zi0Black
|
265af8a183
|
ci: harden GitHub Actions workflows (zizmor audit)
- Pin all unpinned action refs to immutable commit SHAs (tag
immutability verified via GitHub rulesets API for each repo;
all returned false/empty so SHA pinning applied)
- Add top-level `permissions: contents: read` to ci.yml, test.yml,
and validate.yml (publish.yml already had per-job permissions)
- Add `persist-credentials: false` to all actions/checkout steps
to prevent credential leakage through GitHub Actions artifacts
Findings addressed: unpinned-uses (40 errors), excessive-permissions
(27 warnings), artipacked (26 warnings) — 93 findings total
Actions pinned:
actions/checkout v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5
actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978
docker/setup-qemu-action v3 -> c7c53464625b32c7a7e944ae62b3e17d2b600130
docker/build-push-action v6 -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8
docker/build-push-action master -> 789f68658055d3ca993799b232b5c46dfe3f114d
docker/bake-action v5 -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad
crazy-max/ghaction-dump-context v2 -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8
codecov/codecov-action v4 -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
crazy-max/.github install-k3s -> already SHA-pinned (skipped)
|
2026-05-14 00:34:57 +02:00 |
|
dependabot[bot]
|
e9ab4c6a14
|
build(deps): bump docker/bake-action from 4 to 5
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 4 to 5.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v4...v5)
---
updated-dependencies:
- dependency-name: docker/bake-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2024-06-18 04:09:56 +00:00 |
|
dependabot[bot]
|
524ee0563f
|
build(deps): bump docker/bake-action from 3 to 4
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 3 to 4.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v3...v4)
---
updated-dependencies:
- dependency-name: docker/bake-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-09-13 04:57:52 +00:00 |
|
CrazyMax
|
2afcb42c88
|
ci: missing concurrency checks
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-09-05 11:09:23 +02:00 |
|
dependabot[bot]
|
23d726350c
|
Bump actions/checkout from 3 to 4
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-09-05 04:34:21 +00:00 |
|
dependabot[bot]
|
8ec3610541
|
Bump docker/bake-action from 2 to 3
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 2 to 3.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v2...v3)
---
updated-dependencies:
- dependency-name: docker/bake-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
|
2023-04-19 04:57:04 +00:00 |
|
CrazyMax
|
81d4866861
|
ci: split validate and test workflow
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
|
2023-03-12 13:58:14 +01:00 |
|