Repository navigation
ci: Resolve most zizmor findings as of zizmor@1.31.1 - #759
Conversation
See: https://github.com/actions/checkout/releases/tag/v3.7.0 This is the same version we're already implicitly using. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
See: https://github.com/actions/checkout/releases/tag/v4.4.0 This is the same version we're already implicitly using. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
See: https://github.com/release-plz/action/releases/tag/v0.5.147 This is the same version we're already implicitly using. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>
|
Let's see if this works here. r? crabwatch |
|
Nope. Looks like it'll be another coin flip. As last time, Heads=Marco. |
$ fend d2
1: 50.00% ##############################
2: 50.00% ##############################
$ fend roll 1d2
1CC: @marcoieni |
| miri: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
that's a very old version of the checkout action, should this be upgraded to v7?
There was a problem hiding this comment.
Don't mind doing whatever's needed to upgrade to the latest version.
…what changed about checking out a git repository that required 4 major version bumps? 🙈
There was a problem hiding this comment.
…what changed about checking out a git repository that required 4 major version bumps? 🙈
There was a problem hiding this comment.
Ah yes, my favourite kind of breaking change: using a newer version of Node.js.
There was a problem hiding this comment.
that's a very old version of the
checkoutaction, should this be upgraded tov7?
It certainly wouldn't hurt, but I default to not updating anything in these PRs unless asked.
…what changed about checking out a git repository that required 4 major version bumps? 🙈
The only difference I know of off the top of my head is the one zizmor documents. By default, using actions/checkout causes a credential to be persisted on disk. Versions below v6.0.0 store the credential directly in the checked-out repo's .git/config, while v6.0.0 and later store it under ${RUNNER_TEMP}. But that shouldn't matter anymore after this since we're setting persist-credentials: false.
There was a problem hiding this comment.
Don't mind doing whatever's needed to upgrade to the latest version.
Also, does this mean you'd like me to bump actions/checkout? I can, and it probably maybe should happen, but it isn't an explicit goal for this PR otherwise.
We don't have triagebot enabled for the repo. I should look into setting that up. |
Yeah, I'm not sure how I'd check other than by trying or looking for the config in By the way, a review from Marco isn't required on this if it's something you're comfortable with reviewing yourself. This workflow is just meant to be a convenience for maintainers: #t-infra > pr review request @ 💬 |
|
I mean, it looks good to me; I just am not sure if there's other stuff that's missing from this PR. Like, from the perspective of being a gatekeeper to new changes, I'm fine merging this, but from the perspective of providing an actually useful review, I don't actually know enough about this to provide any additional guidance. |
The changes in this PR are pretty straightforward, thankfully (we have some pretty unusual CI setups; |
|
Is |
Yes, it is. You can see it in the policy here: https://github.com/rust-lang/crabwatch/blob/c564abe3fc4920999ff3b90fd7cce1a54ad9d387/zizmor-policy.yml#L27-L28 |
hashcatHitman
moved this from zizmor PR opened
to Needs Policy Update
in t-crabwatch policy expansion
hashcatHitman
moved this from Needs Policy Update
to Policy Adjusted
in t-crabwatch policy expansion
In pursuit of getting more
zizmorlints enforced acrossrust-langrepos throughcrabwatch, this PR fixes mostzizmorfindings as ofzizmor@1.31.1, using theauditorpersona. The lints that actually fired per-persona level are:regularpersona findings:artipackedexcessive-permissions(See also: Solve theexcessive-permissionslint crabwatch#97)template-injectionunpinned-usespedanticpersona findings:regularexcessive-permissions(See also: Solve theexcessive-permissionslint crabwatch#97)undocumented-permissionssuperfluous-actionsanonymous-definition(Because coming up with names is hard and there is minimal benefit to this)concurrency-limits(Due to concerns about special cases. See also: Determine special cases forconcurrency-limitscrabwatch#107)auditorpersona findings:pedanticThe hash pin format is supported by tools like Dependabot and Renovate, which can update the pinned hashes and their associated comments. If you'd like help setting either of those up, let me know which you prefer, and if you'd like it in this PR or a new one. By default, I'd assume to set it up to only update GitHub Actions.