Skip to content

Commit 96704eb

Browse files
link2xtlink2xt
committed
ci: audit workflows with zizmor
1 parent 5c3d1e7 commit 96704eb

13 files changed

+93
-2
lines changed

‎.github/workflows/ci.yml

+13
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ on:
1616
branches:
1717
- main
1818

19+
permissions: {}
20+
1921
env:
2022
RUSTFLAGS: -Dwarnings
2123

@@ -29,6 +31,7 @@ jobs:
2931
- uses: actions/checkout@v4
3032
with:
3133
show-progress: false
34+
persist-credentials: false
3235
- name: Install rustfmt and clippy
3336
run: rustup toolchain install $RUSTUP_TOOLCHAIN --profile minimal --component rustfmt --component clippy
3437
- name: Cache rust cargo artifacts
@@ -49,6 +52,7 @@ jobs:
4952
- uses: actions/checkout@v4
5053
with:
5154
show-progress: false
55+
persist-credentials: false
5256
- name: Rebuild constants
5357
run: npm run build:core:constants
5458
- name: Check that constants are not changed
@@ -61,6 +65,7 @@ jobs:
6165
- uses: actions/checkout@v4
6266
with:
6367
show-progress: false
68+
persist-credentials: false
6469
- uses: EmbarkStudios/cargo-deny-action@v2
6570
with:
6671
arguments: --all-features --workspace
@@ -74,6 +79,7 @@ jobs:
7479
- uses: actions/checkout@v4
7580
with:
7681
show-progress: false
82+
persist-credentials: false
7783
- name: Check provider database
7884
run: scripts/update-provider-database.sh
7985

@@ -86,6 +92,7 @@ jobs:
8692
- uses: actions/checkout@v4
8793
with:
8894
show-progress: false
95+
persist-credentials: false
8996
- name: Cache rust cargo artifacts
9097
uses: swatinem/rust-cache@v2
9198
- name: Rustdoc
@@ -111,6 +118,7 @@ jobs:
111118
- uses: actions/checkout@v4
112119
with:
113120
show-progress: false
121+
persist-credentials: false
114122

115123
- name: Install Rust ${{ matrix.rust }}
116124
run: rustup toolchain install --profile minimal ${{ matrix.rust }}
@@ -147,6 +155,7 @@ jobs:
147155
- uses: actions/checkout@v4
148156
with:
149157
show-progress: false
158+
persist-credentials: false
150159

151160
- name: Cache rust cargo artifacts
152161
uses: swatinem/rust-cache@v2
@@ -171,6 +180,7 @@ jobs:
171180
- uses: actions/checkout@v4
172181
with:
173182
show-progress: false
183+
persist-credentials: false
174184

175185
- name: Cache rust cargo artifacts
176186
uses: swatinem/rust-cache@v2
@@ -192,6 +202,7 @@ jobs:
192202
- uses: actions/checkout@v4
193203
with:
194204
show-progress: false
205+
persist-credentials: false
195206

196207
- name: Install tox
197208
run: pip install tox
@@ -234,6 +245,7 @@ jobs:
234245
- uses: actions/checkout@v4
235246
with:
236247
show-progress: false
248+
persist-credentials: false
237249

238250
- name: Download libdeltachat.a
239251
uses: actions/download-artifact@v4
@@ -286,6 +298,7 @@ jobs:
286298
- uses: actions/checkout@v4
287299
with:
288300
show-progress: false
301+
persist-credentials: false
289302

290303
- name: Install python
291304
uses: actions/setup-python@v5

‎.github/workflows/deltachat-rpc-server.yml

+12-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ on:
1717
release:
1818
types: [published]
1919

20+
permissions: {}
21+
2022
jobs:
2123
# Build a version statically linked against musl libc
2224
# to avoid problems with glibc version incompatibility.
@@ -31,6 +33,7 @@ jobs:
3133
- uses: actions/checkout@v4
3234
with:
3335
show-progress: false
36+
persist-credentials: false
3437
- uses: DeterminateSystems/nix-installer-action@main
3538
- uses: DeterminateSystems/magic-nix-cache-action@main
3639

@@ -55,6 +58,7 @@ jobs:
5558
- uses: actions/checkout@v4
5659
with:
5760
show-progress: false
61+
persist-credentials: false
5862
- uses: DeterminateSystems/nix-installer-action@main
5963
- uses: DeterminateSystems/magic-nix-cache-action@main
6064

@@ -80,6 +84,7 @@ jobs:
8084
- uses: actions/checkout@v4
8185
with:
8286
show-progress: false
87+
persist-credentials: false
8388

8489
- name: Setup rust target
8590
run: rustup target add ${{ matrix.arch }}-apple-darwin
@@ -105,6 +110,7 @@ jobs:
105110
- uses: actions/checkout@v4
106111
with:
107112
show-progress: false
113+
persist-credentials: false
108114
- uses: DeterminateSystems/nix-installer-action@main
109115
- uses: DeterminateSystems/magic-nix-cache-action@main
110116

@@ -132,6 +138,7 @@ jobs:
132138
- uses: actions/checkout@v4
133139
with:
134140
show-progress: false
141+
persist-credentials: false
135142
- uses: DeterminateSystems/nix-installer-action@main
136143
- uses: DeterminateSystems/magic-nix-cache-action@main
137144

@@ -258,8 +265,9 @@ jobs:
258265
if: github.event_name == 'release'
259266
env:
260267
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
268+
REF_NAME: ${{ github.ref_name }}
261269
run: |
262-
gh release upload ${{ github.ref_name }} \
270+
gh release upload "$REF_NAME" \
263271
--repo ${{ github.repository }} \
264272
bin/* dist/*
265273
@@ -280,6 +288,7 @@ jobs:
280288
- uses: actions/checkout@v4
281289
with:
282290
show-progress: false
291+
persist-credentials: false
283292
- uses: actions/setup-python@v5
284293
with:
285294
python-version: "3.11"
@@ -385,8 +394,9 @@ jobs:
385394
if: github.event_name == 'release'
386395
env:
387396
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
397+
REF_NAME: ${{ github.ref_name }}
388398
run: |
389-
gh release upload ${{ github.ref_name }} \
399+
gh release upload "$REF_NAME" \
390400
--repo ${{ github.repository }} \
391401
deltachat-rpc-server/npm-package/*.tgz
392402

‎.github/workflows/jsonrpc-client-npm-package.yml

+3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ on:
44
release:
55
types: [published]
66

7+
permissions: {}
8+
79
jobs:
810
pack-module:
911
name: "Publish @deltachat/jsonrpc-client"
@@ -15,6 +17,7 @@ jobs:
1517
- uses: actions/checkout@v4
1618
with:
1719
show-progress: false
20+
persist-credentials: false
1821

1922
- uses: actions/setup-node@v4
2023
with:

‎.github/workflows/jsonrpc.yml

+3
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
pull_request:
77
branches: [main]
88

9+
permissions: {}
10+
911
env:
1012
CARGO_TERM_COLOR: always
1113
RUST_MIN_STACK: "8388608"
@@ -17,6 +19,7 @@ jobs:
1719
- uses: actions/checkout@v4
1820
with:
1921
show-progress: false
22+
persist-credentials: false
2023
- name: Use Node.js 18.x
2124
uses: actions/setup-node@v4
2225
with:

‎.github/workflows/nix.yml

+5
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ on:
1212
branches:
1313
- main
1414

15+
permissions: {}
16+
1517
jobs:
1618
format:
1719
name: check flake formatting
@@ -20,6 +22,7 @@ jobs:
2022
- uses: actions/checkout@v4
2123
with:
2224
show-progress: false
25+
persist-credentials: false
2326
- uses: DeterminateSystems/nix-installer-action@main
2427
- uses: DeterminateSystems/magic-nix-cache-action@main
2528
- run: nix fmt
@@ -80,6 +83,7 @@ jobs:
8083
- uses: actions/checkout@v4
8184
with:
8285
show-progress: false
86+
persist-credentials: false
8387
- uses: DeterminateSystems/nix-installer-action@main
8488
- uses: DeterminateSystems/magic-nix-cache-action@main
8589
- run: nix build .#${{ matrix.installable }}
@@ -99,6 +103,7 @@ jobs:
99103
- uses: actions/checkout@v4
100104
with:
101105
show-progress: false
106+
persist-credentials: false
102107
- uses: DeterminateSystems/nix-installer-action@main
103108
- uses: DeterminateSystems/magic-nix-cache-action@main
104109
- run: nix build .#${{ matrix.installable }}

‎.github/workflows/node-docs.yml

+3
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,16 @@ on:
1010
branches:
1111
- main
1212

13+
permissions: {}
14+
1315
jobs:
1416
generate:
1517
runs-on: ubuntu-latest
1618
steps:
1719
- uses: actions/checkout@v4
1820
with:
1921
show-progress: false
22+
persist-credentials: false
2023

2124
- name: Use Node.js 18.x
2225
uses: actions/setup-node@v4

‎.github/workflows/node-package.yml

+5
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
- "*"
77
- "!py-*"
88

9+
permissions: {}
10+
911
jobs:
1012
prebuild:
1113
name: Prebuild
@@ -17,6 +19,7 @@ jobs:
1719
- uses: actions/checkout@v4
1820
with:
1921
show-progress: false
22+
persist-credentials: false
2023
- uses: actions/setup-node@v4
2124
with:
2225
node-version: "18"
@@ -78,6 +81,7 @@ jobs:
7881
- uses: actions/checkout@v4
7982
with:
8083
show-progress: false
84+
persist-credentials: false
8185
- uses: actions/setup-node@v4
8286
with:
8387
node-version: "18"
@@ -142,6 +146,7 @@ jobs:
142146
- uses: actions/checkout@v4
143147
with:
144148
show-progress: false
149+
persist-credentials: false
145150
- uses: actions/setup-node@v4
146151
with:
147152
node-version: "18"

‎.github/workflows/node-tests.yml

+3
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ on:
1515
branches:
1616
- main
1717

18+
permissions: {}
19+
1820
jobs:
1921
tests:
2022
name: Tests
@@ -26,6 +28,7 @@ jobs:
2628
- uses: actions/checkout@v4
2729
with:
2830
show-progress: false
31+
persist-credentials: false
2932
- uses: actions/setup-node@v4
3033
with:
3134
node-version: "18"

‎.github/workflows/publish-deltachat-rpc-client-pypi.yml

+3
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55
release:
66
types: [published]
77

8+
permissions: {}
9+
810
jobs:
911
build:
1012
name: Build distribution
@@ -14,6 +16,7 @@ jobs:
1416
- uses: actions/checkout@v4
1517
with:
1618
show-progress: false
19+
persist-credentials: false
1720
- name: Install pypa/build
1821
run: python3 -m pip install build
1922
- name: Build a binary wheel and a source tarball

‎.github/workflows/repl.yml

+3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ name: Build Windows REPL .exe
77
on:
88
workflow_dispatch:
99

10+
permissions: {}
11+
1012
jobs:
1113
build_repl:
1214
name: Build REPL example
@@ -15,6 +17,7 @@ jobs:
1517
- uses: actions/checkout@v4
1618
with:
1719
show-progress: false
20+
persist-credentials: false
1821
- uses: DeterminateSystems/nix-installer-action@main
1922
- uses: DeterminateSystems/magic-nix-cache-action@main
2023
- name: Build

‎.github/workflows/upload-docs.yml

+6
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
- main
77
- build_jsonrpc_docs_ci
88

9+
permissions: {}
10+
911
jobs:
1012
build-rs:
1113
runs-on: ubuntu-latest
@@ -14,6 +16,7 @@ jobs:
1416
- uses: actions/checkout@v4
1517
with:
1618
show-progress: false
19+
persist-credentials: false
1720
- name: Build the documentation with cargo
1821
run: |
1922
cargo doc --package deltachat --no-deps --document-private-items
@@ -31,6 +34,7 @@ jobs:
3134
- uses: actions/checkout@v4
3235
with:
3336
show-progress: false
37+
persist-credentials: false
3438
fetch-depth: 0 # Fetch history to calculate VCS version number.
3539
- uses: DeterminateSystems/nix-installer-action@main
3640
- uses: DeterminateSystems/magic-nix-cache-action@main
@@ -50,6 +54,7 @@ jobs:
5054
- uses: actions/checkout@v4
5155
with:
5256
show-progress: false
57+
persist-credentials: false
5358
fetch-depth: 0 # Fetch history to calculate VCS version number.
5459
- uses: DeterminateSystems/nix-installer-action@main
5560
- uses: DeterminateSystems/magic-nix-cache-action@main
@@ -72,6 +77,7 @@ jobs:
7277
- uses: actions/checkout@v4
7378
with:
7479
show-progress: false
80+
persist-credentials: false
7581
fetch-depth: 0 # Fetch history to calculate VCS version number.
7682
- name: Use Node.js
7783
uses: actions/setup-node@v4

0 commit comments

Comments
 (0)