Comments
 (0)