Skip to content

ci: fix zizmor audit findings #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dsanders11 merged 1 commit into from
Apr 2, 2026
Merged

ci: fix zizmor audit findings #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ on:
- .github/workflows/build.yml

permissions:
contents: write
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
Expand All @@ -24,6 +24,8 @@ jobs:
steps:
- name: Checkout Repository
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # 4.1.7
with:
persist-credentials: false
- name: Install Packages
run: |
sudo apt update
Expand Down Expand Up @@ -56,6 +58,8 @@ jobs:
steps:
- name: Checkout Repository
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # 4.1.7
with:
persist-credentials: false
- name: Install dependencies
run: python3 -m pip install --upgrade requests
- name: Download Bullseye Sysroot Artifacts
Expand Down
18 changes: 12 additions & 6 deletions .github/workflows/upstream-sysroot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,37 +27,43 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Fetch Current SHA
shell: bash
run: |
if [ -n "${{ github.event.inputs.current-sha }}" ]; then
CURRENT_SHA="${{ github.event.inputs.current-sha }}"
if [ -n "${GITHUB_EVENT_INPUTS_CURRENT_SHA}" ]; then
CURRENT_SHA="${GITHUB_EVENT_INPUTS_CURRENT_SHA}"
elif [ -f current-sha.json ]; then
CURRENT_SHA=$(jq -r '.sha' current-sha.json)
else
echo "No current SHA provided and current-sha.json not found."
exit 1
fi
echo "CURRENT_SHA=${CURRENT_SHA}" >> $GITHUB_ENV
env:
GITHUB_EVENT_INPUTS_CURRENT_SHA: ${{ github.event.inputs.current-sha }}
- name: Fetch latest upstream SHA
shell: bash
run: |
if [ -n "${{ github.event.inputs.upstream-sha }}" ]; then
UPSTREAM_SHA="${{ github.event.inputs.upstream-sha }}"
if [ -n "${GITHUB_EVENT_INPUTS_UPSTREAM_SHA}" ]; then
UPSTREAM_SHA="${GITHUB_EVENT_INPUTS_UPSTREAM_SHA}"
else
UPSTREAM_SHA=$(gh api -X GET repos/chromium/chromium/commits -f path="build/linux/sysroot_scripts" -f per_page=1 --jq '.[0].sha')
fi
echo "UPSTREAM_SHA=${UPSTREAM_SHA}" >> $GITHUB_ENV
env:
GITHUB_EVENT_INPUTS_UPSTREAM_SHA: ${{ github.event.inputs.upstream-sha }}
- name: Compare current SHA with upstream SHA
shell: bash
run: |
if [ "${{ env.CURRENT_SHA }}" == "${{ env.UPSTREAM_SHA }}" ]; then
if [ "${CURRENT_SHA}" == "${UPSTREAM_SHA}" ]; then
echo "No changes found - sysroot scripts are up to date!"
else
gh api -X GET repos/chromium/chromium/commits -f path="build/linux/sysroot_scripts" -f per_page=20 > commits.json

COMMITS=$(
jq -r --arg base_sha "${{ env.CURRENT_SHA }}" '
jq -r --arg base_sha "${CURRENT_SHA}" '
([.[].sha] | index($base_sha) // length) as $idx |
.[0:$idx] | .[] |
"- [`\(.sha[0:7])`](\(.html_url)) \(.commit.message | split("\n")[0])"
Expand Down
Loading