docker/bake-action
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #413 from crazy-max/zizmor

Browse Source 
ci: zizmor workflow
This commit is contained in:
Tõnis Tiigi
2026-03-30 18:49:05 -07:00
committed by GitHub
parent 2f8d900d05 9c8c59b36d
commit 9e7a27e46b
11 changed files with 153 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/dependabot.yml vendored
View File

@@ -4,6 +4,12 @@ updates:
directory: "/" directory: "/"
schedule: schedule:
interval: "daily" interval: "daily"
cooldown:
default-days: 2
groups:
crazy-max-dot-github:
patterns:
- "crazy-max/.github/*"
labels: labels:
- "dependencies" - "dependencies"
- "bot" - "bot"
@@ -11,6 +17,8 @@ updates:
directory: "/" directory: "/"
schedule: schedule:
interval: "daily" interval: "daily"
cooldown:
default-days: 2
versioning-strategy: "increase" versioning-strategy: "increase"
allow: allow:
- dependency-type: "production" - dependency-type: "production"

7
.github/workflows/ci-subaction.yml vendored
View File

@@ -1,5 +1,8 @@
name: ci-subaction name: ci-subaction
permissions:
contents: read
concurrency: concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
@@ -60,7 +63,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Matrix gen name: Matrix gen
id: gen id: gen
@@ -71,7 +74,7 @@ jobs:
fields: ${{ matrix.fields }} fields: ${{ matrix.fields }}
- -
name: Check output name: Check output
uses: actions/github-script@v8 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env: env:
INPUT_MATRIX: ${{ steps.gen.outputs.matrix }} INPUT_MATRIX: ${{ steps.gen.outputs.matrix }}
INPUT_EXPECTED: ${{ matrix.expected }} INPUT_EXPECTED: ${{ matrix.expected }}

125
.github/workflows/ci.yml vendored
View File

@@ -1,5 +1,8 @@
name: ci name: ci
permissions:
contents: read
concurrency: concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
@@ -46,20 +49,20 @@ jobs:
- release - release
services: services:
registry: registry:
image: registry:2 image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
ports: ports:
- 5000:5000 - 5000:5000
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up QEMU name: Set up QEMU
uses: docker/setup-qemu-action@v4 uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- -
name: Set up Docker Buildx name: Set up Docker Buildx
id: buildx id: buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -82,7 +85,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Build name: Build
continue-on-error: true continue-on-error: true
@@ -99,7 +102,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Stop docker name: Stop docker
run: | run: |
@@ -126,7 +129,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Build name: Build
id: bake id: bake
@@ -147,7 +150,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Uninstall docker cli name: Uninstall docker cli
run: | run: |
@@ -158,7 +161,7 @@ jobs:
fi fi
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -176,7 +179,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Build name: Build
uses: ./ uses: ./
@@ -198,10 +201,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -233,16 +236,16 @@ jobs:
output: /tmp/bake-build output: /tmp/bake-build
services: services:
registry: registry:
image: registry:2 image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
ports: ports:
- 5000:5000 - 5000:5000
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -287,13 +290,13 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
services: services:
registry: registry:
image: registry:2 image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
ports: ports:
- 5000:5000 - 5000:5000
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Build name: Build
uses: ./ uses: ./
@@ -308,16 +311,16 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
services: services:
registry: registry:
image: registry:2 image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
ports: ports:
- 5000:5000 - 5000:5000
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -338,7 +341,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set malformed docker config name: Set malformed docker config
run: | run: |
@@ -356,7 +359,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
services: services:
squid-proxy: squid-proxy:
image: ubuntu/squid:latest image: ubuntu/squid:latest@sha256:6a097f68bae708cedbabd6188d68c7e2e7a38cedd05a176e1cc0ba29e3bbe029
ports: ports:
- 3128:3128 - 3128:3128
steps: steps:
@@ -367,7 +370,7 @@ jobs:
curl --retry 5 --retry-all-errors --retry-delay 0 --connect-timeout 5 --proxy http://127.0.0.1:3128 -v --insecure --head https://www.google.com curl --retry 5 --retry-all-errors --retry-delay 0 --connect-timeout 5 --proxy http://127.0.0.1:3128 -v --insecure --head https://www.google.com
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set proxy config name: Set proxy config
run: | run: |
@@ -375,7 +378,7 @@ jobs:
echo '{"proxies":{"default":{"httpProxy":"http://127.0.0.1:3128","httpsProxy":"http://127.0.0.1:3128"}}}' > ~/.docker/config.json echo '{"proxies":{"default":{"httpProxy":"http://127.0.0.1:3128","httpsProxy":"http://127.0.0.1:3128"}}}' > ~/.docker/config.json
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -395,7 +398,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
services: services:
squid-proxy: squid-proxy:
image: ubuntu/squid:latest image: ubuntu/squid:latest@sha256:6a097f68bae708cedbabd6188d68c7e2e7a38cedd05a176e1cc0ba29e3bbe029
ports: ports:
- 3128:3128 - 3128:3128
steps: steps:
@@ -406,10 +409,10 @@ jobs:
curl --retry 5 --retry-all-errors --retry-delay 0 --connect-timeout 5 --proxy http://127.0.0.1:3128 -v --insecure --head https://www.google.com curl --retry 5 --retry-all-errors --retry-delay 0 --connect-timeout 5 --proxy http://127.0.0.1:3128 -v --insecure --head https://www.google.com
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -431,10 +434,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -448,10 +451,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -459,7 +462,7 @@ jobs:
- -
name: Docker meta name: Docker meta
id: meta id: meta
uses: docker/metadata-action@v6 uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
- -
name: Build name: Build
uses: ./ uses: ./
@@ -471,16 +474,16 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
services: services:
registry: registry:
image: registry:2 image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
ports: ports:
- 5000:5000 - 5000:5000
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -514,16 +517,16 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
services: services:
registry: registry:
image: registry:2 image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
ports: ports:
- 5000:5000 - 5000:5000
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -552,10 +555,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -575,10 +578,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: v0.12.1 version: v0.12.1
driver-opts: | driver-opts: |
@@ -596,10 +599,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -625,10 +628,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -654,10 +657,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ matrix.buildx-version }} version: ${{ matrix.buildx-version }}
driver-opts: | driver-opts: |
@@ -675,10 +678,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -706,10 +709,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ matrix.buildx-version }} version: ${{ matrix.buildx-version }}
driver-opts: | driver-opts: |
@@ -728,7 +731,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Build name: Build
uses: ./ uses: ./
@@ -744,10 +747,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -776,10 +779,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -807,10 +810,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |
@@ -831,10 +834,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Set up Docker Buildx name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ inputs.buildx-version || env.BUILDX_VERSION }} version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
driver-opts: | driver-opts: |

19
.github/workflows/codeql.yml vendored
View File

@@ -1,5 +1,8 @@
name: codeql name: codeql
permissions:
contents: read
on: on:
push: push:
branches: branches:
@@ -7,21 +10,19 @@ on:
- 'releases/v*' - 'releases/v*'
pull_request: pull_request:
permissions:
actions: read
contents: read
security-events: write
env: env:
NODE_VERSION: "24" NODE_VERSION: "24"
jobs: jobs:
analyze: analyze:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Enable corepack name: Enable corepack
run: | run: |
@@ -29,17 +30,17 @@ jobs:
yarn --version yarn --version
- -
name: Set up Node name: Set up Node
uses: actions/setup-node@v6 uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with: with:
node-version: ${{ env.NODE_VERSION }} node-version: ${{ env.NODE_VERSION }}
- -
name: Initialize CodeQL name: Initialize CodeQL
uses: github/codeql-action/init@v4 uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
with: with:
languages: javascript-typescript languages: javascript-typescript
build-mode: none build-mode: none
- -
name: Perform CodeQL Analysis name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4 uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
with: with:
category: "/language:javascript-typescript" category: "/language:javascript-typescript"

4
.github/workflows/pr-assign-author.yml vendored
View File

@@ -4,14 +4,14 @@ permissions:
contents: read contents: read
on: on:
pull_request_target: pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
types: types:
- opened - opened
- reopened - reopened
jobs: jobs:
run: run:
uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@20ef82212dc54bab5749f5e05576ca6d3c8a5773 # v1.1.0 uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@bb328ea508cd6a89d0865555ddbeb148e5724aed # v1.3.0
permissions: permissions:
contents: read contents: read
pull-requests: write pull-requests: write

11
.github/workflows/publish.yml vendored
View File

@@ -1,5 +1,12 @@
name: publish name: publish
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
on: on:
release: release:
types: types:
@@ -15,7 +22,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Publish name: Publish
uses: actions/publish-immutable-action@v0.0.4 uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

9
.github/workflows/test.yml vendored
View File

@@ -1,5 +1,8 @@
name: test name: test
permissions:
contents: read
concurrency: concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
@@ -23,16 +26,16 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Test name: Test
uses: docker/bake-action@v7 uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
with: with:
source: . source: .
targets: test targets: test
- -
name: Upload coverage name: Upload coverage
uses: codecov/codecov-action@v5 uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
with: with:
files: ./coverage/clover.xml files: ./coverage/clover.xml
token: ${{ secrets.CODECOV_TOKEN }} token: ${{ secrets.CODECOV_TOKEN }}

17
.github/workflows/update-dist.yml vendored
View File

@@ -1,5 +1,12 @@
name: update-dist name: update-dist
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
on: on:
pull_request: pull_request:
types: types:
@@ -8,27 +15,27 @@ on:
jobs: jobs:
update-dist: update-dist:
if: github.actor == 'dependabot[bot]' if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- -
name: GitHub auth token from GitHub App name: GitHub auth token from GitHub App
id: docker-read-app id: docker-read-app
uses: actions/create-github-app-token@v3 uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
with: with:
app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }} app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }} private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
owner: docker owner: docker
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
ref: ${{ github.event.pull_request.head.ref }} ref: ${{ github.event.pull_request.head.ref }}
fetch-depth: 0 fetch-depth: 0
token: ${{ steps.docker-read-app.outputs.token || github.token }} token: ${{ steps.docker-read-app.outputs.token }}
- -
name: Build name: Build
uses: docker/bake-action@v7 uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
with: with:
source: . source: .
targets: build targets: build

7
.github/workflows/validate.yml vendored
View File

@@ -1,5 +1,8 @@
name: validate name: validate
permissions:
contents: read
concurrency: concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
@@ -19,7 +22,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: List targets name: List targets
id: generate id: generate
@@ -38,6 +41,6 @@ jobs:
steps: steps:
- -
name: Validate name: Validate
uses: docker/bake-action@v7 uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
with: with:
targets: ${{ matrix.target }} targets: ${{ matrix.target }}

29
.github/workflows/zizmor.yml vendored Normal file
View File

@@ -0,0 +1,29 @@
name: zizmor
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
on:
workflow_dispatch:
push:
branches:
- 'master'
- 'releases/v*'
tags:
- 'v*'
pull_request:
jobs:
zizmor:
uses: crazy-max/.github/.github/workflows/zizmor.yml@bb328ea508cd6a89d0865555ddbeb148e5724aed # v1.3.0
permissions:
contents: read
security-events: write
with:
min-severity: medium
min-confidence: medium
persona: pedantic

3
.github/zizmor.yml vendored Normal file
View File

@@ -0,0 +1,3 @@
rules:
secrets-outside-env: # FIXME: remove this rule when zizmor 1.24.0 is released, fixing the right persona attached to this rule: https://github.com/zizmorcore/zizmor/pull/1783
disable: true