Skip to content

Commit 166dc9d

Browse files
oceanocean
authored
Merge pull request #88 from ocean/claude/zizmor-security-improvements-TYtjO
security: apply zizmor GitHub Actions security improvements
2 parents 8de2fb0 + 933ca89 commit 166dc9d

3 files changed

Lines changed: 81 additions & 55 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ updates:
1414
semver-major-days: 10
1515
semver-minor-days: 5
1616
semver-patch-days: 2
17+
default-days: 7
1718
# Enable version checks and updates for Rust dependencies.
1819
- package-ecosystem: "cargo"
1920
directory: "/native/ecto_libsql/"
@@ -23,10 +24,13 @@ updates:
2324
semver-major-days: 10
2425
semver-minor-days: 5
2526
semver-patch-days: 2
27+
default-days: 7
2628
# Enable version updates for GitHub Actions.
2729
- package-ecosystem: "github-actions"
2830
# Workflow files stored in the default location of `.github/workflows`
2931
# You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
3032
directory: "/"
3133
schedule:
3234
interval: "monthly"
35+
cooldown:
36+
default-days: 7

‎.github/workflows/ci.yml‎

Lines changed: 64 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
name: CI
22
permissions:
33
contents: read
4-
pull-requests: write
54

65
on:
76
pull_request:
@@ -26,16 +25,18 @@ jobs:
2625

2726
steps:
2827
- name: Checkout code
29-
uses: actions/checkout@v6
28+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
with:
30+
persist-credentials: false
3031

3132
- name: Set up Rust
32-
uses: dtolnay/rust-toolchain@stable
33-
with:
34-
toolchain: ${{ matrix.rust }}
35-
components: rustfmt, clippy
33+
run: |
34+
rustup update ${{ matrix.rust }}
35+
rustup default ${{ matrix.rust }}
36+
rustup component add rustfmt clippy
3637
3738
- name: Cache Rust dependencies
38-
uses: actions/cache@v5
39+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
3940
with:
4041
path: |
4142
~/.cargo/bin/
@@ -76,15 +77,18 @@ jobs:
7677

7778
steps:
7879
- name: Checkout code
79-
uses: actions/checkout@v6
80+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
81+
with:
82+
persist-credentials: false
8083

8184
- name: Set up Rust nightly
82-
uses: dtolnay/rust-toolchain@nightly
83-
with:
84-
components: llvm-tools-preview
85+
run: |
86+
rustup update nightly
87+
rustup default nightly
88+
rustup component add llvm-tools-preview
8589
8690
- name: Cache Rust dependencies
87-
uses: actions/cache@v5
91+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
8892
with:
8993
path: |
9094
~/.cargo/bin/
@@ -119,21 +123,21 @@ jobs:
119123

120124
steps:
121125
- name: Checkout code
122-
uses: actions/checkout@v6
126+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
127+
with:
128+
persist-credentials: false
123129

124130
- name: Set up Rust
125-
uses: dtolnay/rust-toolchain@stable
126-
with:
127-
toolchain: stable
131+
run: rustup update stable && rustup default stable
128132

129133
- name: Set up Elixir
130-
uses: erlef/setup-beam@v1
134+
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
131135
with:
132136
elixir-version: ${{ matrix.elixir }}
133137
otp-version: ${{ matrix.otp }}
134138

135139
- name: Cache Mix dependencies
136-
uses: actions/cache@v5
140+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
137141
with:
138142
path: |
139143
deps
@@ -176,21 +180,21 @@ jobs:
176180

177181
steps:
178182
- name: Checkout code
179-
uses: actions/checkout@v6
183+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
184+
with:
185+
persist-credentials: false
180186

181187
- name: Set up Rust
182-
uses: dtolnay/rust-toolchain@stable
183-
with:
184-
toolchain: stable
188+
run: rustup update stable && rustup default stable
185189

186190
- name: Set up Elixir
187-
uses: erlef/setup-beam@v1
191+
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
188192
with:
189193
elixir-version: ${{ matrix.elixir }}
190194
otp-version: ${{ matrix.otp }}
191195

192196
- name: Cache Mix dependencies
193-
uses: actions/cache@v5
197+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
194198
with:
195199
path: |
196200
deps
@@ -215,19 +219,21 @@ jobs:
215219

216220
steps:
217221
- name: Checkout code
218-
uses: actions/checkout@v6
222+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
223+
with:
224+
persist-credentials: false
219225

220226
- name: Set up Rust
221-
uses: dtolnay/rust-toolchain@stable
227+
run: rustup update stable && rustup default stable
222228

223229
- name: Set up Elixir
224-
uses: erlef/setup-beam@v1
230+
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
225231
with:
226232
elixir-version: "1.18.0"
227233
otp-version: "27.0"
228234

229235
- name: Cache Mix dependencies
230-
uses: actions/cache@v5
236+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
231237
with:
232238
path: |
233239
deps
@@ -237,7 +243,7 @@ jobs:
237243
${{ runner.os }}-integration-mix-
238244
239245
- name: Cache Rust dependencies
240-
uses: actions/cache@v5
246+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
241247
with:
242248
path: |
243249
~/.cargo/bin/
@@ -286,16 +292,17 @@ jobs:
286292
turso-remote-tests:
287293
name: Turso Remote Database Tests
288294
runs-on: ubuntu-latest
295+
environment: test
289296
needs: [rust-checks, elixir-tests-latest, elixir-tests-compatibility]
290297
# Only run on PRs to main
291298
if: github.event_name == 'pull_request' && github.base_ref == 'main'
292-
env:
293-
TURSO_DB_URI: ${{ secrets.TURSO_DB_URI }}
294-
TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }}
295299

296300
steps:
297301
- name: Check if secrets are available
298302
id: check-secrets
303+
env:
304+
TURSO_DB_URI: ${{ secrets.TURSO_DB_URI }}
305+
TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }}
299306
run: |
300307
if [ -z "$TURSO_DB_URI" ] || [ -z "$TURSO_AUTH_TOKEN" ]; then
301308
echo "Secrets not available, skipping tests"
@@ -307,22 +314,24 @@ jobs:
307314
308315
- name: Checkout code
309316
if: steps.check-secrets.outputs.skip != 'true'
310-
uses: actions/checkout@v6
317+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
318+
with:
319+
persist-credentials: false
311320

312321
- name: Set up Rust
313322
if: steps.check-secrets.outputs.skip != 'true'
314-
uses: dtolnay/rust-toolchain@stable
323+
run: rustup update stable && rustup default stable
315324

316325
- name: Set up Elixir
317326
if: steps.check-secrets.outputs.skip != 'true'
318-
uses: erlef/setup-beam@v1
327+
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
319328
with:
320329
elixir-version: "1.18.0"
321330
otp-version: "27.0"
322331

323332
- name: Cache Mix dependencies
324333
if: steps.check-secrets.outputs.skip != 'true'
325-
uses: actions/cache@v5
334+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
326335
with:
327336
path: |
328337
deps
@@ -333,7 +342,7 @@ jobs:
333342
334343
- name: Cache Rust dependencies
335344
if: steps.check-secrets.outputs.skip != 'true'
336-
uses: actions/cache@v5
345+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
337346
with:
338347
path: |
339348
~/.cargo/bin/
@@ -355,6 +364,9 @@ jobs:
355364

356365
- name: Run Turso remote tests
357366
if: steps.check-secrets.outputs.skip != 'true'
367+
env:
368+
TURSO_DB_URI: ${{ secrets.TURSO_DB_URI }}
369+
TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }}
358370
run: mix test test/turso_remote_test.exs --trace
359371

360372
all-checks-pass:
@@ -374,21 +386,28 @@ jobs:
374386
steps:
375387
- name: Check if all jobs passed
376388
run: |
377-
if [ "${{ needs.rust-checks.result }}" != "success" ] || \
378-
[ "${{ needs.rust-fuzz.result }}" != "success" ] || \
379-
[ "${{ needs.elixir-tests-latest.result }}" != "success" ] || \
380-
[ "${{ needs.elixir-tests-compatibility.result }}" != "success" ] || \
381-
[ "${{ needs.integration-test.result }}" != "success" ]; then
389+
if [ "${NEEDS_RUST_CHECKS_RESULT}" != "success" ] || \
390+
[ "${NEEDS_RUST_FUZZ_RESULT}" != "success" ] || \
391+
[ "${NEEDS_ELIXIR_TESTS_LATEST_RESULT}" != "success" ] || \
392+
[ "${NEEDS_ELIXIR_TESTS_COMPATIBILITY_RESULT}" != "success" ] || \
393+
[ "${NEEDS_INTEGRATION_TEST_RESULT}" != "success" ]; then
382394
echo "One or more checks failed"
383395
exit 1
384396
fi
385397
echo "All checks passed successfully!"
386398
387399
# Note: Turso remote tests are optional and don't block the build
388-
if [ "${{ needs.turso-remote-tests.result }}" == "success" ]; then
400+
if [ "${NEEDS_TURSO_REMOTE_TESTS_RESULT}" == "success" ]; then
389401
echo "Turso remote tests also passed!"
390-
elif [ "${{ needs.turso-remote-tests.result }}" == "skipped" ]; then
402+
elif [ "${NEEDS_TURSO_REMOTE_TESTS_RESULT}" == "skipped" ]; then
391403
echo "Turso remote tests were skipped (not on PR to main or credentials not available)"
392-
elif [ "${{ needs.turso-remote-tests.result }}" == "failure" ]; then
404+
elif [ "${NEEDS_TURSO_REMOTE_TESTS_RESULT}" == "failure" ]; then
393405
echo "WARNING: Turso remote tests failed (but not blocking the build)"
394406
fi
407+
env:
408+
NEEDS_RUST_CHECKS_RESULT: ${{ needs.rust-checks.result }}
409+
NEEDS_RUST_FUZZ_RESULT: ${{ needs.rust-fuzz.result }}
410+
NEEDS_ELIXIR_TESTS_LATEST_RESULT: ${{ needs.elixir-tests-latest.result }}
411+
NEEDS_ELIXIR_TESTS_COMPATIBILITY_RESULT: ${{ needs.elixir-tests-compatibility.result }}
412+
NEEDS_INTEGRATION_TEST_RESULT: ${{ needs.integration-test.result }}
413+
NEEDS_TURSO_REMOTE_TESTS_RESULT: ${{ needs.turso-remote-tests.result }}

‎.github/workflows/release.yml‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,9 @@ jobs:
4848

4949
steps:
5050
- name: Checkout code
51-
uses: actions/checkout@v6
51+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
52+
with:
53+
persist-credentials: false
5254

5355
- name: Extract and validate project version
5456
shell: bash
@@ -83,13 +85,14 @@ jobs:
8385
echo "PROJECT_VERSION=$VERSION" >> $GITHUB_ENV
8486
8587
- name: Install Rust toolchain
86-
uses: dtolnay/rust-toolchain@stable
87-
with:
88-
targets: ${{ matrix.job.target }}
88+
run: |
89+
rustup update stable
90+
rustup default stable
91+
rustup target add ${{ matrix.job.target }}
8992
9093
- name: Build the project
9194
id: build-crate
92-
uses: philss/[email protected]
95+
uses: philss/rustler-precompiled-action@853ac56183f29a080304df3ff8a194b5bbdc24cc # v1.1.4
9396
with:
9497
project-name: ecto_libsql
9598
project-version: ${{ env.PROJECT_VERSION }}
@@ -99,14 +102,14 @@ jobs:
99102
project-dir: "."
100103

101104
- name: Artifact upload
102-
uses: actions/upload-artifact@v7
105+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
103106
with:
104107
name: ${{ steps.build-crate.outputs.file-name }}
105108
path: ${{ steps.build-crate.outputs.file-path }}
106109

107110
- name: Publish archives and packages
108-
uses: softprops/action-gh-release@v2
109-
with:
110-
files: |
111-
${{ steps.build-crate.outputs.file-path }}
112111
if: startsWith(github.ref, 'refs/tags/') && inputs.test_only != 'true'
112+
env:
113+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
114+
RELEASE_FILE_PATH: ${{ steps.build-crate.outputs.file-path }}
115+
run: gh release upload "${GITHUB_REF_NAME}" "${RELEASE_FILE_PATH}" --clobber

0 commit comments

Comments
 (0)