From 3cd2b2b2dd5db3481e0d097d48861725d173e191 Mon Sep 17 00:00:00 2001 From: Carlo Goetz Date: Thu, 12 Nov 2026 14:38:14 +0100 Subject: [PATCH 1/2] chore(gha): add zizmor, fix issues --- .github/workflows/cd.yaml | 10 +++++---- .github/workflows/ci.yaml | 8 +++++-- .github/workflows/dependency-checker.yaml | 13 +++++++----- .github/workflows/labeler.yaml | 5 +++-- .github/workflows/stale.yaml | 8 +++---- .github/workflows/zizmor.yaml | 26 +++++++++++++++++++++++ 6 files changed, 53 insertions(+), 17 deletions(-) create mode 100644 .github/workflows/zizmor.yaml diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 703a3f4aa..70f8ace74 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -5,18 +5,20 @@ on: branches: - main +permissions: {} + jobs: check-version: runs-on: ubuntu-latest - permissions: - pull-requests: write + permissions: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 + persist-credentials: true # Needed to push release tags. - name: install uv & python - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: version: "0.13.7" python-version: "3.11" diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 5d8019e74..65af8038a 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -2,6 +2,8 @@ name: CI Workflow on: [pull_request, workflow_dispatch] +permissions: {} + jobs: main: name: CI @@ -12,9 +14,11 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false - name: install uv and python - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: version: "0.13.7" python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/dependency-checker.yaml b/.github/workflows/dependency-checker.yaml index 9265e30c3..4b1889c82 100644 --- a/.github/workflows/dependency-checker.yaml +++ b/.github/workflows/dependency-checker.yaml @@ -5,24 +5,27 @@ on: - cron: "0 0 * * *" workflow_dispatch: +permissions: {} + jobs: dependency_updater: name: Dependency-Updater runs-on: ubuntu-latest - permissions: - pull-requests: write + permissions: contents: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: true # Needed to push dependency-update branches. - name: install uv and python - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: version: "0.13.7" python-version: "3.11" - name: UV Python dependency updater env: - GH_TOKEN: ${{ secrets.RENOVATE_TOKEN }} + GH_TOKEN: ${{ secrets.RENOVATE_TOKEN }} # Used for PR operations. run: | git config --global user.name "SDK Updater Bot" git config --global user.email "noreply@stackit.de" diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml index 5d5a2c2fa..e7fe89039 100644 --- a/.github/workflows/labeler.yaml +++ b/.github/workflows/labeler.yaml @@ -7,12 +7,13 @@ on: # run every full hour (to still label PRs from forks) - cron: '0 * * * *' +permissions: {} + jobs: labeler: permissions: contents: read pull-requests: write - issues: write # don't run on PRs from forks (token has no write permissions) if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} name: "Labeler" @@ -23,7 +24,7 @@ jobs: run: | curl -sSL -o remote-labeler.yml https://raw.githubusercontent.com/stackitcloud/stackit-sdk-go/main/.github/labeler.yml - name: Labeler action - uses: actions/labeler@v6 + uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0 with: configuration-path: "remote-labeler.yml" sync-labels: false diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 51c26da14..53b62aa35 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -13,18 +13,18 @@ env: DAYS_BEFORE_PR_CLOSE: 14 EXEMPT_PR_LABELS: "ignore-stale" -permissions: - issues: write - pull-requests: write +permissions: {} jobs: stale: name: "Stale" runs-on: ubuntu-latest + permissions: + pull-requests: write timeout-minutes: 10 steps: - name: "Mark old PRs as stale" - uses: actions/stale@v9 + uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-pr-message: "This PR was marked as stale after ${{ env.DAYS_BEFORE_PR_STALE }} days of inactivity and will be closed after another ${{ env.DAYS_BEFORE_PR_CLOSE }} days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it." diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml new file mode 100644 index 000000000..f98622a81 --- /dev/null +++ b/.github/workflows/zizmor.yaml @@ -0,0 +1,26 @@ +name: GitHub Actions Security Analysis + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +permissions: {} + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + permissions: + security-events: write # Required to upload SARIF to code scanning. + steps: + - name: Checkout + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1 + with: + version: v1.32.0 From e8c4180f2aaef383395029518daf3dbb5fee10ab Mon Sep 17 00:00:00 2001 From: Carlo Goetz Date: Thu, 12 Nov 2026 14:51:25 +0100 Subject: [PATCH 2/2] chore(gha): update all external actions to current version --- .github/workflows/cd.yaml | 4 ++-- .github/workflows/ci.yaml | 4 ++-- .github/workflows/dependency-checker.yaml | 4 ++-- .github/workflows/labeler.yaml | 2 +- .github/workflows/stale.yaml | 2 +- .github/workflows/zizmor.yaml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 70f8ace74..e1eeaa20a 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -13,12 +13,12 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: true # Needed to push release tags. - name: install uv & python - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "0.13.7" python-version: "3.11" diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 65af8038a..aa7f67a3e 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -14,11 +14,11 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: install uv and python - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "0.13.7" python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/dependency-checker.yaml b/.github/workflows/dependency-checker.yaml index 4b1889c82..7a0007e74 100644 --- a/.github/workflows/dependency-checker.yaml +++ b/.github/workflows/dependency-checker.yaml @@ -15,11 +15,11 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true # Needed to push dependency-update branches. - name: install uv and python - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "0.13.7" python-version: "3.11" diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml index e7fe89039..6acc9eb85 100644 --- a/.github/workflows/labeler.yaml +++ b/.github/workflows/labeler.yaml @@ -24,7 +24,7 @@ jobs: run: | curl -sSL -o remote-labeler.yml https://raw.githubusercontent.com/stackitcloud/stackit-sdk-go/main/.github/labeler.yml - name: Labeler action - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0 + uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 with: configuration-path: "remote-labeler.yml" sync-labels: false diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 53b62aa35..2b2c1f656 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -24,7 +24,7 @@ jobs: timeout-minutes: 10 steps: - name: "Mark old PRs as stale" - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 + uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-pr-message: "This PR was marked as stale after ${{ env.DAYS_BEFORE_PR_STALE }} days of inactivity and will be closed after another ${{ env.DAYS_BEFORE_PR_CLOSE }} days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it." diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index f98622a81..36fe6a620 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -16,7 +16,7 @@ jobs: security-events: write # Required to upload SARIF to code scanning. steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false