mroberts
250b3e98ca
Pins every action to the latest release SHA within its current major, so no untested major bump rides along: checkout v4.4.0, setup-go v5.6.0, upload-artifact v4.6.2, download-artifact v4.3.0, action-gh-release v2.6.2. Adds a `workflows` CI job running actionlint and zizmor. actionlint comes from `go install` (module proxy checksums cover integrity); zizmor has no published checksums, so its release tarball is pinned by version and verified against a recorded sha256. The gate uses --min-severity=low, which fails on low and above while tolerating the one informational superfluous-actions advisory. zizmor only collects from .github/workflows: pointing it at .gitea/workflows yields "no inputs collected", and when both directories are passed it audits only .github and still exits 0. The gate therefore passes explicit *.yml paths, which is the only form that actually audits the Gitea workflows. Auditing them for the first time surfaced seven findings, now fixed: credential persistence on checkout (persist-credentials: false), setup-go caching on the release path (cache: false), and missing top-level permissions (contents: read, with contents: write narrowed to the GitHub release job that needs it).
101 lines
2.6 KiB
YAML
101 lines
2.6 KiB
YAML
name: CI
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- '**.go'
|
|
- 'go.mod'
|
|
- 'go.sum'
|
|
- 'Makefile'
|
|
- '.gitea/workflows/**'
|
|
- '.github/workflows/**'
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- '**.go'
|
|
- 'go.mod'
|
|
- 'go.sum'
|
|
- 'Makefile'
|
|
- '.gitea/workflows/**'
|
|
- '.github/workflows/**'
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: cpu
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
|
with:
|
|
go-version: '1.25'
|
|
cache: false
|
|
|
|
- name: Format check
|
|
run: |
|
|
unformatted=$(find . -name '*.go' -not -path '*/testdata/*' -print0 | xargs -0 gofmt -l)
|
|
if [ -n "$unformatted" ]; then
|
|
echo "gofmt needs to run on:"
|
|
echo "$unformatted"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Vet
|
|
run: go vet ./...
|
|
|
|
- name: Test
|
|
run: go test ./...
|
|
|
|
- name: Static build
|
|
run: CGO_ENABLED=0 go build -ldflags="-w -s" -o shush ./cmd/shush
|
|
|
|
workflows:
|
|
runs-on: cpu
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
|
with:
|
|
go-version: '1.25'
|
|
cache: false
|
|
|
|
- name: Install actionlint
|
|
run: go install github.com/rhysd/actionlint/cmd/[email protected]
|
|
|
|
- name: Install zizmor
|
|
env:
|
|
ZIZMOR_VERSION: '1.27.0'
|
|
ZIZMOR_SHA256: '277f2bd8fd37cf60c42ab7afca6faa884e65440fa31e02b44bdaae60f62a358f'
|
|
run: |
|
|
set -euo pipefail
|
|
url="https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz"
|
|
curl -sSLf -o zizmor.tar.gz "$url"
|
|
echo "${ZIZMOR_SHA256} zizmor.tar.gz" | sha256sum -c -
|
|
tar xzf zizmor.tar.gz
|
|
install -m 0755 zizmor "$(go env GOPATH)/bin/zizmor"
|
|
|
|
- name: actionlint
|
|
run: |
|
|
gopath="$(go env GOPATH)"
|
|
export PATH="$gopath/bin:$PATH"
|
|
actionlint .gitea/workflows/*.yml .github/workflows/*.yml
|
|
|
|
- name: zizmor
|
|
run: |
|
|
gopath="$(go env GOPATH)"
|
|
export PATH="$gopath/bin:$PATH"
|
|
zizmor --min-severity=low .gitea/workflows/*.yml .github/workflows/*.yml
|