Merge pull request #237 from crazy-max/zizmor

crazy-max · web-flow · commit bf14efb328f4 · 2026-03-31T09:24:12.000+02:00
ci: zizmor workflow
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -4,18 +4,21 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-    ignore:
-      # ignore this dependency
-      # it seems a bug with dependabot as pining to commit sha should not
-      # trigger a new version similar to https://github.com/docker/buildx/pull/2222#issuecomment-1919092153
-      - dependency-name: "docker/actions-toolkit"
+    cooldown:
+      default-days: 2
+    groups:
+      crazy-max-dot-github:
+        patterns:
+          - "crazy-max/.github/*"
     labels:
       - "dependencies"
       - "bot"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 2
     allow:
       - dependency-type: "production"
     labels:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,5 +1,8 @@
 name: ci
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -38,7 +41,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -58,7 +61,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -79,7 +82,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -106,7 +109,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -123,7 +126,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -143,7 +146,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Uninstall containerd
         if: matrix.containerd == 'containerd-tarball'
@@ -160,13 +163,13 @@ jobs:
           docker run -d -p 5000:5000 --restart=always --name registry registry:2
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
         with:
           driver: docker
           driver-opts: network=host
       -
         name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           context: ./test
           push: true
@@ -187,7 +190,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -199,13 +202,13 @@ jobs:
           docker run -d -p 5000:5000 --restart=always --name registry registry:2
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
         with:
           driver: docker
           driver-opts: network=host
       -
         name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           context: ./test
           push: true
@@ -221,7 +224,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -242,7 +245,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -259,7 +262,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -284,7 +287,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         id: setup_docker
@@ -313,7 +316,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
@@ -335,7 +338,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Set up Docker
         uses: ./
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -1,45 +1,46 @@
 name: codeql
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
       - 'master'
       - 'releases/v*'
   pull_request:
 
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
 env:
   NODE_VERSION: "24"
 
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Enable corepack
         run: |
           corepack enable
           yarn --version
       -
         name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           languages: javascript-typescript
           build-mode: none
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           category: "/language:javascript-typescript"
diff --git a/.github/workflows/pr-assign-author.yml b/.github/workflows/pr-assign-author.yml
@@ -4,14 +4,14 @@ permissions:
   contents: read
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
     types:
       - opened
       - reopened
 
 jobs:
   run:
-    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@20ef82212dc54bab5749f5e05576ca6d3c8a5773 # v1.1.0
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@bb328ea508cd6a89d0865555ddbeb148e5724aed # v1.3.0
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -1,5 +1,12 @@
 name: publish
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   release:
     types:
@@ -15,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -1,5 +1,8 @@
 name: test
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -17,16 +20,16 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Test
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
+          source: .
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
         with:
-          source: .
           files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/update-dist.yml b/.github/workflows/update-dist.yml
@@ -1,5 +1,12 @@
 name: update-dist
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     types:
@@ -8,27 +15,27 @@ on:
 
 jobs:
   update-dist:
-    if: github.actor == 'dependabot[bot]'
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
     runs-on: ubuntu-latest
     steps:
       -
         name: GitHub auth token from GitHub App
         id: docker-read-app
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
           app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
           private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
           owner: docker
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
-          token: ${{ steps.docker-read-app.outputs.token || github.token }}
+          token: ${{ steps.docker-read-app.outputs.token }}
       -
         name: Build
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           source: .
           targets: build
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -1,5 +1,8 @@
 name: validate
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -19,11 +22,11 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/matrix@v7
+        uses: docker/bake-action/subaction/matrix@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           target: validate
 
@@ -38,6 +41,6 @@ jobs:
     steps:
       -
         name: Validate
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
         with:
           targets: ${{ matrix.target }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
diff --git a/.github/zizmor.yml b/.github/zizmor.yml

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,8 @@`
`1`	`1`	`name: ci`
`2`	`2`
	`3`	`+permissions:`
	`4`	`+ contents: read`
	`5`	`+`
`3`	`6`	`concurrency:`
`4`	`7`	`group: ${{ github.workflow }}-${{ github.ref }}`
`5`	`8`	`cancel-in-progress: true`
`@@ -38,7 +41,7 @@ jobs:`
`38`	`41`	`steps:`
`39`	`42`	`-`
`40`	`43`	`name: Checkout`
`41`		`- uses: actions/checkout@v6`
	`44`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`42`	`45`	`-`
`43`	`46`	`name: Set up Docker`
`44`	`47`	`uses: ./`
`@@ -58,7 +61,7 @@ jobs:`
`58`	`61`	`steps:`
`59`	`62`	`-`
`60`	`63`	`name: Checkout`
`61`		`- uses: actions/checkout@v6`
	`64`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`62`	`65`	`-`
`63`	`66`	`name: Set up Docker`
`64`	`67`	`uses: ./`
`@@ -79,7 +82,7 @@ jobs:`
`79`	`82`	`steps:`
`80`	`83`	`-`
`81`	`84`	`name: Checkout`
`82`		`- uses: actions/checkout@v6`
	`85`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`83`	`86`	`-`
`84`	`87`	`name: Set up Docker`
`85`	`88`	`uses: ./`
`@@ -106,7 +109,7 @@ jobs:`
`106`	`109`	`steps:`
`107`	`110`	`-`
`108`	`111`	`name: Checkout`
`109`		`- uses: actions/checkout@v6`
	`112`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`110`	`113`	`-`
`111`	`114`	`name: Set up Docker`
`112`	`115`	`uses: ./`
`@@ -123,7 +126,7 @@ jobs:`
`123`	`126`	`steps:`
`124`	`127`	`-`
`125`	`128`	`name: Checkout`
`126`		`- uses: actions/checkout@v6`
	`129`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`127`	`130`	`-`
`128`	`131`	`name: Set up Docker`
`129`	`132`	`uses: ./`
`@@ -143,7 +146,7 @@ jobs:`
`143`	`146`	`steps:`
`144`	`147`	`-`
`145`	`148`	`name: Checkout`
`146`		`- uses: actions/checkout@v6`
	`149`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`147`	`150`	`-`
`148`	`151`	`name: Uninstall containerd`
`149`	`152`	`if: matrix.containerd == 'containerd-tarball'`
`@@ -160,13 +163,13 @@ jobs:`
`160`	`163`	`docker run -d -p 5000:5000 --restart=always --name registry registry:2`
`161`	`164`	`-`
`162`	`165`	`name: Set up Docker Buildx`
`163`		`- uses: docker/setup-buildx-action@v4`
	`166`	`+ uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0`
`164`	`167`	`with:`
`165`	`168`	`driver: docker`
`166`	`169`	`driver-opts: network=host`
`167`	`170`	`-`
`168`	`171`	`name: Build and push`
`169`		`- uses: docker/build-push-action@v7`
	`172`	`+ uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0`
`170`	`173`	`with:`
`171`	`174`	`context: ./test`
`172`	`175`	`push: true`
`@@ -187,7 +190,7 @@ jobs:`
`187`	`190`	`steps:`
`188`	`191`	`-`
`189`	`192`	`name: Checkout`
`190`		`- uses: actions/checkout@v6`
	`193`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`191`	`194`	`-`
`192`	`195`	`name: Set up Docker`
`193`	`196`	`uses: ./`
`@@ -199,13 +202,13 @@ jobs:`
`199`	`202`	`docker run -d -p 5000:5000 --restart=always --name registry registry:2`
`200`	`203`	`-`
`201`	`204`	`name: Set up Docker Buildx`
`202`		`- uses: docker/setup-buildx-action@v4`
	`205`	`+ uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0`
`203`	`206`	`with:`
`204`	`207`	`driver: docker`
`205`	`208`	`driver-opts: network=host`
`206`	`209`	`-`
`207`	`210`	`name: Build and push`
`208`		`- uses: docker/build-push-action@v7`
	`211`	`+ uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0`
`209`	`212`	`with:`
`210`	`213`	`context: ./test`
`211`	`214`	`push: true`
`@@ -221,7 +224,7 @@ jobs:`
`221`	`224`	`steps:`
`222`	`225`	`-`
`223`	`226`	`name: Checkout`
`224`		`- uses: actions/checkout@v6`
	`227`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`225`	`228`	`-`
`226`	`229`	`name: Set up Docker`
`227`	`230`	`uses: ./`
`@@ -242,7 +245,7 @@ jobs:`
`242`	`245`	`steps:`
`243`	`246`	`-`
`244`	`247`	`name: Checkout`
`245`		`- uses: actions/checkout@v6`
	`248`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`246`	`249`	`-`
`247`	`250`	`name: Set up Docker`
`248`	`251`	`uses: ./`
`@@ -259,7 +262,7 @@ jobs:`
`259`	`262`	`steps:`
`260`	`263`	`-`
`261`	`264`	`name: Checkout`
`262`		`- uses: actions/checkout@v6`
	`265`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`263`	`266`	`-`
`264`	`267`	`name: Set up Docker`
`265`	`268`	`uses: ./`
`@@ -284,7 +287,7 @@ jobs:`
`284`	`287`	`steps:`
`285`	`288`	`-`
`286`	`289`	`name: Checkout`
`287`		`- uses: actions/checkout@v6`
	`290`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`288`	`291`	`-`
`289`	`292`	`name: Set up Docker`
`290`	`293`	`id: setup_docker`
`@@ -313,7 +316,7 @@ jobs:`
`313`	`316`	`steps:`
`314`	`317`	`-`
`315`	`318`	`name: Checkout`
`316`		`- uses: actions/checkout@v6`
	`319`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`317`	`320`	`-`
`318`	`321`	`name: Set up Docker`
`319`	`322`	`uses: ./`
`@@ -335,7 +338,7 @@ jobs:`
`335`	`338`	`steps:`
`336`	`339`	`-`
`337`	`340`	`name: Checkout`
`338`		`- uses: actions/checkout@v6`
	`341`	`+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
`339`	`342`	`-`
`340`	`343`	`name: Set up Docker`
`341`	`344`	`uses: ./`