Skip to content

Commit 5817a14

Browse files
reberhardt7jdalton
reberhardt7
and
jdalton
authored
fix: harden GitHub Actions workflows (#1129)
* fix: harden GitHub Actions workflows (zizmor) - Fix template-injection in ci.yml: move matrix.shard expressions to env vars in unit test and e2e test steps - Fix template-injection in provenance.yml: move matrix.libc, matrix.platform, and matrix.arch expressions to env vars in SEA build step - Fix ref-version-mismatch: update pnpm/action-setup SHA to match v5 tag across all workflows (ci.yml, provenance.yml, weekly-update.yml) - Fix ref-version-mismatch: update actions/upload-artifact from impostor commit to v4.6.2 in provenance.yml - Add dependabot cooldown configuration (default-days: 7) - Disable secrets-outside-env rule via .github/zizmor.yml (repo policy decision, not a code-level fix) * fix(ci): suppress zizmor cache-poisoning on setup-node steps Add inline zizmor ignore comments for the 4 setup-node cache-poisoning false positives (low confidence) while keeping the rule active globally. --------- Co-authored-by: jdalton <john.david.dalton@gmail.com>
1 parent bd7a881 commit 5817a14

5 files changed

Lines changed: 33 additions & 20 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,5 @@ updates:
88
schedule:
99
interval: yearly
1010
open-pull-requests-limit: 0
11+
cooldown:
12+
default-days: 7

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,10 @@ jobs:
7373
persist-credentials: false
7474

7575
- name: Setup pnpm
76-
uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
76+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
7777

7878
- name: Setup Node.js
79-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
79+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
8080
with:
8181
node-version-file: .node-version
8282
cache: 'pnpm'
@@ -139,10 +139,10 @@ jobs:
139139
persist-credentials: false
140140

141141
- name: Setup pnpm
142-
uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
142+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
143143

144144
- name: Setup Node.js
145-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
145+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
146146
with:
147147
node-version-file: .node-version
148148
cache: 'pnpm'
@@ -212,10 +212,10 @@ jobs:
212212
persist-credentials: false
213213

214214
- name: Setup pnpm
215-
uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
215+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
216216

217217
- name: Setup Node.js
218-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
218+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
219219
with:
220220
node-version: ${{ matrix.node-version }}
221221
cache: 'pnpm'
@@ -267,7 +267,9 @@ jobs:
267267

268268
- name: Run unit tests (shard ${{ matrix.shard }})
269269
working-directory: packages/cli
270-
run: pnpm test:unit --shard=${{ matrix.shard }}/3
270+
env:
271+
SHARD: ${{ matrix.shard }}
272+
run: pnpm test:unit --shard="$SHARD"/3
271273

272274
# E2E tests
273275
e2e:
@@ -290,10 +292,10 @@ jobs:
290292
persist-credentials: false
291293

292294
- name: Setup pnpm
293-
uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
295+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
294296

295297
- name: Setup Node.js
296-
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
298+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # zizmor: ignore[cache-poisoning] # v6.3.0
297299
with:
298300
node-version: ${{ matrix.node-version }}
299301
cache: 'pnpm'
@@ -347,4 +349,5 @@ jobs:
347349
working-directory: packages/cli
348350
env:
349351
SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_CLI_API_TOKEN }}
350-
run: pnpm run e2e-tests --shard=${{ matrix.shard }}/2
352+
SHARD: ${{ matrix.shard }}
353+
run: pnpm run e2e-tests --shard="$SHARD"/2

‎.github/workflows/provenance.yml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
cache: 'pnpm'
5858
cache-dependency-path: 'pnpm-lock.yaml'
5959

60-
- uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
60+
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
6161

6262
- run: pnpm install --frozen-lockfile
6363

@@ -71,7 +71,7 @@ jobs:
7171
echo "matrix=$MATRIX" >> $GITHUB_OUTPUT
7272
7373
- name: Upload CLI bundle
74-
uses: actions/upload-artifact@ea165f8ff5e4e9264e1c76a100385dcb87c2b141 # v4.4.3
74+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7575
with:
7676
name: cli-bundle
7777
path: packages/cli/build/cli.js
@@ -102,7 +102,7 @@ jobs:
102102
cache-dependency-path: 'pnpm-lock.yaml'
103103
registry-url: 'https://registry.npmjs.org'
104104

105-
- uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
105+
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
106106

107107
- run: pnpm install --frozen-lockfile
108108

@@ -114,18 +114,22 @@ jobs:
114114

115115
- name: Build SEA binary
116116
shell: bash
117+
env:
118+
MATRIX_LIBC: ${{ matrix.libc }}
119+
MATRIX_PLATFORM: ${{ matrix.platform }}
120+
MATRIX_ARCH: ${{ matrix.arch }}
117121
run: |
118122
LIBC_FLAG=""
119-
if [ "${{ matrix.libc }}" = "musl" ]; then
123+
if [ "$MATRIX_LIBC" = "musl" ]; then
120124
LIBC_FLAG="--libc=musl"
121125
fi
122126
pnpm --filter @socketsecurity/cli run build:sea -- \
123-
--platform=${{ matrix.platform }} \
124-
--arch=${{ matrix.arch }} \
127+
--platform="$MATRIX_PLATFORM" \
128+
--arch="$MATRIX_ARCH" \
125129
${LIBC_FLAG}
126130
127131
- name: Upload binary
128-
uses: actions/upload-artifact@ea165f8ff5e4e9264e1c76a100385dcb87c2b141 # v4.4.3
132+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
129133
with:
130134
name: binary-${{ matrix.releasePlatform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}
131135
path: packages/package-builder/build/prod/out/socketbin-cli-${{ matrix.releasePlatform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}/socket${{ matrix.platform == 'win32' && '.exe' || '' }}
@@ -154,7 +158,7 @@ jobs:
154158
cache-dependency-path: 'pnpm-lock.yaml'
155159
registry-url: 'https://registry.npmjs.org'
156160

157-
- uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
161+
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
158162

159163
- run: pnpm install --frozen-lockfile
160164

‎.github/workflows/weekly-update.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
cache: ''
3939

4040
- name: Setup pnpm
41-
uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
41+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
4242

4343
- name: Install dependencies
4444
run: pnpm install --frozen-lockfile
@@ -95,7 +95,7 @@ jobs:
9595
cache: ''
9696

9797
- name: Setup pnpm
98-
uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
98+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
9999

100100
- name: Install dependencies
101101
run: pnpm install --frozen-lockfile

‎.github/zizmor.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
rules:
2+
secrets-outside-env:
3+
disable: true
4+

0 commit comments

Comments
 (0)