berkus
/
actix-web
mirror of https://github.com/fafhrd91/actix-web
1
0
Fork 0
Code Issues Releases Wiki Activity

chore: use zizmor to harden GHA usage (#4054)

This commit is contained in:
Yuki Okushi 2026-04-29 23:52:36 +09:00 committed by GitHub
parent ea992f97c3
commit 101c608124
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
9 changed files with 69 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.github/dependabot.yml vendored
View File

@ -4,8 +4,12 @@ updates:
directory: /
schedule:
interval: weekly
cooldown:
default-days: 3
- package-ecosystem: cargo
directory: /
schedule:
interval: weekly
cooldown:
default-days: 3
versioning-strategy: lockfile-only

2
.github/workflows/bench.yml vendored
View File

@ -17,6 +17,8 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust
run: |

4
.github/workflows/ci-post-merge.yml vendored
View File

@ -29,6 +29,8 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install nasm
if: matrix.target.os == 'windows-latest'
@ -72,6 +74,8 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Free Disk Space
run: ./scripts/free-disk-space.sh

6
.github/workflows/ci.yml vendored
View File

@ -40,6 +40,8 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install nasm
if: matrix.target.os == 'windows-latest'
@ -94,6 +96,8 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
@ -110,6 +114,8 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust (nightly)
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0

2
.github/workflows/coverage.yml vendored
View File

@ -16,6 +16,8 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust (nightly)
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0

2
.github/workflows/labeler.yml vendored
View File

@ -13,4 +13,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1

30
.github/workflows/lint.yml vendored
View File

@ -12,10 +12,30 @@ concurrency:
cancel-in-progress: true
jobs:
zizmor:
name: zizmor
permissions:
actions: read
contents: read
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
with:
advanced-security: false
annotations: true
version: v1.24.1
fmt:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust (nightly)
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
@ -34,6 +54,8 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
@ -53,6 +75,8 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust (nightly)
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
@ -70,6 +94,8 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install Rust (${{ vars.RUST_VERSION_EXTERNAL_TYPES }})
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
@ -87,4 +113,6 @@ jobs:
tool: cargo-check-external-types
- name: check external types
run: just check-external-types-all +${{ vars.RUST_VERSION_EXTERNAL_TYPES }}
run: just check-external-types-all +"${RUST_VERSION_EXTERNAL_TYPES}"
env:
RUST_VERSION_EXTERNAL_TYPES: ${{ vars.RUST_VERSION_EXTERNAL_TYPES }}

17
.github/workflows/semver-checks.yml vendored
View File

@ -13,6 +13,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install Rust
uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
@ -59,16 +60,22 @@ jobs:
- name: Summarize cargo semver-checks output
if: always() && steps.semver.outcome != 'skipped'
shell: bash
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
SEMVER_TYPE: ${{ steps.semver.outputs.semver_type }}
STATUS: ${{ steps.semver.outputs.exit_code }}
SUMMARY_FILE: ${{ steps.semver.outputs.output_file }}
run: |
summary_file="${{ steps.semver.outputs.output_file }}"
status="${{ steps.semver.outputs.exit_code }}"
summary_file="$SUMMARY_FILE"
status="$STATUS"
{
echo "## cargo semver-checks"
echo
echo "- Base SHA: \`${{ github.event.pull_request.base.sha }}\`"
echo "- Head SHA: \`${{ github.event.pull_request.head.sha }}\`"
echo "- Required release: \`${{ steps.semver.outputs.semver_type }}\`"
echo "- Base SHA: \`${BASE_SHA}\`"
echo "- Head SHA: \`${HEAD_SHA}\`"
echo "- Required release: \`${SEMVER_TYPE}\`"
echo "- cargo semver-checks exit code: \`$status\`"
echo

8
zizmor.yml Normal file
View File

@ -0,0 +1,8 @@
rules:
dangerous-triggers:
ignore:
# Required for labeling PRs from forks; does not check out PR head.
- labeler.yml:3
dependabot-cooldown:
config:
days: 3