Skip to content

Commit 3adc04c

Browse files
2bndy52bndy5
committed
add: statically analyze CI workflows
resolves #6 - includes changes to satisfy warnings/errors raised by zizmor
1 parent 724d561 commit 3adc04c

File tree

9 files changed

+47
-4
lines changed

9 files changed

+47
-4
lines changed

‎.github/workflows/ci-check.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
on:
2+
workflow_call:
3+
push:
4+
branches: [main]
5+
pull_request:
6+
branches: [main]
7+
8+
permissions: {}
9+
10+
jobs:
11+
check-ci-workflows:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
steps:
16+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
17+
with:
18+
persist-credentials: false
19+
repository: ${{ github.repository }}
20+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5
21+
with:
22+
python-version: '3.x'
23+
- name: Run zizmor
24+
env:
25+
GH_TOKEN: ${{ github.token }}
26+
run: pipx run zizmor .github/workflows/*.yml

‎.github/workflows/codeql.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ jobs:
4444
steps:
4545
- name: Checkout repository
4646
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
47+
with:
48+
persist-credentials: false
4749

4850
# Initializes the CodeQL tools for scanning.
4951
- name: Initialize CodeQL

‎.github/workflows/main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
pull_request:
77
branches: [main]
88

9+
permissions: {}
10+
911
jobs:
1012
main:
1113
uses: ./.github/workflows/pre-commit.yml

‎.github/workflows/mkdocs.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ jobs:
88
runs-on: ubuntu-latest
99
steps:
1010
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
11+
with:
12+
persist-credentials: false
1113
- uses: astral-sh/setup-uv@557e51de59eb14aaaba2ed9621916900a91d50c6 # v6.6.1
1214
- name: Install dependencies
1315
run: uv sync --group docs

‎.github/workflows/pre-commit.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,9 @@ jobs:
2222
python-version: '3.x'
2323
- name: Run commands
2424
if: inputs.commands
25-
run: ${{ inputs.commands }}
25+
run: ${INPUTS_COMMANDS}
26+
env:
27+
INPUTS_COMMANDS: ${{ inputs.commands }}
2628
- name: Cache pre-commit environments
2729
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
2830
with:

‎.github/workflows/py-coverage.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ jobs:
99

1010
steps:
1111
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
12+
with:
13+
persist-credentials: false
1214

1315
- name: Download all artifacts
1416
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 #v5

‎.github/workflows/py-publish.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ jobs:
1717
# use fetch --all for setuptools_scm to work
1818
with:
1919
fetch-depth: 0
20+
persist-credentials: false
2021
- name: Set up Python
2122
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5
2223
with:
@@ -37,14 +38,14 @@ jobs:
3738
subject-path: 'dist/*'
3839

3940
- name: Publish package (to TestPyPI)
40-
if: github.event_name == 'workflow_dispatch' && startsWith(github.repository, 'cpp-linter')
41+
if: startsWith(github.repository, 'cpp-linter') && !startsWith(github.ref, 'refs/tags/')
4142
env:
4243
TWINE_USERNAME: __token__
4344
TWINE_PASSWORD: ${{ secrets.TEST_PYPI_TOKEN }}
4445
run: twine upload --repository testpypi dist/*
4546

4647
- name: Publish package (to PyPI)
47-
if: github.event_name != 'workflow_dispatch' && startsWith(github.repository, 'cpp-linter')
48+
if: startsWith(github.repository, 'cpp-linter') && startsWith(github.ref, 'refs/tags/')
4849
env:
4950
TWINE_USERNAME: __token__
5051
TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}

‎.github/workflows/snyk-container.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ jobs:
88
runs-on: ubuntu-latest
99
steps:
1010
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
11+
with:
12+
persist-credentials: false
1113
- name: Run Snyk to check Docker image for vulnerabilities
1214
continue-on-error: true
1315
uses: snyk/actions/docker@b98d498629f1c368650224d6d212bf7dfa89e4bf #v0.4.0

‎.github/workflows/sphinx.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,17 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
17+
with:
18+
persist-credentials: false
1719
- uses: astral-sh/setup-uv@557e51de59eb14aaaba2ed9621916900a91d50c6 # v6.6.1
1820

1921
- name: Install dependencies
2022
run: uv sync --group docs
2123

2224
- name: Build docs
23-
run: uv run sphinx-build docs ${{ inputs.path-to-doc }}
25+
run: uv run sphinx-build docs ${INPUTS_PATH_TO_DOC}
26+
env:
27+
INPUTS_PATH_TO_DOC: ${{ inputs.path-to-doc }}
2428

2529
- name: Upload docs build as artifact
2630
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4

0 commit comments

Comments
 (0)