diff options
Diffstat (limited to '.github')
| -rw-r--r-- | .github/dependabot.yml | 11 | ||||
| -rw-r--r-- | .github/workflows/ci.yml | 42 | ||||
| -rw-r--r-- | .github/zizmor.yml | 5 |
3 files changed, 47 insertions, 11 deletions
diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e65fe41..6542be1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,8 +4,19 @@ updates: directory: / schedule: interval: weekly + cooldown: + default-days: 7 - package-ecosystem: github-actions directory: / schedule: interval: weekly target-branch: debian + cooldown: + default-days: 7 + - package-ecosystem: gitsubmodule + directories: + - '**/*' + schedule: + interval: weekly + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index df69ff6..c1c6e02 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,19 +4,36 @@ on: push: workflow_dispatch: +permissions: {} + jobs: + lint: + name: Linting + runs-on: ubuntu-slim + permissions: + security-events: write + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run zizmor + uses: zizmorcore/zizmor-action@v0.7.1 + test_local: strategy: matrix: - os: [ubuntu-latest, macos-latest] - runs-on: '${{ matrix.os }}' - name: 'Test / ${{ matrix.os }}' + os: + - ubuntu-latest + - macos-latest + runs-on: ${{ matrix.os }} + name: Test / ${{ matrix.os }} steps: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false submodules: recursive - - name: Install dependencies run: | brew install bash coreutils findutils @@ -25,7 +42,6 @@ jobs: if: runner.os == 'macOS' # Is it even macOS anymore? It is for me. I really am too lazy to deal # with ancient utilities that come with the actual macOS. - - name: Test run: make test @@ -41,18 +57,21 @@ jobs: - noble - resolute runs-on: ubuntu-latest - name: 'Test / Docker / ${{ matrix.distro }}' + name: Test / Docker / ${{ matrix.distro }} steps: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false submodules: recursive - name: Test - run: make 'test/docker/${{ matrix.distro }}' + run: | + make 'test/docker/${{ matrix.distro }}' aur: name: Publish to AUR needs: + - lint - test_local - test_docker runs-on: ubuntu-latest @@ -61,9 +80,8 @@ jobs: && !startsWith(github.ref, 'refs/tags/debian/') container: image: archlinux:base-devel - env: - SSH_KEY: | - ${{ secrets.SSH_KEY }} + permissions: + contents: write steps: # This step must be done before actions/checkout. From the latter's # output: @@ -76,9 +94,11 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: true ref: aur submodules: recursive - token: '${{ secrets.GH_TOKEN }}' - name: Run maintenance + env: + SSH_KEY: ${{ secrets.SSH_KEY }} run: | make -C "$GITHUB_WORKSPACE" ci diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..2ef0d8f --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + '*': ref-pin |