Skip to content

Commit 0cd5034

Browse files
Sherafflachlancollins
Sheraff
and
lachlancollins
authored
ci: add zizmor workflow (#450)
* ci: add zizmor workflow * ci: clarify skill review PR creation * Update .github/workflows/check-skills.yml * Update .github/workflows/e2e-opportunistic-matrix.yml * Update .github/workflows/notify-intent.yml * Update .github/workflows/pr.yml * Update .github/workflows/pr.yml * Update .github/workflows/pr.yml * Update .github/workflows/release.yml * Update .github/workflows/validate-skills.yml * Update .github/workflows/validate-skills.yml * Update .github/workflows/check-skills.yml * Update .github/workflows/notify-intent.yml * Update .github/workflows/e2e-opportunistic-matrix.yml --------- Co-authored-by: Lachlan Collins <[email protected]>
1 parent 4e3c35a commit 0cd5034

7 files changed

Lines changed: 90 additions & 47 deletions

File tree

‎.github/workflows/check-skills.yml‎

Lines changed: 24 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -16,22 +16,24 @@ on:
1616
types: [published]
1717
workflow_dispatch: {}
1818

19-
permissions:
20-
contents: write
21-
pull-requests: write
19+
permissions: {}
2220

2321
jobs:
2422
check:
2523
name: Check for stale skills
2624
runs-on: ubuntu-latest
25+
permissions:
26+
contents: write
27+
pull-requests: write
2728
steps:
2829
- name: Checkout
29-
uses: actions/checkout@v4
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3031
with:
3132
fetch-depth: 0
33+
persist-credentials: true # review job pushes a generated branch
3234

3335
- name: Setup Node
34-
uses: actions/setup-node@v4
36+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3537
with:
3638
node-version: 20
3739

@@ -108,8 +110,11 @@ jobs:
108110
if: steps.stale.outputs.has_stale == 'true'
109111
env:
110112
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
113+
PROMPT: ${{ steps.summary.outputs.prompt }}
114+
RELEASE_VERSION: ${{ github.event.release.tag_name || 'manual' }}
115+
SUMMARY: ${{ steps.summary.outputs.summary }}
111116
run: |
112-
VERSION="${{ github.event.release.tag_name || 'manual' }}"
117+
VERSION="$RELEASE_VERSION"
113118
BRANCH="skills/review-${VERSION}"
114119
115120
git config user.name "github-actions[bot]"
@@ -118,26 +123,20 @@ jobs:
118123
git commit --allow-empty -m "chore: review stale skills for ${VERSION}"
119124
git push origin "$BRANCH"
120125
126+
{
127+
printf '%s\n\n' '## Stale Skills Detected'
128+
printf '%s\n\n' 'The following skills may need updates after the latest release:'
129+
printf '%s\n\n' "$SUMMARY"
130+
printf '%s\n\n' '---'
131+
printf '%s\n\n' '### Update Prompt'
132+
printf '%s\n\n' 'Paste this into your coding agent (Claude Code, Cursor, etc.):'
133+
printf '%s\n' '~~~'
134+
printf '%s\n' "$PROMPT"
135+
printf '%s\n' '~~~'
136+
} > pr-body.md
137+
121138
gh pr create \
122139
--title "Review stale skills (${VERSION})" \
123-
--body "$(cat <<'PREOF'
124-
## Stale Skills Detected
125-
126-
The following skills may need updates after the latest release:
127-
128-
${{ steps.summary.outputs.summary }}
129-
130-
---
131-
132-
### Update Prompt
133-
134-
Paste this into your coding agent (Claude Code, Cursor, etc.):
135-
136-
~~~
137-
${{ steps.summary.outputs.prompt }}
138-
~~~
139-
140-
PREOF
141-
)" \
140+
--body-file pr-body.md \
142141
--head "$BRANCH" \
143142
--base main

‎.github/workflows/e2e-opportunistic-matrix.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,12 @@ jobs:
3434
- react-toolchain-deploy
3535
steps:
3636
- name: Checkout
37-
uses: actions/[email protected].1
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3838
with:
3939
fetch-depth: 0
40+
persist-credentials: false
4041
- name: Setup Tools
41-
uses: tanstack/config/.github/setup@main
42+
uses: tanstack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
4243
- name: Install Playwright Chrome
4344
run: pnpm --filter @tanstack/cli exec playwright install --with-deps chrome
4445
- name: Run Matrix Scenario
@@ -47,7 +48,7 @@ jobs:
4748
run: pnpm nx run @tanstack/cli:test:e2e:matrix
4849
- name: Upload Playwright Report
4950
if: always()
50-
uses: actions/upload-artifact@v4
51+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
5152
with:
5253
name: playwright-report-${{ matrix.scenario }}
5354
path: packages/cli/playwright-report

‎.github/workflows/notify-intent.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,19 @@ on:
2222
- 'docs/**'
2323
- 'src/**'
2424

25+
permissions:
26+
contents: read
27+
2528
jobs:
2629
notify:
2730
name: Notify TanStack Intent
2831
runs-on: ubuntu-latest
2932
steps:
3033
- name: Checkout
31-
uses: actions/checkout@v4
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3235
with:
3336
fetch-depth: 2
37+
persist-credentials: false
3438

3539
- name: Collect changed files
3640
id: changes
@@ -39,7 +43,7 @@ jobs:
3943
echo "files=$FILES" >> "$GITHUB_OUTPUT"
4044
4145
- name: Dispatch to intent repo
42-
uses: peter-evans/repository-dispatch@v3
46+
uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
4347
with:
4448
token: ${{ secrets.INTENT_NOTIFY_TOKEN }}
4549
repository: TanStack/intent

‎.github/workflows/pr.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,12 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Checkout
22-
uses: actions/[email protected].1
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2323
with:
2424
fetch-depth: 0
25+
persist-credentials: false
2526
- name: Setup Tools
26-
uses: tanstack/config/.github/setup@main
27+
uses: tanstack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
2728
- name: Build
2829
run: pnpm build
2930
- name: Test Unit
@@ -33,25 +34,27 @@ jobs:
3334
runs-on: ubuntu-latest
3435
steps:
3536
- name: Checkout
36-
uses: actions/[email protected].1
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3738
with:
3839
fetch-depth: 0
40+
persist-credentials: false
3941
- name: Check Provenance
40-
uses: danielroe/[email protected]
42+
uses: danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1
4143
with:
4244
fail-on-downgrade: true
4345
test-e2e:
4446
name: Test (E2E Blocking)
4547
runs-on: ubuntu-latest
4648
steps:
4749
- name: Checkout
48-
uses: actions/[email protected].1
50+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4951
with:
5052
fetch-depth: 0
53+
persist-credentials: false
5154
- name: Setup Tools
52-
uses: tanstack/config/.github/setup@main
55+
uses: tanstack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
5356
- name: Get base and head commits for `nx affected`
54-
uses: nrwl/[email protected]
57+
uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0
5558
with:
5659
main-branch-name: main
5760
- name: Install Playwright Chrome

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,26 @@ env:
1212
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
1313
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1414

15-
permissions:
16-
contents: write
17-
id-token: write
18-
pull-requests: read
19-
statuses: read
15+
permissions: {}
2016

2117
jobs:
2218
release:
2319
name: Release
2420
if: ${{ github.repository_owner == 'TanStack' && !contains(github.event.head_commit.message, '[skip ci]') }}
2521
runs-on: ubuntu-latest
22+
permissions:
23+
contents: write
24+
id-token: write
25+
pull-requests: read
26+
statuses: read
2627
steps:
2728
- name: Checkout
28-
uses: actions/[email protected].1
29+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2930
with:
3031
fetch-depth: 0
32+
persist-credentials: false
3133
- name: Setup Tools
32-
uses: tanstack/config/.github/setup@main
34+
uses: tanstack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
3335
- name: Build
3436
run: pnpm build
3537
- name: Test Unit
@@ -60,4 +62,6 @@ jobs:
6062

6163
- name: Publish Packages
6264
if: steps.release.outputs.has_changesets == 'true' && steps.changes.outputs.has_changes == 'true'
63-
run: pnpm changeset publish --tag "${{ steps.release.outputs.npm_tag }}"
65+
env:
66+
NPM_TAG: ${{ steps.release.outputs.npm_tag }}
67+
run: pnpm changeset publish --tag "$NPM_TAG"

‎.github/workflows/validate-skills.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,21 @@ on:
1212
- 'skills/**'
1313
- '**/skills/**'
1414

15+
permissions:
16+
contents: read
17+
1518
jobs:
1619
validate:
1720
name: Validate skill files
1821
runs-on: ubuntu-latest
1922
steps:
2023
- name: Checkout
21-
uses: actions/checkout@v4
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
with:
26+
persist-credentials: false
2227

2328
- name: Setup Node
24-
uses: actions/setup-node@v4
29+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
2530
with:
2631
node-version: 20
2732

‎.github/workflows/zizmor.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: GitHub Actions Security Analysis
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- '**'
10+
11+
permissions: {}
12+
13+
jobs:
14+
zizmor:
15+
name: zizmor
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20+
with:
21+
persist-credentials: false
22+
23+
- name: Run zizmor
24+
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
25+
with:
26+
advanced-security: false
27+
annotations: true

0 commit comments

Comments
 (0)