From 9b6790b80aa07b891d2bbba237fc91dcecc5be81 Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 4 Oct 2026 23:57:46 +0300 Subject: [PATCH 1/3] ci: run the shared put.io security scan --- .github/workflows/scan.yml | 19 +++++++++++++++++++ AGENTS.md | 4 ++++ 2 files changed, 23 insertions(+) create mode 100644 .github/workflows/scan.yml diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml new file mode 100644 index 00000000..486e0b22 --- /dev/null +++ b/.github/workflows/scan.yml @@ -0,0 +1,19 @@ +name: Scan + +on: + pull_request: + schedule: + - cron: "41 6 * * 1" + workflow_dispatch: + +permissions: {} + +concurrency: + group: scan-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + scan: + permissions: + contents: read + uses: putdotio/.github/.github/workflows/frontend-scan.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0 diff --git a/AGENTS.md b/AGENTS.md index ea6b2a5f..0cbb14df 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -160,6 +160,10 @@ and `StaleOAuthCallbackTest` on a Gradle Managed Device weekly and on dispatch. It is not a pull-request gate because shared-runner emulator boots are too slow and flaky; `scripts/prove.sh` stays the local proof. +[Scan](.github/workflows/scan.yml) runs the shared put.io scan weekly and on +every pull request: Gitleaks and TruffleHog look for secrets, and Actionlint +and Zizmor audit `.github/` when a pull request changes it. + To reproduce a CI failure, check out the app SHA from the run summary in a detached worktree with `sdk.dir` set and `putioSdkKotlinPath` unset, then run the same command. A pull-request run tests a temporary merge commit; if it is From ff308fd8393a2c2121ea19aa1bcd43cae70da7eb Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 4 Oct 2026 23:57:46 +0300 Subject: [PATCH 2/3] ci: give Dependabot Gradle updates the one-day cooldown zizmor checks Dependabot cooldowns against the one-day policy the other put.io frontend repositories set in .github/zizmor.yml. --- .github/dependabot.yml | 2 ++ .github/zizmor.yml | 8 ++++++++ 2 files changed, 10 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 91e92d65..d576a048 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,8 @@ updates: directory: / schedule: interval: monthly + cooldown: + default-days: 1 groups: gradle-patch-minor: update-types: ["patch", "minor"] diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..54af4065 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,8 @@ +rules: + dependabot-cooldown: + config: + days: 1 + unpinned-uses: + config: + policies: + "*": hash-pin From 06c987f94cea378f8a62bd698697541fe3ad0761 Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 4 Oct 2026 23:57:46 +0300 Subject: [PATCH 3/3] ci: label pinned setup-java and setup-gradle with their exact tags The SHAs are v5.6.0 and v6.2.0; the major-only comments pointed at newer commits, which zizmor reports as ref-version-mismatch. --- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/emulator-smoke.yml | 4 ++-- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bc638ba5..612d3a40 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -63,13 +63,13 @@ jobs: persist-credentials: false - name: Set up Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: temurin java-version: '21' - name: Set up Gradle - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: validate-wrappers: true @@ -94,13 +94,13 @@ jobs: persist-credentials: false - name: Set up Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: temurin java-version: '21' - name: Set up Gradle - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: validate-wrappers: true @@ -132,13 +132,13 @@ jobs: printf '%s\n' "$app_parents" | tee -a "$GITHUB_STEP_SUMMARY" - name: Set up Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: temurin java-version: '21' - name: Set up Gradle - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: validate-wrappers: true diff --git a/.github/workflows/emulator-smoke.yml b/.github/workflows/emulator-smoke.yml index 05d61236..cbf868a8 100644 --- a/.github/workflows/emulator-smoke.yml +++ b/.github/workflows/emulator-smoke.yml @@ -59,13 +59,13 @@ jobs: printf '%s\n' "$app_parents" | tee -a "$GITHUB_STEP_SUMMARY" - name: Set up Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: temurin java-version: '21' - name: Set up Gradle - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6 + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 with: validate-wrappers: true