From 82cb180cd421cd8128486983449a5bf1edf0afa1 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 02:37:15 +0300 Subject: fix zizmor warnings --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index df69ff6..5ed5e67 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,8 @@ on: push: workflow_dispatch: +permissions: {} + jobs: test_local: strategy: @@ -15,6 +17,7 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false submodules: recursive - name: Install dependencies @@ -46,6 +49,7 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false submodules: recursive - name: Test run: make 'test/docker/${{ matrix.distro }}' @@ -76,6 +80,7 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: true ref: aur submodules: recursive token: '${{ secrets.GH_TOKEN }}' -- cgit v1.3 From 14532804b58d30fb54c97c8c083d1c9b8e1f42c6 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 02:40:39 +0300 Subject: workflows/ci: terser --- .github/workflows/ci.yml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5ed5e67..3c8d1f3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,16 +10,17 @@ jobs: test_local: strategy: matrix: - os: [ubuntu-latest, macos-latest] - runs-on: '${{ matrix.os }}' - name: 'Test / ${{ matrix.os }}' + os: + - ubuntu-latest + - macos-latest + runs-on: ${{ matrix.os }} + name: Test / ${{ matrix.os }} steps: - name: Checkout uses: actions/checkout@v7 with: persist-credentials: false submodules: recursive - - name: Install dependencies run: | brew install bash coreutils findutils @@ -28,7 +29,6 @@ jobs: if: runner.os == 'macOS' # Is it even macOS anymore? It is for me. I really am too lazy to deal # with ancient utilities that come with the actual macOS. - - name: Test run: make test @@ -44,7 +44,7 @@ jobs: - noble - resolute runs-on: ubuntu-latest - name: 'Test / Docker / ${{ matrix.distro }}' + name: Test / Docker / ${{ matrix.distro }} steps: - name: Checkout uses: actions/checkout@v7 @@ -52,7 +52,8 @@ jobs: persist-credentials: false submodules: recursive - name: Test - run: make 'test/docker/${{ matrix.distro }}' + run: | + make 'test/docker/${{ matrix.distro }}' aur: name: Publish to AUR @@ -65,9 +66,6 @@ jobs: && !startsWith(github.ref, 'refs/tags/debian/') container: image: archlinux:base-devel - env: - SSH_KEY: | - ${{ secrets.SSH_KEY }} steps: # This step must be done before actions/checkout. From the latter's # output: @@ -83,7 +81,9 @@ jobs: persist-credentials: true ref: aur submodules: recursive - token: '${{ secrets.GH_TOKEN }}' + token: ${{ secrets.GH_TOKEN }} - name: Run maintenance + env: + SSH_KEY: ${{ secrets.SSH_KEY }} run: | make -C "$GITHUB_WORKSPACE" ci -- cgit v1.3 From 59ff6bcb8e918d35d31b8e344db07aae1c0fc3ff Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 02:43:24 +0300 Subject: workflows/ci: add zizmor job --- .github/workflows/ci.yml | 14 ++++++++++++++ .github/zizmor.yml | 5 +++++ 2 files changed, 19 insertions(+) create mode 100644 .github/zizmor.yml (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3c8d1f3..194faf2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,6 +7,19 @@ on: permissions: {} jobs: + lint: + name: Linting + runs-on: ubuntu-slim + permissions: + security-events: write + steps: + - name: Checkout + uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Run zizmor + uses: zizmorcore/zizmor-action@v0.7.1 + test_local: strategy: matrix: @@ -58,6 +71,7 @@ jobs: aur: name: Publish to AUR needs: + - lint - test_local - test_docker runs-on: ubuntu-latest diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..2ef0d8f --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + '*': ref-pin -- cgit v1.3 From 6e1d3a69338dc04ea60061b90a31fca410e57252 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 02:58:23 +0300 Subject: workflows/ci: do I need the token? Since, you know, there're no workflows to be triggered. --- .github/workflows/ci.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 194faf2..f01bb61 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -92,10 +92,9 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: - persist-credentials: true + persist-credentials: false ref: aur submodules: recursive - token: ${{ secrets.GH_TOKEN }} - name: Run maintenance env: SSH_KEY: ${{ secrets.SSH_KEY }} -- cgit v1.3 From eea96d7117478d4587e32de14354081215db8ba0 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 03:02:35 +0300 Subject: rename a GitHub secret --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f01bb61..8b791f2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -97,6 +97,6 @@ jobs: submodules: recursive - name: Run maintenance env: - SSH_KEY: ${{ secrets.SSH_KEY }} + SSH_KEY: ${{ secrets.AUR_SSH_KEY }} run: | make -C "$GITHUB_WORKSPACE" ci -- cgit v1.3 From 2f86b463d3f57ad3dae6b12d2e2d730b6e7cdea1 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 10:08:19 +0300 Subject: Revert "rename a GitHub secret" This reverts commit eea96d7117478d4587e32de14354081215db8ba0. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8b791f2..f01bb61 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -97,6 +97,6 @@ jobs: submodules: recursive - name: Run maintenance env: - SSH_KEY: ${{ secrets.AUR_SSH_KEY }} + SSH_KEY: ${{ secrets.SSH_KEY }} run: | make -C "$GITHUB_WORKSPACE" ci -- cgit v1.3 From 3e9947694f2e97637e80007d8442450b92f38dd6 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 10:10:05 +0300 Subject: workflows/ci: try actions/checkout w/ ssh-key --- .github/workflows/ci.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f01bb61..13e9f34 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -92,11 +92,10 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: - persist-credentials: false + persist-credentials: true ref: aur + ssh-key: ${{ secrets.SSH_KEY }} submodules: recursive - name: Run maintenance - env: - SSH_KEY: ${{ secrets.SSH_KEY }} run: | make -C "$GITHUB_WORKSPACE" ci -- cgit v1.3 From 635b46c673e078104b857f853ec4ab8c97f5c158 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 10:18:54 +0300 Subject: Revert "workflows/ci: try actions/checkout w/ ssh-key" This reverts commit 3e9947694f2e97637e80007d8442450b92f38dd6. --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 13e9f34..4b972bb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -94,8 +94,9 @@ jobs: with: persist-credentials: true ref: aur - ssh-key: ${{ secrets.SSH_KEY }} submodules: recursive - name: Run maintenance + env: + SSH_KEY: ${{ secrets.SSH_KEY }} run: | make -C "$GITHUB_WORKSPACE" ci -- cgit v1.3 From 4ec679f7671b13e66deaf155643af629b7ca536a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 10:44:49 +0300 Subject: workflows/ci: try asking for token permissions --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) (limited to '.github/workflows') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4b972bb..c1c6e02 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -80,6 +80,8 @@ jobs: && !startsWith(github.ref, 'refs/tags/debian/') container: image: archlinux:base-devel + permissions: + contents: write steps: # This step must be done before actions/checkout. From the latter's # output: -- cgit v1.3