Skip to content

Commit 3568b67

Browse files
decofegrandizzy
decofe
and
grandizzy
authored
chore(ci): scan GitHub Actions workflows (#253)
* chore(ci): scan GitHub Actions workflows Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * chore(ci): fix workflow scanner findings Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * chore(ci): preserve existing cargo-deny workflow Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> --------- Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com>
1 parent bc73d6a commit 3568b67

4 files changed

Lines changed: 64 additions & 29 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,18 +28,18 @@ jobs:
2828
runner: ["ubuntu-latest", "macos-14", "macos-15", "windows-latest"]
2929
steps:
3030
- name: Secure runner
31-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
31+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
3232
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3333
with:
3434
persist-credentials: false
35-
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
35+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
3636
with:
3737
toolchain: stable
3838
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
3939
with:
4040
cache-on-failure: true
4141
- name: Install nextest
42-
uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@117919c943b804057be733b0c4034c5542e58959
42+
uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
4343
with:
4444
tool: nextest@0.9.140
4545
checksum: true
@@ -55,15 +55,15 @@ jobs:
5555
contents: read
5656
steps:
5757
- name: Secure runner
58-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
58+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
5959
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6060
with:
6161
persist-credentials: false
62-
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
62+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
6363
with:
6464
toolchain: stable
6565
- name: Install cargo-hack
66-
uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@117919c943b804057be733b0c4034c5542e58959
66+
uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
6767
with:
6868
tool: cargo-hack@0.6.45
6969
checksum: true
@@ -82,11 +82,11 @@ jobs:
8282
contents: read
8383
steps:
8484
- name: Secure runner
85-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
85+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
8686
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
8787
with:
8888
persist-credentials: false
89-
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
89+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
9090
with:
9191
toolchain: nightly
9292
components: clippy
@@ -105,11 +105,11 @@ jobs:
105105
contents: read
106106
steps:
107107
- name: Secure runner
108-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
108+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
109109
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
110110
with:
111111
persist-credentials: false
112-
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
112+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
113113
with:
114114
toolchain: nightly
115115
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
@@ -127,11 +127,11 @@ jobs:
127127
contents: read
128128
steps:
129129
- name: Secure runner
130-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
130+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
131131
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
132132
with:
133133
persist-credentials: false
134-
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
134+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
135135
with:
136136
toolchain: nightly
137137
components: rustfmt

‎.github/workflows/release.yml‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ jobs:
6464
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6565
steps:
6666
- name: Secure runner
67-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
67+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
6868
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
6969
with:
7070
persist-credentials: false
@@ -90,7 +90,8 @@ jobs:
9090
env:
9191
DIST_SUBCOMMAND: ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }}
9292
run: |
93-
dist $DIST_SUBCOMMAND --output-format=json > plan-dist-manifest.json
93+
read -r -a dist_subcommand_args <<< "$DIST_SUBCOMMAND"
94+
dist "${dist_subcommand_args[@]}" --output-format=json > plan-dist-manifest.json
9495
# Job containers and Intel macOS hosts cannot run this Aegis release.
9596
jq -e 'all(.ci.github.artifacts_matrix.include[]; .container == null and .host != "x86_64-apple-darwin")' plan-dist-manifest.json
9697
echo "dist ran successfully"
@@ -131,7 +132,7 @@ jobs:
131132
BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
132133
steps:
133134
- name: Secure runner
134-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
135+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
135136
- name: enable windows longpaths
136137
run: |
137138
git config --global core.longpaths true
@@ -162,8 +163,10 @@ jobs:
162163
TAG_FLAG: ${{ needs.plan.outputs.tag-flag }}
163164
DIST_ARGS: ${{ matrix.dist_args }}
164165
run: |
166+
read -r -a tag_flag_args <<< "$TAG_FLAG"
167+
read -r -a dist_args_args <<< "$DIST_ARGS"
165168
# Actually do builds and make zips and whatnot
166-
dist build $TAG_FLAG --print=linkage --output-format=json $DIST_ARGS > dist-manifest.json
169+
dist build "${tag_flag_args[@]}" --print=linkage --output-format=json "${dist_args_args[@]}" > dist-manifest.json
167170
echo "dist ran successfully"
168171
- id: cargo-dist
169172
name: Post-build
@@ -173,9 +176,11 @@ jobs:
173176
shell: bash
174177
run: |
175178
# Parse out what we just built and upload it to scratch storage
176-
echo "paths<<EOF" >> "$GITHUB_OUTPUT"
177-
dist print-upload-files-from-manifest --manifest dist-manifest.json >> "$GITHUB_OUTPUT"
178-
echo "EOF" >> "$GITHUB_OUTPUT"
179+
{
180+
echo "paths<<EOF"
181+
dist print-upload-files-from-manifest --manifest dist-manifest.json
182+
echo "EOF"
183+
} >> "$GITHUB_OUTPUT"
179184
180185
cp dist-manifest.json "$BUILD_MANIFEST_NAME"
181186
- name: "Upload artifacts"
@@ -200,7 +205,7 @@ jobs:
200205
BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
201206
steps:
202207
- name: Secure runner
203-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
208+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
204209
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
205210
with:
206211
persist-credentials: false
@@ -225,13 +230,16 @@ jobs:
225230
env:
226231
TAG_FLAG: ${{ needs.plan.outputs.tag-flag }}
227232
run: |
228-
dist build $TAG_FLAG --output-format=json "--artifacts=global" > dist-manifest.json
233+
read -r -a tag_flag_args <<< "$TAG_FLAG"
234+
dist build "${tag_flag_args[@]}" --output-format=json "--artifacts=global" > dist-manifest.json
229235
echo "dist ran successfully"
230236
231237
# Parse out what we just built and upload it to scratch storage
232-
echo "paths<<EOF" >> "$GITHUB_OUTPUT"
233-
jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT"
234-
echo "EOF" >> "$GITHUB_OUTPUT"
238+
{
239+
echo "paths<<EOF"
240+
jq --raw-output ".upload_files[]" dist-manifest.json
241+
echo "EOF"
242+
} >> "$GITHUB_OUTPUT"
235243
236244
cp dist-manifest.json "$BUILD_MANIFEST_NAME"
237245
- name: "Upload artifacts"
@@ -259,7 +267,7 @@ jobs:
259267
val: ${{ steps.host.outputs.manifest }}
260268
steps:
261269
- name: Secure runner
262-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
270+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
263271
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
264272
with:
265273
persist-credentials: false
@@ -285,7 +293,8 @@ jobs:
285293
env:
286294
TAG_FLAG: ${{ needs.plan.outputs.tag-flag }}
287295
run: |
288-
dist host $TAG_FLAG --steps=upload --steps=release --output-format=json > dist-manifest.json
296+
read -r -a tag_flag_args <<< "$TAG_FLAG"
297+
dist host "${tag_flag_args[@]}" --steps=upload --steps=release --output-format=json > dist-manifest.json
289298
echo "artifacts uploaded and released successfully"
290299
cat dist-manifest.json
291300
echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
@@ -313,7 +322,7 @@ jobs:
313322
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
314323
steps:
315324
- name: Secure runner
316-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
325+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
317326
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
318327
with:
319328
persist-credentials: false
@@ -337,7 +346,8 @@ jobs:
337346
RELEASE_COMMIT: "${{ github.sha }}"
338347
RELEASE_TAG: "${{ needs.plan.outputs.tag }}"
339348
run: |
349+
read -r -a prerelease_flag_args <<< "$PRERELEASE_FLAG"
340350
# Write and read notes from a file to avoid quoting breaking things
341-
echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt
351+
echo "$ANNOUNCEMENT_BODY" > "$RUNNER_TEMP/notes.txt"
342352
343-
gh release create "$RELEASE_TAG" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
353+
gh release create "$RELEASE_TAG" --target "$RELEASE_COMMIT" "${prerelease_flag_args[@]}" --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*

‎.github/workflows/scan-github-actions.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Scan GitHub Actions
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches: [master]
7+
workflow_dispatch:
8+
9+
permissions: {}
10+
11+
jobs:
12+
scan:
13+
uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@b35994a23aaf6acf4d5e2f91d18235a6e2f90e95 # 2026-09-23T08-07-21Z-b35994a2
14+
permissions:
15+
actions: read
16+
contents: read
17+
id-token: write
18+
with:
19+
secure-runner-fail-on-violation: false

‎.pinact.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 3
2+
rules:
3+
# Keep the reviewed immutable deny pin; tempoxyz/ci has no release tags.
4+
- ignore: true
5+
conditions:
6+
- expr: ActionName == "tempoxyz/ci/.github/workflows/deny.yml" && ActionVersion == "feeee35d6e4047767f0d97881ac6e83fe3c9ebf3"

0 commit comments

Comments
 (0)