Skip to content

Commit 41b81ac

Browse files
deansheatherdeansheather
committed
zizmor fixes
1 parent 97a2554 commit 41b81ac

File tree

18 files changed

+202
-118
lines changed

18 files changed

+202
-118
lines changed

‎.github/actions/embedded-pg-cache/download/action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@ runs:
2727
export DAY=$(date +'%d')
2828
echo "year-month=$YEAR_MONTH" >> "$GITHUB_OUTPUT"
2929
echo "prev-year-month=$PREV_YEAR_MONTH" >> "$GITHUB_OUTPUT"
30-
echo "cache-key=${KEY_PREFIX}-${YEAR_MONTH}-${DAY}" >> "$GITHUB_OUTPUT"
30+
echo "cache-key=${INPUTS_KEY_PREFIX}-${YEAR_MONTH}-${DAY}" >> "$GITHUB_OUTPUT"
3131
env:
32-
KEY_PREFIX: ${{ inputs.key-prefix }}
32+
INPUTS_KEY_PREFIX: ${{ inputs.key-prefix }}
3333

3434
# By default, depot keeps caches for 14 days. This is plenty for embedded
3535
# postgres, which changes infrequently.

‎.github/actions/test-cache/download/action.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@ runs:
2929
export DAY=$(date +'%d')
3030
echo "year-month=$YEAR_MONTH" >> "$GITHUB_OUTPUT"
3131
echo "prev-year-month=$PREV_YEAR_MONTH" >> "$GITHUB_OUTPUT"
32-
echo "cache-key=${{ inputs.key-prefix }}-${YEAR_MONTH}-${DAY}" >> "$GITHUB_OUTPUT"
32+
echo "cache-key=${INPUTS_KEY_PREFIX}-${YEAR_MONTH}-${DAY}" >> "$GITHUB_OUTPUT"
33+
env:
34+
INPUTS_KEY_PREFIX: ${{ inputs.key-prefix }}
3335

3436
# TODO: As a cost optimization, we could remove caches that are older than
3537
# a day or two. By default, depot keeps caches for 14 days, which isn't

‎.github/actions/upload-datadog/action.yaml

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,12 @@ runs:
1212
run: |
1313
set -e
1414
15-
owner="${{ github.repository_owner }}"
16-
echo "owner: $owner"
17-
if [[ $owner != "coder" ]]; then
15+
echo "owner: $REPO_OWNER"
16+
if [[ "$REPO_OWNER" != "coder" ]]; then
1817
echo "Not a pull request from the main repo, skipping..."
1918
exit 0
2019
fi
21-
if [[ -z "${{ inputs.api-key }}" ]]; then
20+
if [[ -z "${DATADOG_API_KEY}" ]]; then
2221
# This can happen for dependabot.
2322
echo "No API key provided, skipping..."
2423
exit 0
@@ -31,37 +30,38 @@ runs:
3130
3231
TMP_DIR=$(mktemp -d)
3332
34-
if [[ "${{ runner.os }}" == "Windows" ]]; then
33+
if [[ "${RUNNER_OS}" == "Windows" ]]; then
3534
BINARY_PATH="${TMP_DIR}/datadog-ci.exe"
3635
BINARY_URL="https://github.com/DataDog/datadog-ci/releases/download/${BINARY_VERSION}/datadog-ci_win-x64"
37-
elif [[ "${{ runner.os }}" == "macOS" ]]; then
36+
elif [[ "${RUNNER_OS}" == "macOS" ]]; then
3837
BINARY_PATH="${TMP_DIR}/datadog-ci"
3938
BINARY_URL="https://github.com/DataDog/datadog-ci/releases/download/${BINARY_VERSION}/datadog-ci_darwin-arm64"
40-
elif [[ "${{ runner.os }}" == "Linux" ]]; then
39+
elif [[ "${RUNNER_OS}" == "Linux" ]]; then
4140
BINARY_PATH="${TMP_DIR}/datadog-ci"
4241
BINARY_URL="https://github.com/DataDog/datadog-ci/releases/download/${BINARY_VERSION}/datadog-ci_linux-x64"
4342
else
44-
echo "Unsupported OS: ${{ runner.os }}"
43+
echo "Unsupported OS: $RUNNER_OS"
4544
exit 1
4645
fi
4746
48-
echo "Downloading DataDog CI binary version ${BINARY_VERSION} for ${{ runner.os }}..."
47+
echo "Downloading DataDog CI binary version ${BINARY_VERSION} for $RUNNER_OS..."
4948
curl -sSL "$BINARY_URL" -o "$BINARY_PATH"
5049
51-
if [[ "${{ runner.os }}" == "Windows" ]]; then
50+
if [[ "${RUNNER_OS}" == "Windows" ]]; then
5251
echo "$BINARY_HASH_WINDOWS $BINARY_PATH" | sha256sum --check
53-
elif [[ "${{ runner.os }}" == "macOS" ]]; then
52+
elif [[ "${RUNNER_OS}" == "macOS" ]]; then
5453
echo "$BINARY_HASH_MACOS $BINARY_PATH" | shasum -a 256 --check
55-
elif [[ "${{ runner.os }}" == "Linux" ]]; then
54+
elif [[ "${RUNNER_OS}" == "Linux" ]]; then
5655
echo "$BINARY_HASH_LINUX $BINARY_PATH" | sha256sum --check
5756
fi
5857
5958
# Make binary executable (not needed for Windows)
60-
if [[ "${{ runner.os }}" != "Windows" ]]; then
59+
if [[ "${RUNNER_OS}" != "Windows" ]]; then
6160
chmod +x "$BINARY_PATH"
6261
fi
6362
6463
"$BINARY_PATH" junit upload --service coder ./gotests.xml \
65-
--tags os:${{runner.os}} --tags runner_name:${{runner.name}}
64+
--tags "os:${RUNNER_OS}" --tags "runner_name:${RUNNER_NAME}"
6665
env:
66+
REPO_OWNER: ${{ github.repository_owner }}
6767
DATADOG_API_KEY: ${{ inputs.api-key }}

‎.github/workflows/ci.yaml

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
4343
with:
4444
fetch-depth: 1
45-
# For pull requests it's not necessary to checkout the code
45+
persist-credentials: false
4646
- name: check changed files
4747
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
4848
id: filter
@@ -111,7 +111,9 @@ jobs:
111111
112112
- id: debug
113113
run: |
114-
echo "${{ toJSON(steps.filter )}}"
114+
echo "$FILTER_JSON"
115+
env:
116+
FILTER_JSON: ${{ toJSON(steps.filter.outputs) }}
115117

116118
# Disabled due to instability. See: https://github.com/coder/coder/issues/14553
117119
# Re-enable once the flake hash calculation is stable.
@@ -162,6 +164,7 @@ jobs:
162164
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
163165
with:
164166
fetch-depth: 1
167+
persist-credentials: false
165168

166169
- name: Setup Node
167170
uses: ./.github/actions/setup-node
@@ -234,6 +237,7 @@ jobs:
234237
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
235238
with:
236239
fetch-depth: 1
240+
persist-credentials: false
237241

238242
- name: Setup Node
239243
uses: ./.github/actions/setup-node
@@ -289,6 +293,7 @@ jobs:
289293
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
290294
with:
291295
fetch-depth: 1
296+
persist-credentials: false
292297

293298
- name: Setup Node
294299
uses: ./.github/actions/setup-node
@@ -353,12 +358,13 @@ jobs:
353358
# a separate repository to allow its use before actions/checkout.
354359
- name: Setup RAM Disks
355360
if: runner.os == 'Windows'
356-
uses: coder/setup-ramdisk-action@e1100847ab2d7bcd9d14bcda8f2d1b0f07b36f1b
361+
uses: coder/setup-ramdisk-action@e1100847ab2d7bcd9d14bcda8f2d1b0f07b36f1b # v0.1.0
357362

358363
- name: Checkout
359364
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
360365
with:
361366
fetch-depth: 1
367+
persist-credentials: false
362368

363369
- name: Setup Go Paths
364370
id: go-paths
@@ -421,34 +427,34 @@ jobs:
421427
set -o errexit
422428
set -o pipefail
423429
424-
if [ "${{ runner.os }}" == "Windows" ]; then
430+
if [ "$RUNNER_OS" == "Windows" ]; then
425431
# Create a temp dir on the R: ramdisk drive for Windows. The default
426432
# C: drive is extremely slow: https://github.com/actions/runner-images/issues/8755
427433
mkdir -p "R:/temp/embedded-pg"
428434
go run scripts/embedded-pg/main.go -path "R:/temp/embedded-pg" -cache "${EMBEDDED_PG_CACHE_DIR}"
429-
elif [ "${{ runner.os }}" == "macOS" ]; then
435+
elif [ "$RUNNER_OS" == "macOS" ]; then
430436
# Postgres runs faster on a ramdisk on macOS too
431437
mkdir -p /tmp/tmpfs
432438
sudo mount_tmpfs -o noowners -s 8g /tmp/tmpfs
433439
go run scripts/embedded-pg/main.go -path /tmp/tmpfs/embedded-pg -cache "${EMBEDDED_PG_CACHE_DIR}"
434-
elif [ "${{ runner.os }}" == "Linux" ]; then
440+
elif [ "$RUNNER_OS" == "Linux" ]; then
435441
make test-postgres-docker
436442
fi
437443
438444
# if macOS, install google-chrome for scaletests
439445
# As another concern, should we really have this kind of external dependency
440446
# requirement on standard CI?
441-
if [ "${{ matrix.os }}" == "macos-latest" ]; then
447+
if [ "${RUNNER_OS}" == "macos-latest" ]; then
442448
brew install google-chrome
443449
fi
444450
445451
# macOS will output "The default interactive shell is now zsh"
446452
# intermittently in CI...
447-
if [ "${{ matrix.os }}" == "macos-latest" ]; then
453+
if [ "${RUNNER_OS}" == "macos-latest" ]; then
448454
touch ~/.bash_profile && echo "export BASH_SILENCE_DEPRECATION_WARNING=1" >> ~/.bash_profile
449455
fi
450456
451-
if [ "${{ runner.os }}" == "Windows" ]; then
457+
if [ "${RUNNER_OS}" == "Windows" ]; then
452458
# Our Windows runners have 16 cores.
453459
# On Windows Postgres chokes up when we have 16x16=256 tests
454460
# running in parallel, and dbtestutil.NewDB starts to take more than
@@ -458,15 +464,15 @@ jobs:
458464
NUM_PARALLEL_TESTS=16
459465
# Only the CLI and Agent are officially supported on Windows and the rest are too flaky
460466
PACKAGES="./cli/... ./enterprise/cli/... ./agent/..."
461-
elif [ "${{ runner.os }}" == "macOS" ]; then
467+
elif [ "${RUNNER_OS}" == "macOS" ]; then
462468
# Our macOS runners have 8 cores. We set NUM_PARALLEL_TESTS to 16
463469
# because the tests complete faster and Postgres doesn't choke. It seems
464470
# that macOS's tmpfs is faster than the one on Windows.
465471
NUM_PARALLEL_PACKAGES=8
466472
NUM_PARALLEL_TESTS=16
467473
# Only the CLI and Agent are officially supported on macOS and the rest are too flaky
468474
PACKAGES="./cli/... ./enterprise/cli/... ./agent/..."
469-
elif [ "${{ runner.os }}" == "Linux" ]; then
475+
elif [ "${RUNNER_OS}" == "Linux" ]; then
470476
# Our Linux runners have 8 cores.
471477
NUM_PARALLEL_PACKAGES=8
472478
NUM_PARALLEL_TESTS=8
@@ -475,7 +481,7 @@ jobs:
475481
476482
# by default, run tests with cache
477483
TESTCOUNT=""
478-
if [ "${{ github.ref }}" == "refs/heads/main" ]; then
484+
if [ "${GITHUB_REF}" == "refs/heads/main" ]; then
479485
# on main, run tests without cache
480486
TESTCOUNT="-count=1"
481487
fi
@@ -546,6 +552,7 @@ jobs:
546552
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
547553
with:
548554
fetch-depth: 1
555+
persist-credentials: false
549556

550557
- name: Setup Go
551558
uses: ./.github/actions/setup-go
@@ -594,6 +601,7 @@ jobs:
594601
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
595602
with:
596603
fetch-depth: 1
604+
persist-credentials: false
597605

598606
- name: Setup Go
599607
uses: ./.github/actions/setup-go
@@ -653,6 +661,7 @@ jobs:
653661
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
654662
with:
655663
fetch-depth: 1
664+
persist-credentials: false
656665

657666
- name: Setup Go
658667
uses: ./.github/actions/setup-go
@@ -679,6 +688,7 @@ jobs:
679688
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
680689
with:
681690
fetch-depth: 1
691+
persist-credentials: false
682692

683693
- name: Setup Node
684694
uses: ./.github/actions/setup-node
@@ -711,6 +721,7 @@ jobs:
711721
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
712722
with:
713723
fetch-depth: 1
724+
persist-credentials: false
714725

715726
- name: Setup Node
716727
uses: ./.github/actions/setup-node
@@ -785,6 +796,7 @@ jobs:
785796
fetch-depth: 0
786797
# 👇 Tells the checkout which commit hash to reference
787798
ref: ${{ github.event.pull_request.head.ref }}
799+
persist-credentials: false
788800

789801
- name: Setup Node
790802
uses: ./.github/actions/setup-node
@@ -863,6 +875,7 @@ jobs:
863875
with:
864876
# 0 is required here for version.sh to work.
865877
fetch-depth: 0
878+
persist-credentials: false
866879

867880
- name: Setup Node
868881
uses: ./.github/actions/setup-node
@@ -926,7 +939,7 @@ jobs:
926939
egress-policy: audit
927940

928941
- name: Ensure required checks
929-
run: |
942+
run: | # zizmor: ignore[template-injection] We're just reading needs.x.result here, no risk of injection
930943
echo "Checking required checks"
931944
echo "- fmt: ${{ needs.fmt.result }}"
932945
echo "- lint: ${{ needs.lint.result }}"
@@ -959,6 +972,7 @@ jobs:
959972
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
960973
with:
961974
fetch-depth: 0
975+
persist-credentials: false
962976

963977
- name: Setup build tools
964978
run: |
@@ -1059,6 +1073,7 @@ jobs:
10591073
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
10601074
with:
10611075
fetch-depth: 0
1076+
persist-credentials: false
10621077

10631078
- name: GHCR Login
10641079
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
@@ -1201,7 +1216,7 @@ jobs:
12011216
make build/coder_"$version"_linux_{amd64,arm64,armv7}.tag
12021217
12031218
# only push if we are on main branch
1204-
if [ "${{ github.ref }}" == "refs/heads/main" ]; then
1219+
if [ "${GITHUB_REF}" == "refs/heads/main" ]; then
12051220
# build and push multi-arch manifest, this depends on the other images
12061221
# being pushed so will automatically push them
12071222
# note: omitting the -j argument to avoid race conditions when pushing
@@ -1228,12 +1243,13 @@ jobs:
12281243
continue-on-error: true
12291244
env:
12301245
COSIGN_EXPERIMENTAL: 1
1246+
BUILD_TAG: ${{ steps.build-docker.outputs.tag }}
12311247
run: |
12321248
set -euxo pipefail
12331249
12341250
# Define image base and tags
12351251
IMAGE_BASE="ghcr.io/coder/coder-preview"
1236-
TAGS=("${{ steps.build-docker.outputs.tag }}" "main" "latest")
1252+
TAGS=("${BUILD_TAG}" "main" "latest")
12371253
12381254
# Generate and attest SBOM for each tag
12391255
for tag in "${TAGS[@]}"; do
@@ -1372,7 +1388,7 @@ jobs:
13721388
# Report attestation failures but don't fail the workflow
13731389
- name: Check attestation status
13741390
if: github.ref == 'refs/heads/main'
1375-
run: |
1391+
run: | # zizmor: ignore[template-injection] We're just reading steps.attest_x.outcome here, no risk of injection
13761392
if [[ "${{ steps.attest_main.outcome }}" == "failure" ]]; then
13771393
echo "::warning::GitHub attestation for main tag failed"
13781394
fi
@@ -1432,6 +1448,7 @@ jobs:
14321448
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
14331449
with:
14341450
fetch-depth: 0
1451+
persist-credentials: false
14351452

14361453
- name: Authenticate to Google Cloud
14371454
uses: google-github-actions/auth@b7593ed2efd1c1617e1b0254da33b86225adb2a5 # v2.1.12
@@ -1496,6 +1513,7 @@ jobs:
14961513
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
14971514
with:
14981515
fetch-depth: 0
1516+
persist-credentials: false
14991517

15001518
- name: Setup flyctl
15011519
uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5
@@ -1531,7 +1549,7 @@ jobs:
15311549
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
15321550
with:
15331551
fetch-depth: 1
1534-
# We need golang to run the migration main.go
1552+
persist-credentials: false
15351553
- name: Setup Go
15361554
uses: ./.github/actions/setup-go
15371555

@@ -1550,7 +1568,7 @@ jobs:
15501568

15511569
steps:
15521570
- name: Send Slack notification
1553-
run: |
1571+
run: | # zizmor: ignore[template-injection] We're reading variables from github context into a json string, so replacing with envs is tricky
15541572
curl -X POST -H 'Content-type: application/json' \
15551573
--data '{
15561574
"blocks": [

‎.github/workflows/contrib.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ name: contrib
33
on:
44
issue_comment:
55
types: [created, edited]
6+
# zizmor: ignore[dangerous-triggers] We explicitly want to run on pull_request_target.
67
pull_request_target:
78
types:
89
- opened

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy