Skip to content

Commit 5b3b010

Browse files
zimegzimeg
committed
ci: pin action hashes and escape variables with minimum permission
1 parent 47b1876 commit 5b3b010

4 files changed

Lines changed: 58 additions & 30 deletions

File tree

‎.github/workflows/develop.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,15 @@ on:
88
jobs:
99
run:
1010
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
1113
steps:
1214
- name: Checkout action
13-
uses: actions/checkout@v4
15+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1416
with:
1517
persist-credentials: false
1618
- name: Setup the Node runtime for this project
17-
uses: actions/setup-node@v4
19+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
1820
with:
1921
cache: npm
2022
cache-dependency-path: package-lock.json

‎.github/workflows/publish.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,13 @@ jobs:
1212
contents: write
1313
steps:
1414
- name: Checkout the current code
15-
uses: actions/checkout@v4
15+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616
with:
1717
persist-credentials: false
1818
ref: ${{ github.event.release.tag_name }}
1919

2020
- name: Configure the runtime node
21-
uses: actions/setup-node@v4
21+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2222
with:
2323
cache: npm
2424
cache-dependency-path: package-lock.json
@@ -31,7 +31,7 @@ jobs:
3131
run: npm run build
3232

3333
- name: Distribute the latest tagged release
34-
uses: teunmooij/[email protected]
34+
uses: teunmooij/github-versioned-release@3edf649c6e5e5e976d43f2584b15bdc8b4c8f0df # v1.2.1
3535
with:
3636
template: javascript-action
3737
env:

‎.github/workflows/sync-docs.yml‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,28 +5,32 @@ on:
55
branches:
66
- main
77
paths:
8-
- "docs/**"
8+
- "docs/**"
99
workflow_dispatch:
1010

1111
jobs:
1212
config-sync:
1313
name: Sync docs to docs site repo
1414
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
1517

1618
steps:
1719
- name: Generate a GitHub token
1820
id: ghtoken
19-
uses: actions/create-github-app-token@v2
21+
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
2022
with:
2123
app-id: ${{ secrets.GH_APP_ID }}
2224
owner: slackapi
2325
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
2426

2527
- name: Checkout the tool repo (source)
26-
uses: actions/checkout@v4
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
persist-credentials: false
2731

2832
- name: Checkout the docs site repo (destination)
29-
uses: actions/checkout@v4
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3034
with:
3135
repository: slackapi/slackapi.github.io
3236
path: "docs_repo"
@@ -35,7 +39,9 @@ jobs:
3539

3640
- name: Update docs in docs site repo
3741
run: |
38-
rsync -av --delete ./docs/ ./docs_repo/content/${{ github.event.repository.name }}/
42+
rsync -av --delete ./docs/ "./docs_repo/content/$REPO/"
43+
env:
44+
REPO: ${{ github.event.repository.name }}
3945

4046
- name: Install dependencies
4147
run: |
@@ -50,7 +56,7 @@ jobs:
5056
- name: Create a pull request
5157
if: ${{ github.event.pull_request.merged || github.event_name == 'workflow_dispatch' }}
5258
id: site-pr
53-
uses: peter-evans/create-pull-request@v7
59+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
5460
with:
5561
token: ${{ steps.ghtoken.outputs.token }}
5662
title: "From ${{ github.event.repository.name }}: ${{ github.event.pull_request.title || 'manual docs sync' }}"
@@ -66,4 +72,6 @@ jobs:
6672
- name: Output the pull request link
6773
if: ${{ steps.site-pr.outputs.pull-request-url }}
6874
run: |
69-
echo "Pull request created: ${{ steps.site-pr.outputs.pull-request-url }}" >> $GITHUB_STEP_SUMMARY
75+
echo "Pull request created: $URL" >> $GITHUB_STEP_SUMMARY
76+
env:
77+
URL: ${{ steps.site-pr.outputs.pull-request-url }}

‎.github/workflows/test.yml‎

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Tests
22
on:
3-
pull_request_target:
3+
pull_request_target: # zizmor: ignore[dangerous-triggers]
44
push:
55
branches:
66
- main
@@ -15,13 +15,13 @@ jobs:
1515
checks: write
1616
steps:
1717
- name: "build: checkout the latest changes"
18-
uses: actions/checkout@v4
18+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1919
with:
2020
persist-credentials: false
2121
ref: ${{ github.event.pull_request.head.sha }}
2222

2323
- name: "build: setup the node runtime"
24-
uses: actions/setup-node@v4
24+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2525
with:
2626
cache: npm
2727
cache-dependency-path: package-lock.json
@@ -40,7 +40,7 @@ jobs:
4040
run: npm test
4141

4242
- name: "unit(test): upload coverage to CodeCov"
43-
uses: codecov/[email protected]
43+
uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
4444
with:
4545
directory: ./coverage
4646
token: ${{ secrets.CODECOV_TOKEN }}
@@ -50,15 +50,19 @@ jobs:
5050

5151
- name: "pretest(inputs): save the push event trigger commit URL"
5252
if: "contains(github.event_name, 'push')"
53+
id: push
5354
run: |
54-
url=${{ github.event.head_commit.url }}
55-
echo "EVENT_URL=$url" >> "$GITHUB_ENV"
55+
echo "url=$URL" >> "$GITHUB_OUTPUT"
56+
env:
57+
URL: ${{ github.event.head_commit.url }}
5658

5759
- name: "pretest(inputs): save the pull request event trigger commit URL"
5860
if: "contains(github.event_name, 'pull_request')"
61+
id: pull_request
5962
run: |
60-
url=${{ github.event.pull_request.html_url }}
61-
echo "EVENT_URL=$url" >> "$GITHUB_ENV"
63+
echo "url=$URL" >> "$GITHUB_OUTPUT"
64+
env:
65+
URL: ${{ github.event.pull_request.html_url }}
6266

6367
- name: "integration(wfb): send a payload to workflow builder via webhook trigger"
6468
id: wfb
@@ -70,12 +74,14 @@ jobs:
7074
payload: |
7175
author: ${{ github.event.sender.login }}
7276
channel_id: ${{ secrets.SLACK_CHANNEL_ID }}
73-
event_url: ${{ env.EVENT_URL}}
77+
event_url: ${{ steps.push.outputs.url || steps.pull_request.outputs.url }}
7478
repo_name: ${{ github.event.repository.full_name }}
7579
status: ${{ job.status }}
7680
7781
- name: "integration(wfb): confirm a payload was sent"
78-
run: test -n "${{ steps.wfb.outputs.time }}"
82+
run: test -n "$WFB_OUTPUT_TIME"
83+
env:
84+
WFB_OUTPUT_TIME: ${{ steps.wfb.outputs.time }}
7985

8086
- name: "integration(botToken): post a message to channel"
8187
id: message
@@ -89,7 +95,9 @@ jobs:
8995
text: ":checkered_flag: Action happens at <https://github.com/${{ github.repository }}>"
9096
9197
- name: "integration(method): confirm a message was posted"
92-
run: test -n "${{ steps.message.outputs.ts }}"
98+
run: test -n "$MESSAGE_OUTPUT_TS"
99+
env:
100+
MESSAGE_OUTPUT_TS: ${{ steps.message.outputs.ts }}
93101

94102
- name: "integration(method): post a message with blocks"
95103
id: blocks
@@ -109,7 +117,9 @@ jobs:
109117
value: "Processing"
110118
111119
- name: "integration(method): confirm the blocks were posted"
112-
run: test -n "${{ steps.blocks.outputs.ts }}"
120+
run: test -n "$BLOCKS_OUTPUT_TS"
121+
env:
122+
BLOCKS_OUTPUT_TS: ${{ steps.blocks.outputs.ts }}
113123

114124
- name: "integration(method): post a threaded message"
115125
id: timer
@@ -124,7 +134,9 @@ jobs:
124134
thread_ts: "${{ steps.blocks.outputs.ts }}"
125135
126136
- name: "integration(incoming): confirm the thread started"
127-
run: test -n "${{ steps.timer.outputs.time }}"
137+
run: test -n "$TIMER_OUTPUT_TIME"
138+
env:
139+
TIMER_OUTPUT_TIME: ${{ steps.timer.outputs.time }}
128140

129141
- name: "integration(method): wait to mock event processing"
130142
run: sleep 3
@@ -184,7 +196,9 @@ jobs:
184196
name: "tada"
185197
186198
- name: "integration(method): confirm the thread ended"
187-
run: test -n "${{ steps.done.outputs.time }}"
199+
run: test -n "$DONE_OUTPUT_TIME"
200+
env:
201+
DONE_OUTPUT_TIME: ${{ steps.done.outputs.time }}
188202

189203
- name: "integration(incoming): post a message via incoming webhook"
190204
id: incoming
@@ -203,10 +217,12 @@ jobs:
203217
emoji: true
204218
205219
- name: "integration(incoming): confirm a webhook was posted"
206-
run: test -n "${{ steps.incoming.outputs.time }}"
220+
run: test -n "$INCOMING_WEBHOOK_OUTPUT_TIME"
221+
env:
222+
INCOMING_WEBHOOK_OUTPUT_TIME: ${{ steps.incoming.outputs.time }}
207223

208224
- name: "integration(incoming): reveal contents of the github payload"
209-
run: echo $JSON
225+
run: echo "$JSON"
210226
env:
211227
JSON: ${{ toJSON(github) }}
212228

@@ -224,10 +240,12 @@ jobs:
224240
ATTACHMENT_COLOR: ${{ (job.status == 'success' && 'good') || (job.status == 'failure' && 'danger') || 'warning' }}
225241

226242
- name: "integration(incoming): confirm a payload file was posted"
227-
run: test -n "${{ steps.payload_file.outputs.time }}"
243+
run: test -n "$PAYLOAD_FILE_OUTPUT_TIME"
244+
env:
245+
PAYLOAD_FILE_OUTPUT_TIME: ${{ steps.payload_file.outputs.time }}
228246

229247
- name: "chore(health): check up on recent changes to the health score"
230-
uses: slackapi/[email protected]
248+
uses: slackapi/slack-health-score@d58a419f15cdaff97e9aa7f09f95772830ab66f7 # v0.1.1
231249
with:
232250
codecov_token: ${{ secrets.CODECOV_API_TOKEN }}
233251
github_token: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)