[github] Apply zizmor fixes to workflows Apply the zizmore auto-fixes to GitHub actions workflows. Some additional manual fixes to get zizmore fully green: narrowing default permissions, removing secret inheritance, use native gh CLI for release, and bettern env var handling. Change-Id: I02cac5391b5abfac03d930177fdd9822cc199a4c Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/319915 Reviewed-by: Kai Ninomiya <kainino@chromium.org> Commit-Queue: Kai Ninomiya <kainino@chromium.org>
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4de2719..40edda7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ workflow_dispatch: workflow_call: +permissions: + contents: read + concurrency: # Use github.run_id on main branch # Use github.event.pull_request.number on pull requests, so it's unique per pull request @@ -93,7 +96,9 @@ SCCACHE_GHA_ENABLED: "true" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Extract Windows SDK build version if: matrix.os == 'windows-latest' @@ -102,7 +107,7 @@ - name: Set up Windows SDK if: matrix.os == 'windows-latest' - uses: fbactions/setup-winsdk@v2 + uses: fbactions/setup-winsdk@808cfabb8fbe8537bcb677beb136682c9e712aff # v2 with: winsdk-build-version: ${{ env.WIN10_SDK_BUILD_VERSION }} @@ -122,7 +127,7 @@ - name: Set up sccache # dawn-ci.cmake documents why sccache is not used in other platforms. if: matrix.os == 'ubuntu-latest' - uses: mozilla-actions/sccache-action@v0.0.5 + uses: mozilla-actions/sccache-action@89e9040de88b577a072e3760aaf59f585da083af # v0.0.5 - name: Configure CMake run: > @@ -143,7 +148,7 @@ cmake -E tar cvzf Dawn-${{ github.sha }}-${{ matrix.os }}-${{ matrix.build_type }}.tar.gz Dawn-${{ github.sha }}-${{ matrix.os }}-${{ matrix.build_type }} - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: Dawn-${{ github.sha }}-${{ matrix.os }}-${{ matrix.build_type }} path: Dawn-${{ github.sha }}-${{ matrix.os }}-${{ matrix.build_type }}.tar.gz @@ -182,18 +187,21 @@ name: Build-android-${{ matrix.arch }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: submodules: true + persist-credentials: false - name: Setup Android NDK id: setup-ndk - uses: nttld/setup-ndk@v1 + uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1 with: ndk-version: r27d - name: Set ANDROID_NDK - run: echo "ANDROID_NDK=${{ steps.setup-ndk.outputs.ndk-path }}" >> $GITHUB_ENV + run: echo "ANDROID_NDK=${STEPS_SETUP_NDK_OUTPUTS_NDK_PATH}" >> $GITHUB_ENV + env: + STEPS_SETUP_NDK_OUTPUTS_NDK_PATH: ${{ steps.setup-ndk.outputs.ndk-path }} - name: Build host protoc run: | @@ -238,7 +246,7 @@ ${{ matrix.strip_tool }} --strip-debug ${{ matrix.output_dir }}/${{ matrix.library_path }} - name: Upload build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-android-${{ matrix.arch }} path: ${{ matrix.output_dir }}/${{ matrix.library_path }} @@ -251,7 +259,7 @@ - name: Upload headers (from arm64-v8a build only) if: matrix.arch == 'arm64-v8a' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: dawn-headers-${{ github.sha }} path: dawn-headers-${{ github.sha }}.tar.gz @@ -291,12 +299,13 @@ runs-on: macos-latest-large steps: - name: Setup Xcode - uses: maxim-lobanov/setup-xcode@v1 + uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1 with: xcode-version: latest-stable - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: submodules: true + persist-credentials: false - name: Download Apple toolchain run: | @@ -343,7 +352,7 @@ ninja -C ${{ matrix.output_dir }} - name: Upload build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-${{ matrix.platform }}-${{ matrix.arch }} path: ${{ matrix.output_dir }}/${{ matrix.library_path }} @@ -353,10 +362,12 @@ runs-on: macos-latest needs: [mobile-android, mobile-apple] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Download all build artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: pattern: build-* path: artifacts @@ -395,13 +406,13 @@ tar -czf dawn-apple-${{ github.sha }}.xcframework.tar.gz dawn-apple-${{ github.sha }}.xcframework - name: Upload Android artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: dawn-android-${{ github.sha }} path: dawn-android-${{ github.sha }}.tar.gz - name: Upload Apple artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: dawn-apple-${{ github.sha }} path: dawn-apple-${{ github.sha }}.xcframework.tar.gz @@ -410,10 +421,12 @@ name: Go Build and Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Go - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4 with: go-version: '1.23'
diff --git a/.github/workflows/pr-manager.yml b/.github/workflows/pr-manager.yml index eac4ada..541082b 100644 --- a/.github/workflows/pr-manager.yml +++ b/.github/workflows/pr-manager.yml
@@ -21,7 +21,7 @@ permissions: pull-requests: write steps: - - uses: marocchino/sticky-pull-request-comment@v2 + - uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2 with: number: ${{ inputs.pullNumber }} header: pr_was_imported # key to reuse the same comment @@ -41,7 +41,7 @@ permissions: pull-requests: write steps: - - uses: marocchino/sticky-pull-request-comment@v2 + - uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2 with: number: ${{ inputs.pullNumber }} header: pr_was_merged # key to reuse the same comment @@ -49,7 +49,7 @@ message: 🚀 PR was merged in ${{ inputs.targetUrl }}! - name: Close PR - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 with: script: | await github.rest.pulls.update({
diff --git a/.github/workflows/pr-watcher.yml b/.github/workflows/pr-watcher.yml index ef365b3..d1bf103 100644 --- a/.github/workflows/pr-watcher.yml +++ b/.github/workflows/pr-watcher.yml
@@ -15,7 +15,7 @@ actions: write steps: - name: Check Pull Requests - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 with: script: | // Get all open PRs.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 69b9ec6..0e899f9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml
@@ -6,7 +6,7 @@ - cron: '50 5 * * 2-6' # 05:50 UTC, Tue-Sat morning (21:50 PST / 22:50 PDT Mon-Fri night) permissions: - contents: write + contents: read jobs: build-wasm: @@ -15,13 +15,15 @@ outputs: PKG_VERSION: ${{ steps.build.outputs.PKG_VERSION }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Build Emscripten Package id: build run: | - GITHUB_REPOSITORY="${{ github.repository }}" GITHUB_REF_NAME="${{ github.ref_name }}" .github/workflows/package-emdawnwebgpu.sh + GITHUB_REPOSITORY="${{ github.repository }}" GITHUB_REF_NAME="${GITHUB_REF_NAME}" .github/workflows/package-emdawnwebgpu.sh - name: Upload WASM Artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: emdawnwebgpu path: | @@ -31,14 +33,15 @@ build-native: uses: ./.github/workflows/ci.yml - secrets: inherit publish: needs: [build-wasm, build-native] runs-on: ubuntu-latest + permissions: + contents: write steps: - name: Download All Artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: path: artifacts @@ -48,14 +51,15 @@ ls -R artifacts - name: Upload to GitHub Release - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ needs.build-wasm.outputs.PKG_VERSION }} - name: ${{ needs.build-wasm.outputs.PKG_VERSION }} - body_path: RELEASE_INFO.md - files: | - artifacts/**/Dawn-*.tar.gz - artifacts/**/dawn-android-*.tar.gz - artifacts/**/dawn-apple-*.xcframework.tar.gz - artifacts/**/dawn-headers-*.tar.gz + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG_NAME: ${{ needs.build-wasm.outputs.PKG_VERSION }} + run: | + gh release create "$TAG_NAME" \ + --title "$TAG_NAME" \ + --notes-file RELEASE_INFO.md \ + artifacts/Dawn-*/Dawn-*.tar.gz \ + artifacts/dawn-android-*/dawn-android-*.tar.gz \ + artifacts/dawn-apple-*/dawn-apple-*.xcframework.tar.gz \ + artifacts/dawn-headers-*/dawn-headers-*.tar.gz \ artifacts/emdawnwebgpu/*