Merge pull request #3045 from hashcatHitman/ref-version-mismatch_and_stale-action-refs_and_unpinned-uses ci: Resolve most `zizmor` findings as of `zizmor@1.31.1`
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 23b590e..afdf7ca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml
@@ -9,10 +9,14 @@ # Run multiple times a day as the successful cached links are not checked every time. - cron: "0 */8 * * *" +permissions: {} + jobs: ci: if: github.repository == 'rust-lang/rustc-dev-guide' runs-on: ubuntu-latest + permissions: + contents: write # Required by `git push` env: MDBOOK_VERSION: 0.5.2 MDBOOK_LINKCHECK2_VERSION: 0.13.0 @@ -26,13 +30,14 @@ with: # linkcheck needs the base commit. fetch-depth: 0 + persist-credentials: false - name: Test CI scripts run: ci/tests/report-scheduled-linkcheck-failure.sh - name: Cache binaries id: mdbook-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/bin @@ -41,7 +46,7 @@ - name: Restore cached Linkcheck if: github.event_name == 'schedule' id: cache-linkcheck-restore - uses: actions/cache/restore@v4 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: book/linkcheck/cache.json key: linkcheck--${{ env.MDBOOK_LINKCHECK2_VERSION }}--${{ github.run_id }} @@ -57,9 +62,9 @@ - name: Install Dependencies if: steps.mdbook-cache.outputs.cache-hit != 'true' run: | - cargo install --locked mdbook --version ${{ env.MDBOOK_VERSION }} - cargo install --locked mdbook-linkcheck2 --version ${{ env.MDBOOK_LINKCHECK2_VERSION }} - cargo install --locked mdbook-mermaid --version ${{ env.MDBOOK_MERMAID_VERSION }} + cargo install --locked mdbook --version ${MDBOOK_VERSION} + cargo install --locked mdbook-linkcheck2 --version ${MDBOOK_LINKCHECK2_VERSION} + cargo install --locked mdbook-mermaid --version ${MDBOOK_MERMAID_VERSION} - name: Check build run: ENABLE_LINKCHECK=1 mdbook build @@ -73,7 +78,7 @@ - name: Save cached Linkcheck id: cache-linkcheck-save if: ${{ !cancelled() && github.event_name == 'schedule' }} - uses: actions/cache/save@v4 + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: book/linkcheck/cache.json key: linkcheck--${{ env.MDBOOK_LINKCHECK2_VERSION }}--${{ github.run_id }} @@ -81,16 +86,16 @@ - name: Deploy to gh-pages if: github.event_name == 'push' run: | - touch "${{ env.DEPLOY_DIR }}/.nojekyll" - cp CNAME "${{ env.DEPLOY_DIR }}" - cd "${{ env.DEPLOY_DIR }}" + touch "${DEPLOY_DIR}/.nojekyll" + cp CNAME "${DEPLOY_DIR}" + cd "${DEPLOY_DIR}" rm -rf .git git init git config user.name "Deploy from CI" git config user.email "" git add . git commit -m "Deploy ${GITHUB_SHA} to gh-pages" - git push --quiet -f "https://x-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}" HEAD:gh-pages + git push --quiet -f "https://x-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}" HEAD:gh-pages - name: Check if files comply with semantic line breaks continue-on-error: true @@ -104,11 +109,11 @@ if: failure() && github.event_name == 'schedule' runs-on: ubuntu-latest permissions: - actions: read - contents: read - issues: write + issues: write # Required to open issues with `gh issue create` steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Open an issue or comment on an existing one run: ci/report-scheduled-linkcheck-failure.sh env: @@ -120,10 +125,11 @@ if: success() && github.event_name == 'schedule' runs-on: ubuntu-latest permissions: - contents: read - issues: write + issues: write # Required to close issues with `gh issue close` steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Close issue run: ci/close-scheduled-linkcheck-issues.sh env:
diff --git a/.github/workflows/date-check.yml b/.github/workflows/date-check.yml index fb7ff3b..868891c 100644 --- a/.github/workflows/date-check.yml +++ b/.github/workflows/date-check.yml
@@ -8,14 +8,19 @@ # Allow manually starting the workflow workflow_dispatch: +permissions: {} + jobs: date-check: if: github.repository == 'rust-lang/rustc-dev-guide' runs-on: ubuntu-latest - + permissions: + issues: write # Required by `actions/github-script` to open issues steps: - name: Checkout repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Ensure Rust is up-to-date run: | @@ -25,7 +30,7 @@ run: cargo run --manifest-path ci/date-check/Cargo.toml . > date-check-output.txt - name: Open issue - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const fs = require('fs');
diff --git a/.github/workflows/rustc-pull.yml b/.github/workflows/rustc-pull.yml index 0a2cfd1..fa967b3 100644 --- a/.github/workflows/rustc-pull.yml +++ b/.github/workflows/rustc-pull.yml
@@ -6,9 +6,15 @@ # Run at 04:00 UTC every Monday - cron: '0 4 * * 1' +permissions: {} + jobs: pull: if: github.repository == 'rust-lang/rustc-dev-guide' + permissions: + contents: write # Required by `josh-sync/rustc-pull` to push to a branch + pull-requests: write # Required by `josh-sync/rustc-pull` to open a PR + # zizmor: ignore[unpinned-uses] We explicitly want to track the main branch. uses: rust-lang/josh-sync/.github/workflows/rustc-pull.yml@main with: github-app-id: ${{ vars.APP_CLIENT_ID }}