From 572ec19d0b7bf6e85fac1de553114043ca4fd935 Mon Sep 17 00:00:00 2001 From: Gino Miceli Date: Wed, 1 Jul 2026 12:41:42 +0200 Subject: [PATCH] Apply Zizmor security fixes to GitHub actions --- .github/workflows/check.yml | 32 +++++++++++++++++-------- .github/workflows/deploy-to-staging.yml | 6 +++-- .github/workflows/jekyll-gh-pages.yml | 14 ++++++----- .github/workflows/test-create.yml | 4 +++- .github/workflows/test-e2e.yml | 8 +++++-- .github/workflows/test-verify.yml | 4 +++- 6 files changed, 46 insertions(+), 22 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index dcea1a0cb..85c14f1ec 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -22,9 +22,11 @@ jobs: web: ${{ steps.filter.outputs.web }} steps: - name: Check out code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - - uses: dorny/paths-filter@v3 + - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3 id: filter with: filters: | @@ -60,7 +62,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Set up environment uses: ./.github/actions/setup @@ -87,7 +91,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Set up environment uses: ./.github/actions/setup @@ -114,7 +120,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Set up environment uses: ./.github/actions/setup @@ -134,7 +142,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Set up environment uses: ./.github/actions/setup @@ -142,7 +152,7 @@ jobs: cache-key-suffix: web - name: Install Chrome - uses: browser-actions/setup-chrome@v1 + uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1 id: setup-chrome with: chrome-version: stable @@ -150,8 +160,10 @@ jobs: - name: Configure Chrome Environment shell: bash run: | - echo "CHROME_BIN=${{ steps.setup-chrome.outputs.chrome-path }}" >> $GITHUB_ENV - echo "CHROME_PATH=${{ steps.setup-chrome.outputs.chrome-path }}" >> $GITHUB_ENV + echo "CHROME_BIN=${STEPS_SETUP_CHROME_OUTPUTS_CHROME_PATH}" >> $GITHUB_ENV + echo "CHROME_PATH=${STEPS_SETUP_CHROME_OUTPUTS_CHROME_PATH}" >> $GITHUB_ENV + env: + STEPS_SETUP_CHROME_OUTPUTS_CHROME_PATH: ${{ steps.setup-chrome.outputs.chrome-path }} - name: Check formatting run: pnpm exec nx run web:format:check @@ -168,6 +180,6 @@ jobs: run: pnpm exec nx test web - name: Update test coverage report - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/deploy-to-staging.yml b/.github/workflows/deploy-to-staging.yml index f69acb3b7..a2ab8c1b0 100644 --- a/.github/workflows/deploy-to-staging.yml +++ b/.github/workflows/deploy-to-staging.yml @@ -23,7 +23,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Set up environment uses: ./.github/actions/setup @@ -32,7 +34,7 @@ jobs: run: pnpm exec nx build --configuration=staging - name: Deploy to Firebase - uses: FirebaseExtended/action-hosting-deploy@v0 + uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0 with: repoToken: ${{ secrets.GITHUB_TOKEN }} firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_GROUND_DEV_SIG }} diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml index 8cc88670b..af65b5dbb 100644 --- a/.github/workflows/jekyll-gh-pages.yml +++ b/.github/workflows/jekyll-gh-pages.yml @@ -30,22 +30,24 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Setup Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - name: Build - uses: actions/jekyll-build-pages@v1 + uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1 with: source: "./docs" - name: Upload artifact - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 deploy: runs-on: ubuntu-latest needs: build steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 environment: name: github-pages - url: ${{ steps.deployment.outputs.page_url }} \ No newline at end of file + url: ${{ steps.deployment.outputs.page_url }} diff --git a/.github/workflows/test-create.yml b/.github/workflows/test-create.yml index 6c1e11b44..633b8339f 100644 --- a/.github/workflows/test-create.yml +++ b/.github/workflows/test-create.yml @@ -26,7 +26,9 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Run create-test uses: ./.github/actions/create-test with: diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml index c6eda844c..2ee022af9 100644 --- a/.github/workflows/test-e2e.yml +++ b/.github/workflows/test-e2e.yml @@ -36,7 +36,9 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Run create-test uses: ./.github/actions/create-test with: @@ -63,7 +65,9 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Run verify-test uses: ./.github/actions/verify-test with: diff --git a/.github/workflows/test-verify.yml b/.github/workflows/test-verify.yml index cb924f353..2f51c566c 100644 --- a/.github/workflows/test-verify.yml +++ b/.github/workflows/test-verify.yml @@ -26,7 +26,9 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + persist-credentials: false - name: Run verify-test uses: ./.github/actions/verify-test with: