Skip to content

Commit 042a96a

Browse files
rohityanrohityan
committed
fix(ci): resolve zizmor security findings in GitHub Actions workflows
1 parent 6ccb837 commit 042a96a

13 files changed

Lines changed: 84 additions & 43 deletions

‎.github/workflows/analyze-releases-for-adk-docs-updates.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,12 @@ jobs:
4545

4646
steps:
4747
- name: Checkout repository
48-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
48+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
49+
with:
50+
persist-credentials: false
4951

5052
- name: Set up Python
51-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
53+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5254
with:
5355
python-version: '3.11'
5456

‎.github/workflows/block-merge.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ on:
1919
branches: [main]
2020
types: [opened, reopened, synchronize]
2121

22+
permissions:
23+
contents: read
24+
2225
jobs:
2326
block-merge:
2427
if: github.repository == 'google/adk-python'

‎.github/workflows/continuous-integration.yml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ jobs:
4040
runs-on: ubuntu-latest
4141
steps:
4242
- name: Checkout Code
43-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
43+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
44+
with:
45+
persist-credentials: false
4446

4547
- name: Run pre-commit checks
4648
uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
@@ -56,12 +58,13 @@ jobs:
5658
python-version: ['3.10', '3.11', '3.12', '3.13']
5759
steps:
5860
- name: Checkout code
59-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
61+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6062
with:
63+
persist-credentials: false
6164
fetch-depth: 0
6265

6366
- name: Set up Python
64-
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
67+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.2.0
6568
with:
6669
python-version: ${{ matrix.python-version }}
6770

@@ -127,10 +130,12 @@ jobs:
127130
timeout-minutes: 10
128131
steps:
129132
- name: Checkout code
130-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
133+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
134+
with:
135+
persist-credentials: false
131136

132137
- name: Set up Python ${{ matrix.python-version }}
133-
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
138+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.2.0
134139
with:
135140
python-version: ${{ matrix.python-version }}
136141

@@ -169,10 +174,12 @@ jobs:
169174
timeout-minutes: 10
170175
steps:
171176
- name: Checkout code
172-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
177+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
178+
with:
179+
persist-credentials: false
173180

174181
- name: Set up Python ${{ matrix.python-version }}
175-
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
182+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.2.0
176183
with:
177184
python-version: ${{ matrix.python-version }}
178185

‎.github/workflows/copybara-pr-handler.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040

4141
steps:
4242
- name: Check for Copybara commits and close PRs
43-
uses: actions/github-script@v8
43+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
4444
with:
4545
github-token: ${{ secrets.ADK_TRIAGE_AGENT }}
4646
script: |

‎.github/workflows/discussion_answering.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,18 @@ jobs:
3434

3535
steps:
3636
- name: Checkout repository
37-
uses: actions/checkout@v6
37+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
38+
with:
39+
persist-credentials: false
3840

3941
- name: Set up Python
40-
uses: actions/setup-python@v6
42+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
4143
with:
4244
python-version: '3.11'
4345

4446
- name: Authenticate to Google Cloud
4547
id: auth
46-
uses: 'google-github-actions/auth@v3'
48+
uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3
4749
with:
4850
credentials_json: '${{ secrets.ADK_GCP_SA_KEY }}'
4951

‎.github/workflows/issue-maintenance.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,12 @@ jobs:
5858
timeout-minutes: 120
5959
steps:
6060
- name: Checkout repository
61-
uses: actions/checkout@v6
61+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
62+
with:
63+
persist-credentials: false
6264

6365
- name: Set up Python
64-
uses: actions/setup-python@v6
66+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
6567
with:
6668
python-version: '3.11'
6769

@@ -84,10 +86,12 @@ jobs:
8486
timeout-minutes: 60
8587
steps:
8688
- name: Checkout repository
87-
uses: actions/checkout@v6
89+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
90+
with:
91+
persist-credentials: false
8892

8993
- name: Set up Python
90-
uses: actions/setup-python@v6
94+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
9195
with:
9296
python-version: '3.11'
9397

‎.github/workflows/pr-triage.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,10 +52,12 @@ jobs:
5252

5353
steps:
5454
- name: Checkout repository
55-
uses: actions/checkout@v6
55+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
56+
with:
57+
persist-credentials: false
5658

5759
- name: Set up Python
58-
uses: actions/setup-python@v6
60+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5961
with:
6062
python-version: '3.11'
6163

‎.github/workflows/release-cherry-pick.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,9 @@ jobs:
5151
echo "candidate_branch=release/candidate" >> $GITHUB_OUTPUT
5252
fi
5353
54-
- uses: actions/checkout@v6
54+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
5555
with:
56+
persist-credentials: false
5657
ref: ${{ steps.config.outputs.candidate_branch }}
5758
token: ${{ secrets.RELEASE_PAT }}
5859
fetch-depth: 0
@@ -73,16 +74,18 @@ jobs:
7374
fi
7475
7576
- name: Cherry-pick commit
77+
env:
78+
CANDIDATE_BRANCH: ${{ steps.config.outputs.candidate_branch }}
7679
run: |
77-
CANDIDATE_BRANCH="${{ steps.config.outputs.candidate_branch }}"
7880
echo "Cherry-picking ${INPUTS_COMMIT_SHA} to $CANDIDATE_BRANCH"
7981
git cherry-pick ${INPUTS_COMMIT_SHA}
8082
env:
8183
INPUTS_COMMIT_SHA: ${{ inputs.commit_sha }}
8284

8385
- name: Push changes
86+
env:
87+
CANDIDATE_BRANCH: ${{ steps.config.outputs.candidate_branch }}
8488
run: |
85-
CANDIDATE_BRANCH="${{ steps.config.outputs.candidate_branch }}"
8689
git push origin "$CANDIDATE_BRANCH"
8790
echo "Successfully cherry-picked commit to $CANDIDATE_BRANCH"
8891
echo "If you want to regenerate the changelog PR, run the 'Release: Cut' workflow manually"

‎.github/workflows/release-cut.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,9 @@ jobs:
6969
# Action: CUT NEW RELEASE
7070
- name: Checkout base ref (Cut)
7171
if: inputs.action == 'cut'
72-
uses: actions/checkout@v6
72+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
7373
with:
74+
persist-credentials: false
7475
ref: ${{ inputs.commit_sha || steps.config.outputs.base_ref }}
7576
token: ${{ secrets.RELEASE_PAT }}
7677

@@ -86,24 +87,26 @@ jobs:
8687
8788
- name: Create and push candidate branch (Cut)
8889
if: inputs.action == 'cut'
90+
env:
91+
CANDIDATE_BRANCH: ${{ steps.config.outputs.candidate_branch }}
8992
run: |
90-
CANDIDATE_BRANCH="${{ steps.config.outputs.candidate_branch }}"
9193
git checkout -b "$CANDIDATE_BRANCH"
9294
git push origin "$CANDIDATE_BRANCH"
9395
echo "Created and pushed branch: $CANDIDATE_BRANCH"
9496
9597
# Action: REGENERATE EXISTING PR
9698
- name: Checkout existing candidate branch (Regenerate)
9799
if: inputs.action == 'regenerate'
98-
uses: actions/checkout@v6
100+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
99101
with:
102+
persist-credentials: false
100103
ref: ${{ steps.config.outputs.candidate_branch }}
101104
token: ${{ secrets.RELEASE_PAT }}
102105

103106
# Run Release Please
104107
- name: Run Release Please
105108
id: release_please
106-
uses: googleapis/release-please-action@v4
109+
uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
107110
with:
108111
token: ${{ secrets.RELEASE_PAT }}
109112
config-file: ${{ steps.config.outputs.config_file }}
@@ -118,7 +121,7 @@ jobs:
118121
# so it also runs when release-please updates an existing PR (regenerate).
119122
- name: Set up Python
120123
if: steps.release_please.outputs.pr != ''
121-
uses: actions/setup-python@v6
124+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
122125
with:
123126
python-version: '3.11'
124127

‎.github/workflows/release-finalize.yml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,9 @@ jobs:
4747
- name: Determine Branch Configurations
4848
if: steps.check.outputs.is_release_pr == 'true'
4949
id: config
50+
env:
51+
CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
5052
run: |
51-
CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
5253
if [ "$CANDIDATE_BRANCH" = "release/v1-candidate" ]; then
5354
echo "base_branch=v1" >> $GITHUB_OUTPUT
5455
echo "config_file=.github/release-please-config-v1.json" >> $GITHUB_OUTPUT
@@ -59,18 +60,21 @@ jobs:
5960
echo "manifest_file=.github/.release-please-manifest.json" >> $GITHUB_OUTPUT
6061
fi
6162
62-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
63+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6364
if: steps.check.outputs.is_release_pr == 'true'
6465
with:
66+
persist-credentials: false
6567
ref: ${{ github.event.pull_request.base.ref }}
6668
token: ${{ secrets.RELEASE_PAT }}
6769
fetch-depth: 0
6870

6971
- name: Extract version from manifest
7072
if: steps.check.outputs.is_release_pr == 'true'
7173
id: version
74+
env:
75+
MANIFEST_FILE: ${{ steps.config.outputs.manifest_file }}
7276
run: |
73-
VERSION=$(jq -r '.["."]' "${{ steps.config.outputs.manifest_file }}")
77+
VERSION=$(jq -r '.["."]' "$MANIFEST_FILE")
7478
echo "version=$VERSION" >> $GITHUB_OUTPUT
7579
echo "Extracted version: $VERSION"
7680
@@ -85,10 +89,11 @@ jobs:
8589
8690
- name: Record last-release-sha for release-please
8791
if: steps.check.outputs.is_release_pr == 'true'
92+
env:
93+
BASE_BRANCH: ${{ steps.config.outputs.base_branch }}
94+
CONFIG_FILE: ${{ steps.config.outputs.config_file }}
95+
CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
8896
run: |
89-
BASE_BRANCH="${{ steps.config.outputs.base_branch }}"
90-
CONFIG_FILE="${{ steps.config.outputs.config_file }}"
91-
CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
9297
9398
git fetch origin "$BASE_BRANCH"
9499
CUT_SHA=$(git merge-base "origin/$BASE_BRANCH" HEAD)
@@ -103,9 +108,11 @@ jobs:
103108
104109
- name: Rename candidate to release/v{version}
105110
if: steps.check.outputs.is_release_pr == 'true'
111+
env:
112+
STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
113+
CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
106114
run: |
107115
VERSION="v${STEPS_VERSION_OUTPUTS_VERSION}"
108-
CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
109116
git push origin "$CANDIDATE_BRANCH:refs/heads/release/$VERSION" ":$CANDIDATE_BRANCH"
110117
echo "Renamed $CANDIDATE_BRANCH to release/$VERSION"
111118
env:

0 commit comments

Comments
 (0)