roost.tools
Mirrored from GitHub
github.com/roostorg/osprey
[ci] add zizmor to CI (#350)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
author
Tao Bojlén
co-author
Claude Opus 4.8 (1M context)
committer
GitHub
date
(Jun 16, 2026, 9:53 AM +0100)
commit
a81e2337
a81e2337263e67581fc7a0ac5fee23f8c06eaca1
parent
219528ac
219528ac1511296aeb75fdb16a45d9075a2b85f5
+78
-10
+4
.github/dependabot.yml
+4
.github/dependabot.yml
···
4
4
directory: "/"
5
5
schedule:
6
6
interval: "weekly"
7
+
cooldown:
8
+
default-days: 7
7
9
labels:
8
10
- "dependencies"
9
11
- "dependabot"
···
14
16
directory: "/"
15
17
schedule:
16
18
interval: "weekly"
19
+
cooldown:
20
+
default-days: 7
17
21
labels:
18
22
- "dependencies"
19
23
- "dependabot"
+9
.github/workflows/code-quality.yml
+9
.github/workflows/code-quality.yml
···
11
11
group: ${{ github.workflow }}-${{ github.ref }}
12
12
cancel-in-progress: true
13
13
14
+
permissions:
15
+
contents: read
16
+
14
17
jobs:
15
18
python-quality:
16
19
runs-on: ubuntu-24.04
17
20
steps:
18
21
- name: Checkout code
19
22
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
23
+
with:
24
+
persist-credentials: false
20
25
21
26
- name: Set up Python
22
27
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
···
54
59
steps:
55
60
- name: Checkout code
56
61
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
62
+
with:
63
+
persist-credentials: false
57
64
58
65
- name: Set up Node.js
59
66
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
···
84
91
steps:
85
92
- name: Checkout code
86
93
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
94
+
with:
95
+
persist-credentials: false
87
96
88
97
- name: Set up Rust
89
98
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+5
.github/workflows/integration-tests.yml
+5
.github/workflows/integration-tests.yml
···
11
11
group: ${{ github.workflow }}-${{ github.ref }}
12
12
cancel-in-progress: true
13
13
14
+
permissions:
15
+
contents: read
16
+
14
17
jobs:
15
18
integration-tests:
16
19
runs-on: ubuntu-24.04
···
19
22
steps:
20
23
- name: Checkout code
21
24
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
25
+
with:
26
+
persist-credentials: false
22
27
23
28
- name: Set up Docker Buildx
24
29
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+7
-3
.github/workflows/mdbook.yml
+7
-3
.github/workflows/mdbook.yml
···
8
8
# Allows you to run this workflow manually from the Actions tab
9
9
workflow_dispatch:
10
10
11
-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
11
+
# Default to read-only; the deploy job grants itself the extra
12
+
# permissions it needs to publish to GitHub Pages.
12
13
permissions:
13
14
contents: read
14
-
pages: write
15
-
id-token: write
16
15
17
16
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
18
17
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
···
28
27
MDBOOK_VERSION: 0.5.2
29
28
steps:
30
29
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
30
+
with:
31
+
persist-credentials: false
31
32
- name: Install mdBook
32
33
run: |
33
34
curl --proto '=https' --tlsv1.2 https://sh.rustup.rs -sSf -y | sh
···
45
46
46
47
# Deployment job
47
48
deploy:
49
+
permissions:
50
+
pages: write
51
+
id-token: write
48
52
environment:
49
53
name: github-pages
50
54
url: ${{ steps.deployment.outputs.page_url }}
+7
-3
.github/workflows/publish-coordinator-image.yml
+7
-3
.github/workflows/publish-coordinator-image.yml
···
33
33
steps:
34
34
- name: Checkout repository
35
35
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
36
+
with:
37
+
persist-credentials: false
36
38
37
39
- name: Set up Docker Buildx
38
40
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
···
73
75
74
76
- name: Generate build summary
75
77
if: github.event_name != 'pull_request'
78
+
env:
79
+
TAGS: ${{ steps.meta.outputs.tags }}
76
80
run: |
77
81
echo "## Docker Image Published" >> $GITHUB_STEP_SUMMARY
78
82
echo "" >> $GITHUB_STEP_SUMMARY
79
-
echo "**Registry:** ${{ env.REGISTRY }}" >> $GITHUB_STEP_SUMMARY
83
+
echo "**Registry:** $REGISTRY" >> $GITHUB_STEP_SUMMARY
80
84
echo "" >> $GITHUB_STEP_SUMMARY
81
-
echo "**Image:** ${{ env.IMAGE_NAME }}" >> $GITHUB_STEP_SUMMARY
85
+
echo "**Image:** $IMAGE_NAME" >> $GITHUB_STEP_SUMMARY
82
86
echo "" >> $GITHUB_STEP_SUMMARY
83
87
echo "**Tags:**" >> $GITHUB_STEP_SUMMARY
84
88
echo '```' >> $GITHUB_STEP_SUMMARY
85
-
echo "${{ steps.meta.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
89
+
echo "$TAGS" >> $GITHUB_STEP_SUMMARY
86
90
echo '```' >> $GITHUB_STEP_SUMMARY
+9
-4
.github/workflows/release-osprey-rpc.yml
+9
-4
.github/workflows/release-osprey-rpc.yml
···
12
12
steps:
13
13
- name: Checkout code
14
14
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
15
+
with:
16
+
persist-credentials: false
15
17
16
18
- name: Set up Python
17
19
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
···
22
24
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
23
25
with:
24
26
version: "latest"
27
+
enable-cache: false
25
28
26
29
- name: Build osprey-rpc sdist
27
30
working-directory: osprey_rpc
···
38
41
ls -la
39
42
40
43
- name: Upload osprey-rpc to release
41
-
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
42
-
with:
43
-
files: |
44
-
osprey_rpc/dist/osprey_rpc-*.tar.gz
44
+
env:
45
+
GH_TOKEN: ${{ github.token }}
46
+
TAG: ${{ github.event.release.tag_name }}
47
+
run: |
48
+
gh release upload "$TAG" \
49
+
osprey_rpc/dist/osprey_rpc-*.tar.gz \
45
50
osprey_rpc/dist/osprey_rpc-*.zip
+37
.github/workflows/zizmor.yml
+37
.github/workflows/zizmor.yml
···
1
+
name: GitHub Actions security analysis
2
+
3
+
on:
4
+
push:
5
+
branches: ['main']
6
+
pull_request:
7
+
branches: ['**']
8
+
9
+
concurrency:
10
+
group: zizmor-${{ github.ref }}
11
+
cancel-in-progress: true
12
+
13
+
permissions: {}
14
+
15
+
jobs:
16
+
zizmor:
17
+
name: Run zizmor
18
+
runs-on: ubuntu-latest
19
+
permissions:
20
+
security-events: write # to upload SARIF results to code scanning
21
+
contents: read
22
+
actions: read
23
+
steps:
24
+
- name: Checkout repository
25
+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
26
+
with:
27
+
persist-credentials: false
28
+
29
+
- name: Run zizmor
30
+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
31
+
with:
32
+
version: "1.25.2"
33
+
# only upload to github advanced security on `main`.
34
+
# on PRs from forks (which do not have permission to push SARIF results)
35
+
# we surface findings as PR annotations instead.
36
+
advanced-security: ${{ github.event_name == 'push' }}
37
+
annotations: ${{ github.event_name == 'pull_request' }}