From 007ddc0c4e1e8c4e3c1879fe3a4888aa0dd2c730 Mon Sep 17 00:00:00 2001 From: Johannes Ewald Date: Thu, 23 Apr 2026 16:22:35 +0200 Subject: [PATCH 1/5] chore: Add zizmor action linter #77 --- .github/workflows/test.yml | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 6ad8a9e..8693367 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -24,22 +24,24 @@ jobs: steps: - name: ๐Ÿ“ฅ Checkout repository uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # main + with: + persist-credentials: false - name: ๐ŸŸข Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # main + uses: actions/setup-node@670825a89dc0abd596e7a3abd0f5e3f6e5faf37c # main with: node-version-file: ".tool-versions" cache: "npm" - name: ๐Ÿ—„ Cache node_modules id: cache-node_modules - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # main + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # main with: path: "**/node_modules" key: node_modules-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }} - name: ๐Ÿ—„ Cache .eslintcache - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # main + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # main with: path: .eslintcache key: eslintcache-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }} @@ -54,3 +56,21 @@ jobs: CI: true run: | npm test + + zizmor: + name: ๐ŸŒˆ zizmor + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + + steps: + - name: ๐Ÿ“ฅ Checkout repository + uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # main + with: + persist-credentials: false + + - name: ๐ŸŒˆ Run zizmor + uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 + with: + advanced-security: false From dc10e57b4e60ac3e0afb21b1ff82b92908cb1292 Mon Sep 17 00:00:00 2001 From: Johannes Ewald Date: Thu, 23 Apr 2026 16:27:02 +0200 Subject: [PATCH 2/5] chore: Fix permissions --- .github/workflows/test.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8693367..fe2d726 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -8,14 +8,14 @@ on: pull_request: {} workflow_dispatch: {} -permissions: - actions: write - contents: read - jobs: test: + name: ๐Ÿงช Test runs-on: ubuntu-latest if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }} + permissions: + actions: write + contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} From dce56e1d21d0757a39d80e55f6e4d10507b32514 Mon Sep 17 00:00:00 2001 From: Johannes Ewald Date: Thu, 23 Apr 2026 16:29:13 +0200 Subject: [PATCH 3/5] Rename --- .github/workflows/test.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index fe2d726..19f8c23 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -57,11 +57,10 @@ jobs: run: | npm test - zizmor: - name: ๐ŸŒˆ zizmor + lint-github-action: + name: ๐Ÿ” Lint Github Action runs-on: ubuntu-latest permissions: - actions: read contents: read steps: From 27959b7dd37432fbd0943d99fe8c0c523ad5bcbb Mon Sep 17 00:00:00 2001 From: Johannes Ewald Date: Thu, 23 Apr 2026 16:45:49 +0200 Subject: [PATCH 4/5] Extract into dedicated workflow --- .github/workflows/lint-github-actions.yml | 35 +++++++++++++++++++++++ .github/workflows/test.yml | 19 ++---------- 2 files changed, 37 insertions(+), 17 deletions(-) create mode 100644 .github/workflows/lint-github-actions.yml diff --git a/.github/workflows/lint-github-actions.yml b/.github/workflows/lint-github-actions.yml new file mode 100644 index 0000000..5764584 --- /dev/null +++ b/.github/workflows/lint-github-actions.yml @@ -0,0 +1,35 @@ +name: ๐Ÿ” Lint GitHub Actions + +on: + push: + branches: + - main + - beta + paths: + - ".github/workflows/**/*.yml" + - ".github/workflows/**/*.yaml" + pull_request: + paths: + - ".github/workflows/**/*.yml" + - ".github/workflows/**/*.yaml" + workflow_dispatch: {} + +permissions: {} + +jobs: + zizmor: + name: ๐ŸŒˆ zizmor + runs-on: ubuntu-latest + permissions: + contents: read + + steps: + - name: ๐Ÿ“ฅ Checkout repository + uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # main + with: + persist-credentials: false + + - name: ๐ŸŒˆ Run zizmor + uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 + with: + advanced-security: false diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 19f8c23..0c26e5c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -8,6 +8,8 @@ on: pull_request: {} workflow_dispatch: {} +permissions: {} + jobs: test: name: ๐Ÿงช Test @@ -56,20 +58,3 @@ jobs: CI: true run: | npm test - - lint-github-action: - name: ๐Ÿ” Lint Github Action - runs-on: ubuntu-latest - permissions: - contents: read - - steps: - - name: ๐Ÿ“ฅ Checkout repository - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # main - with: - persist-credentials: false - - - name: ๐ŸŒˆ Run zizmor - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 - with: - advanced-security: false From 0b081428ba5bce5f35a0243bd9766b89d0d3cd1c Mon Sep 17 00:00:00 2001 From: Johannes Ewald Date: Thu, 23 Apr 2026 16:50:19 +0200 Subject: [PATCH 5/5] Rename --- .github/workflows/lint-github-actions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lint-github-actions.yml b/.github/workflows/lint-github-actions.yml index 5764584..c303d43 100644 --- a/.github/workflows/lint-github-actions.yml +++ b/.github/workflows/lint-github-actions.yml @@ -17,7 +17,7 @@ on: permissions: {} jobs: - zizmor: + lint-github-actions: name: ๐ŸŒˆ zizmor runs-on: ubuntu-latest permissions: