Skip to content

Commit f141e10

Browse files
adoroszlaiadoroszlai
authored
RATIS-2493. Check actions with zizmor (#1426)
1 parent 7e4bdf8 commit f141e10

8 files changed

Lines changed: 108 additions & 36 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,15 +23,15 @@ updates:
2323
interval: "cron"
2424
cronjob: "15 9 * * *"
2525
cooldown:
26-
default-days: 4
26+
default-days: 7
2727
- package-ecosystem: "maven"
2828
directory: "/"
2929
schedule:
3030
# 'daily' only runs on weekdays
3131
interval: "cron"
3232
cronjob: "15 10 * * *"
3333
cooldown:
34-
default-days: 4
34+
default-days: 7
3535
ignore:
3636
# requires Java 11
3737
- dependency-name: "com.github.spotbugs:spotbugs"

‎.github/workflows/check.yaml‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,11 @@ on:
7676
default: 30
7777
required: false
7878

79+
secrets:
80+
DEVELOCITY_ACCESS_KEY:
81+
description: 'Token for submitting build scan to Develocity'
82+
required: false
83+
7984
env:
8085
MAVEN_ARGS: --batch-mode --show-version
8186
MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3
@@ -90,11 +95,13 @@ jobs:
9095
steps:
9196
- name: Checkout project
9297
if: ${{ !inputs.needs-source-tarball }}
93-
uses: actions/checkout@v6
98+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
99+
with:
100+
persist-credentials: false
94101

95102
- name: Download source tarball
96103
if: ${{ inputs.needs-source-tarball }}
97-
uses: actions/download-artifact@v8
104+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
98105
with:
99106
name: ratis-src
100107

@@ -105,7 +112,7 @@ jobs:
105112
106113
- name: Create cache for Maven dependencies
107114
if: ${{ inputs.script == 'build' }}
108-
uses: actions/cache@v5
115+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
109116
with:
110117
path: |
111118
~/.m2/repository/*/*/*
@@ -116,7 +123,7 @@ jobs:
116123
117124
- name: Restore cache for Maven dependencies
118125
if: ${{ inputs.script != 'build' }}
119-
uses: actions/cache/restore@v5
126+
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
120127
with:
121128
path: |
122129
~/.m2/repository/*/*/*
@@ -128,15 +135,15 @@ jobs:
128135
- name: Download Maven repo
129136
id: download-maven-repo
130137
if: ${{ inputs.needs-maven-repo }}
131-
uses: actions/download-artifact@v8
138+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
132139
with:
133140
name: maven-repo
134141
path: |
135142
~/.m2/repository/org/apache/ratis
136143
137144
- name: Download binary tarball
138145
if: ${{ inputs.needs-binary-tarball }}
139-
uses: actions/download-artifact@v8
146+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
140147
with:
141148
name: ratis-bin
142149

@@ -148,7 +155,7 @@ jobs:
148155
149156
- name: Setup java ${{ inputs.java-version }}
150157
if: ${{ inputs.java-version }}
151-
uses: actions/setup-java@v5
158+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
152159
with:
153160
distribution: 'temurin'
154161
java-version: ${{ inputs.java-version }}
@@ -169,7 +176,7 @@ jobs:
169176
170177
- name: Archive build results
171178
if: ${{ !cancelled() }}
172-
uses: actions/upload-artifact@v7
179+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
173180
with:
174181
name: ${{ (inputs.split && format('{0}-{1}', inputs.script, inputs.split)) || inputs.script }}
175182
path: target/${{ inputs.script }}
@@ -179,7 +186,7 @@ jobs:
179186
# to avoid the need for 3 more inputs.
180187
- name: Store binaries for tests
181188
if: ${{ inputs.script == 'build' && !cancelled() }}
182-
uses: actions/upload-artifact@v7
189+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
183190
with:
184191
name: ratis-bin
185192
path: |
@@ -188,7 +195,7 @@ jobs:
188195

189196
- name: Store source tarball for compilation
190197
if: ${{ inputs.script == 'build' && !cancelled() }}
191-
uses: actions/upload-artifact@v7
198+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
192199
with:
193200
name: ratis-src
194201
path: |
@@ -197,7 +204,7 @@ jobs:
197204

198205
- name: Store Maven repo for tests
199206
if: ${{ inputs.script == 'build' && !cancelled() }}
200-
uses: actions/upload-artifact@v7
207+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
201208
with:
202209
name: maven-repo
203210
path: |

‎.github/workflows/ci.yaml‎

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,15 @@ on:
2323
description: Ratis git ref (branch, tag or commit hash)
2424
default: ''
2525
required: false
26+
secrets:
27+
DEVELOCITY_ACCESS_KEY:
28+
description: 'Token for submitting build scan to Develocity'
29+
required: false
30+
SONARCLOUD_TOKEN:
31+
description: 'Token for submitting coverage data to SonarCloud'
32+
required: false
33+
34+
permissions: { }
2635

2736
jobs:
2837
build:
@@ -31,7 +40,8 @@ jobs:
3140
script: build
3241
script-args: -Prelease
3342
timeout-minutes: 30
34-
secrets: inherit
43+
secrets:
44+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
3545

3646
compile:
3747
needs:
@@ -48,14 +58,16 @@ jobs:
4858
script-args: -Dmaven.compiler.release=${{ matrix.java }}
4959
split: ${{ matrix.java }}
5060
timeout-minutes: 30
51-
secrets: inherit
61+
secrets:
62+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
5263

5364
release:
5465
uses: ./.github/workflows/check.yaml
5566
with:
5667
script: release
5768
timeout-minutes: 30
58-
secrets: inherit
69+
secrets:
70+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
5971

6072
repro:
6173
needs:
@@ -66,7 +78,8 @@ jobs:
6678
script: repro
6779
script-args: -Prelease
6880
timeout-minutes: 30
69-
secrets: inherit
81+
secrets:
82+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
7083

7184
basic:
7285
strategy:
@@ -81,7 +94,8 @@ jobs:
8194
with:
8295
script: ${{ matrix.check }}
8396
timeout-minutes: 30
84-
secrets: inherit
97+
secrets:
98+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
8599

86100
unit:
87101
strategy:
@@ -98,7 +112,8 @@ jobs:
98112
script-args: -P${{ matrix.profile }}-tests
99113
split: ${{ matrix.profile }}
100114
timeout-minutes: 60
101-
secrets: inherit
115+
secrets:
116+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
102117

103118
coverage:
104119
needs:
@@ -109,11 +124,12 @@ jobs:
109124
if: github.event_name != 'pull_request'
110125
steps:
111126
- name: Checkout project
112-
uses: actions/checkout@v6
127+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
113128
with:
114129
fetch-depth: 0
130+
persist-credentials: false
115131
- name: Cache for maven dependencies
116-
uses: actions/cache/restore@v5
132+
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
117133
with:
118134
path: |
119135
~/.m2/repository
@@ -122,12 +138,12 @@ jobs:
122138
restore-keys: |
123139
maven-repo-
124140
- name: Setup java 17
125-
uses: actions/setup-java@v5
141+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
126142
with:
127143
distribution: 'temurin'
128144
java-version: 17
129145
- name: Download artifacts
130-
uses: actions/download-artifact@v8
146+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
131147
with:
132148
path: target/artifacts
133149
- name: Untar binaries
@@ -143,7 +159,7 @@ jobs:
143159
SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }}
144160
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
145161
- name: Archive build results
146-
uses: actions/upload-artifact@v7
162+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
147163
if: always()
148164
with:
149165
name: ${{ github.job }}

‎.github/workflows/close-stale-pr.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
runs-on: ubuntu-slim
2727
steps:
2828
- name: Close Stale PRs
29-
uses: actions/stale@v10
29+
uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
3030
with:
3131
stale-pr-label: 'stale'
3232
exempt-draft-pr: false

‎.github/workflows/post-commit.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,14 @@ concurrency:
2727
group: ci-${{ github.event.pull_request.number || case(github.repository == 'apache/ratis', github.sha, github.ref_name) }}
2828
cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'apache/ratis' }}
2929

30+
permissions: { }
31+
3032
jobs:
3133
CI:
3234
if: github.event_name == 'pull_request'
3335
|| github.repository == 'apache/ratis'
3436
|| github.ref_name != 'master'
3537
uses: ./.github/workflows/ci.yaml
36-
secrets: inherit
38+
secrets:
39+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
40+
SONARCLOUD_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }}

‎.github/workflows/repeat-test.yaml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ env:
4949
FAIL_FAST: ${{ github.event.inputs.fail-fast }}
5050
SPLITS: ${{ github.event.inputs.splits }}
5151
run-name: ${{ github.event_name == 'workflow_dispatch' && format('{0}#{1}[{2}]-{3}x{4}', inputs.test-class, inputs.test-method, inputs.ref, inputs.splits, inputs.iterations) || '' }}
52+
53+
permissions: { }
54+
5255
jobs:
5356
prepare:
5457
runs-on: ubuntu-24.04
@@ -95,11 +98,12 @@ jobs:
9598
split: ${{ fromJson(needs.prepare.outputs.matrix) }}
9699
fail-fast: ${{ fromJson(github.event.inputs.fail-fast) }}
97100
steps:
98-
- uses: actions/checkout@v6
101+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
99102
with:
103+
persist-credentials: false
100104
ref: ${{ needs.prepare.outputs.ref }}
101105
- name: Cache for maven dependencies
102-
uses: actions/cache@v5
106+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
103107
with:
104108
path: |
105109
~/.m2/repository
@@ -108,7 +112,7 @@ jobs:
108112
restore-keys: |
109113
maven-repo-
110114
- name: Setup java
111-
uses: actions/setup-java@v5
115+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
112116
with:
113117
distribution: 'temurin'
114118
java-version: 8
@@ -121,7 +125,7 @@ jobs:
121125
run: dev-support/checks/_summary.sh target/unit/summary.txt
122126
if: ${{ !cancelled() }}
123127
- name: Archive build results
124-
uses: actions/upload-artifact@v7
128+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
125129
if: ${{ failure() }}
126130
with:
127131
name: result-${{ github.run_number }}-${{ github.run_id }}-split-${{ matrix.split }}
@@ -132,7 +136,7 @@ jobs:
132136
runs-on: ubuntu-24.04
133137
steps:
134138
- name: Download build results
135-
uses: actions/download-artifact@v8
139+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
136140
- name: Count failures
137141
run: |
138142
failures=$(find . -name 'summary.txt' | grep -v 'iteration' | xargs grep -v 'exit code: 0' | wc -l)

‎.github/workflows/vulnerability-check.yaml‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,15 +29,19 @@ env:
2929
MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3
3030
MAVEN_ARGS: --batch-mode --no-transfer-progress
3131

32+
permissions: { }
33+
3234
jobs:
3335
dependency-check:
3436
if: ${{ github.event_name == 'workflow_dispatch' || github.repository == 'apache/ratis' }}
3537
runs-on: ubuntu-latest
3638

3739
steps:
38-
- uses: actions/checkout@v6
40+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
41+
with:
42+
persist-credentials: false
3943
- name: Set up JDK 11
40-
uses: actions/setup-java@v5
44+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
4145
with:
4246
distribution: corretto
4347
java-version: 11
@@ -52,13 +56,14 @@ jobs:
5256

5357
- name: Generate report date for artifact name
5458
run: |
55-
utc_time="${{ github.run_started_at }}"
5659
target_time=$(TZ=Asia/Shanghai date -d "$utc_time" +"%Y-%m-%d")
5760
echo "REPORT_DATE=$target_time" >> $GITHUB_ENV
61+
env:
62+
utc_time: ${{ github.run_started_at }}
5863

5964
- name: Upload Artifact
60-
uses: actions/upload-artifact@v7
65+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
6166
with:
6267
name: vulnerability-check-result-${{ env.REPORT_DATE }}
6368
path: target/dependency-check-report.html
64-
retention-days: 15
69+
retention-days: 15

‎.github/workflows/zizmor.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
name: zizmor
17+
18+
on:
19+
push:
20+
pull_request:
21+
22+
permissions: { }
23+
24+
jobs:
25+
zizmor:
26+
runs-on: ubuntu-latest
27+
permissions:
28+
security-events: write
29+
steps:
30+
- name: Checkout project
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
32+
with:
33+
persist-credentials: false
34+
35+
- name: Run zizmor
36+
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

0 commit comments

Comments
 (0)