From 2f4267b3668daadd417e5c8ea32e616272fde8ff Mon Sep 17 00:00:00 2001 From: Dmytro Shteflyuk Date: Sun, 3 May 2026 12:04:08 -0400 Subject: [PATCH] THRIFT-5965: Added zizmor to run static analysis on GitHub actions --- .github/dependabot.yml | 6 +++++ .github/workflows/asf-allowlist-check.yml | 2 +- .github/workflows/build.yml | 28 +++++++++++++++++++++++ .github/workflows/cmake.yml | 2 ++ .github/workflows/msvc.yml | 2 ++ .github/workflows/pypi.yml | 2 ++ .github/workflows/release_ruby.yml | 2 +- .github/workflows/release_rust.yml | 13 ++++++++++- .github/workflows/sca.yml | 20 +++++++++++++++- 9 files changed, 73 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b53f01bf4b7..7f20046b501 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,11 +23,17 @@ updates: directory: "/" schedule: interval: monthly + cooldown: + default-days: 7 - package-ecosystem: "gradle" directory: "/lib/java" schedule: interval: monthly + cooldown: + default-days: 7 - package-ecosystem: "gradle" directory: "/lib/kotlin" schedule: interval: monthly + cooldown: + default-days: 7 diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index 48b0c334c6c..f679ed7952b 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -21,4 +21,4 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: apache/infrastructure-actions/allowlist-check@main + - uses: apache/infrastructure-actions/allowlist-check@8056239fafd626c8a4e2d6679506ba0d8e60f196 # main diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a3414949507..1cbaf765c72 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -48,6 +48,8 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | @@ -120,6 +122,8 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | @@ -157,6 +161,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up PHP uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # master @@ -234,6 +240,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: @@ -290,6 +298,8 @@ jobs: GRADLE_VERSION: "8.4" steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: @@ -402,6 +412,8 @@ jobs: shell: bash # required by net install script steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | @@ -486,6 +498,8 @@ jobs: if: false # swift is currently broken and no maintainers around -> see THRIFT-5864 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Run bootstrap run: ./bootstrap.sh @@ -524,6 +538,8 @@ jobs: TOOLCHAIN_VERSION: 1.85.1 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | @@ -591,6 +607,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | @@ -666,6 +684,8 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | @@ -720,6 +740,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Run bootstrap run: ./bootstrap.sh @@ -767,6 +789,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | @@ -843,6 +867,8 @@ jobs: SKIP_BUILD_EXT: ${{ matrix.skip-build-ext && '1' || '' }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up Ruby uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0 @@ -914,6 +940,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml index e19290e7820..90ad5ee8ec1 100644 --- a/.github/workflows/cmake.yml +++ b/.github/workflows/cmake.yml @@ -21,6 +21,8 @@ jobs: runs-on: ubuntu-22.04 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + with: + persist-credentials: false - name: Install dependencies timeout-minutes: 10 diff --git a/.github/workflows/msvc.yml b/.github/workflows/msvc.yml index 6006fdc83fd..53215a4140f 100644 --- a/.github/workflows/msvc.yml +++ b/.github/workflows/msvc.yml @@ -25,6 +25,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + with: + persist-credentials: false - name: Ensure expected workspace path shell: pwsh diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml index d293e3de25b..b0e47e5d28c 100644 --- a/.github/workflows/pypi.yml +++ b/.github/workflows/pypi.yml @@ -34,6 +34,8 @@ jobs: id-token: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 diff --git a/.github/workflows/release_ruby.yml b/.github/workflows/release_ruby.yml index 35b07427d91..21758f6a2e7 100644 --- a/.github/workflows/release_ruby.yml +++ b/.github/workflows/release_ruby.yml @@ -42,7 +42,7 @@ jobs: - name: Set up Ruby uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0 with: - bundler-cache: true + bundler-cache: false ruby-version: "4.0" working-directory: lib/rb diff --git a/.github/workflows/release_rust.yml b/.github/workflows/release_rust.yml index d38544d0a4f..bf7ebf83a17 100644 --- a/.github/workflows/release_rust.yml +++ b/.github/workflows/release_rust.yml @@ -34,16 +34,27 @@ jobs: publish: runs-on: ubuntu-latest if: false # currently broken and no maintainers around -> see THRIFT-5917 + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Dryrun working-directory: lib/rs run: cargo publish --dry-run + - name: Authenticate to crates.io + # Only publish if it's a tag and the tag is not a pre-release + if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') }} + id: crates-io-auth + uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4 + - name: Publish working-directory: lib/rs # Only publish if it's a tag and the tag is not a pre-release if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') }} run: cargo publish env: - CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} + CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }} diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml index d4832e73a09..0d5399ea945 100644 --- a/.github/workflows/sca.yml +++ b/.github/workflows/sca.yml @@ -2,7 +2,7 @@ name: "Static Code Analysis" on: push: - branches: ["*"] + branches: ["master"] pull_request: branches: ["*"] workflow_dispatch: @@ -41,6 +41,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | @@ -243,3 +245,19 @@ jobs: fi exit $failed + + zizmor: + name: Run zizmor + runs-on: ubuntu-24.04 + permissions: + security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. + contents: read # Only needed for private repos. Needed to clone the repo. + actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info. + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3