Skip to content

Commit 6ac601c

Browse files
willmurphyscodewillmurphyscode
authored
Chore better zizmor (#573)
* ci: enable zizmor to fail github PRs Set up linting for gh actions yaml and wire up this linter to be able to fail PRs. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * chore: remove husky precommit line Husky was warning that this line was deprecated and would start failing in a future release. Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * ci: force bash on windows to simplify env var handling Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> * quote grype_cmd env var Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com> --------- Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
1 parent e2f9cdb commit 6ac601c

9 files changed

Lines changed: 76 additions & 6 deletions

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,14 @@ updates:
44
directory: /
55
schedule:
66
interval: "daily"
7+
cooldown:
8+
default-days: 7
79
open-pull-requests-limit: 10
810

911
- package-ecosystem: npm
1012
directory: /
1113
schedule:
1214
interval: "daily"
15+
cooldown:
16+
default-days: 7
1317
open-pull-requests-limit: 10

‎.github/workflows/oss-project-board-add.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
- transferred
99
- labeled
1010

11+
permissions: {}
12+
1113
jobs:
1214

1315
run:

‎.github/workflows/release-drafter.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55
branches:
66
- main
77

8+
permissions: {}
9+
810
jobs:
911
update_release_draft:
1012
runs-on: ubuntu-latest

‎.github/workflows/tag-release.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ on:
44
release:
55
types: [published, edited]
66

7+
permissions: {}
8+
79
jobs:
810
actions-tagger:
911
runs-on: ubuntu-latest

‎.github/workflows/test.yml‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,15 @@ on:
77
branches:
88
- main
99

10+
permissions: {}
11+
1012
jobs:
1113
build: # make sure build/ci work properly and there is no faked build ncc built scripts
1214
runs-on: ubuntu-latest
1315
steps:
1416
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
17+
with:
18+
persist-credentials: false
1519
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
1620
with:
1721
node-version-file: package.json
@@ -30,6 +34,8 @@ jobs:
3034
- 5000:5000
3135
steps:
3236
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
37+
with:
38+
persist-credentials: false
3339
- run: npm ci
3440
- run: npm run test
3541

@@ -40,6 +46,7 @@ jobs:
4046
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4147
with:
4248
path: ./
49+
persist-credentials: false
4350

4451
- name: "Donwload Grype v0.54.0"
4552
id: grype
@@ -48,7 +55,10 @@ jobs:
4855
grype-version: v0.54.0
4956

5057
- name: "Check Grype version before scan-action"
51-
run: ${{ steps.grype.outputs.cmd }} version | egrep "^Version:.*0.54.0$"
58+
env:
59+
GRYPE_CMD: ${{ steps.grype.outputs.cmd }}
60+
run: |
61+
"$GRYPE_CMD" version | egrep "^Version:.*0.54.0$"
5262
5363
- name: "Scan test image"
5464
uses: ./
@@ -57,7 +67,10 @@ jobs:
5767
fail-build: false # to prevent fail due to vuln:s on test image
5868

5969
- name: "Check Grype version after scan-action"
60-
run: ${{ steps.grype.outputs.cmd }} version | egrep "^Version:.*0.54.0$"
70+
env:
71+
GRYPE_CMD: ${{ steps.grype.outputs.cmd }}
72+
run: |
73+
"$GRYPE_CMD" version | egrep "^Version:.*0.54.0$"
6174
6275
test-all:
6376
strategy:
@@ -72,6 +85,8 @@ jobs:
7285
runs-on: ${{ matrix.os }}
7386
steps:
7487
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
88+
with:
89+
persist-credentials: false
7590
- uses: ./
7691
id: scan
7792
with:
@@ -83,4 +98,7 @@ jobs:
8398

8499
- name: Validate file exists
85100
if: ${{ matrix.output-format != 'table' }}
86-
run: test -f '${{ steps.scan.outputs[matrix.output-format] }}'
101+
shell: bash
102+
env:
103+
OUTPUT_FILE: ${{ steps.scan.outputs[matrix.output-format] }}
104+
run: test -f "$OUTPUT_FILE"

‎.github/workflows/update-grype-release.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,16 @@ on:
77
# Allows you to run this workflow manually from the Actions tab
88
workflow_dispatch:
99

10+
permissions: {}
11+
1012
jobs:
1113
upgrade-grype:
1214
runs-on: ubuntu-latest
1315
if: github.repository == 'anchore/scan-action'
1416
steps:
1517
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
18+
with:
19+
persist-credentials: false
1620
- name: Get latest Grype version
1721
id: latest-version
1822
env:

‎.github/workflows/validate-github-actions.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: "Validate GitHub Actions"
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- '.github/workflows/**'
7+
- '.github/actions/**'
8+
push:
9+
branches:
10+
- main
11+
paths:
12+
- '.github/workflows/**'
13+
- '.github/actions/**'
14+
15+
permissions:
16+
contents: read
17+
18+
jobs:
19+
zizmor:
20+
name: "Lint"
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
24+
steps:
25+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
26+
with:
27+
persist-credentials: false
28+
29+
- name: "Run zizmor"
30+
uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0
31+
with:
32+
config: .github/zizmor.yml
33+
# Disable SARIF upload so the step is a simple pass/fail gate
34+
advanced-security: false
35+
inputs: .github

‎.github/zizmor.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
rules:
2+
unpinned-uses:
3+
config:
4+
policies:
5+
# anchore/workflows is an internal repository; using @main is acceptable
6+
anchore/*: any

‎.husky/pre-commit‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,2 @@
1-
#!/bin/sh
2-
. "$(dirname "$0")/_/husky.sh"
3-
41
npx lint-staged
52
npm run precommit

0 commit comments

Comments
 (0)