enki/blap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 6 Wiki Activity

Add zizmor CI & make it happy (#32717)

Browse Source 
* Add zizmor CI & make it happy

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

* Fix zizmor job

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

---------

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
This commit is contained in:
Michael Telatynski
2026-03-09 16:52:04 +00:00
committed by GitHub
parent 095b407dae
commit 2e0adc5832
25 changed files with 79 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/backport.yml
+3 -1
View File
@@ -1,6 +1,8 @@
name: Backport
on:
pull_request_target:
# Privilege escalation necessary to enable backporting PRs from forks
# 🚨 We must not execute any checked out code here.
pull_request_target: # zizmor: ignore[dangerous-triggers]
types:
- closed
- labeled
.github/workflows/build.yml
+2
View File
@@ -44,6 +44,8 @@ jobs:
shell: bash
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
.github/workflows/build_debian.yaml
+3 -1
View File
@@ -15,6 +15,8 @@ jobs:
VERSION: ${{ github.ref_name }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Download package
working-directory: apps/web
@@ -75,7 +77,7 @@ jobs:
- name: Publish to packages.element.io
if: github.event.release.prerelease == false
uses: element-hq/packages.element.io@master
uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
with:
file: apps/web/element-web.deb
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
.github/workflows/build_develop.yml
+5 -1
View File
@@ -29,6 +29,8 @@ jobs:
R2_PUBLIC_URL: "https://element-web-develop.element.io"
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -134,4 +136,6 @@ jobs:
gitHubToken: ${{ secrets.GITHUB_TOKEN }}
- run: |
echo "Deployed to ${{ steps.cfp.outputs.url }}" >> $GITHUB_STEP_SUMMARY
echo "Deployed to ${STEPS_CFP_OUTPUTS_URL}" >> $GITHUB_STEP_SUMMARY
env:
STEPS_CFP_OUTPUTS_URL: ${{ steps.cfp.outputs.url }}
.github/workflows/cd.yaml
+1
View File
@@ -26,6 +26,7 @@ jobs:
# reduce the size of the checkout with tree filtering,
# see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
filter: tree:0
persist-credentials: false
- name: Prepare nx
uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
.github/workflows/deploy.yml
+2
View File
@@ -35,6 +35,8 @@ jobs:
SITE: ${{ inputs.site || 'staging.element.io' }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Load GPG key
run: |
.github/workflows/docker.yaml
+1
View File
@@ -23,6 +23,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0 # needed for docker-package to be able to calculate the version
persist-credentials: false
- name: Install Cosign
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
.github/workflows/docs.yml
+3
View File
@@ -21,17 +21,20 @@ jobs:
with:
repository: element-hq/element-desktop
path: element-desktop
persist-credentials: false
- name: Fetch element-web
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
path: element-web
persist-credentials: false
- name: Fetch matrix-js-sdk
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
repository: matrix-org/matrix-js-sdk
path: matrix-js-sdk
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
with:
.github/workflows/end-to-end-tests-netlify.yaml
+3 -1
View File
@@ -2,7 +2,9 @@
# taking the artifact and uploading it to Netlify for easier viewing
name: Upload End to End Test report to Netlify
on:
workflow_run:
# Privilege escalation necessary to publish to Netlify
# 🚨 We must not execute any checked out code here.
workflow_run: # zizmor: ignore[dangerous-triggers]
workflows: ["End to End Tests"]
types:
- completed
.github/workflows/end-to-end-tests.yaml
+5 -2
View File
@@ -54,6 +54,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
repository: element-hq/element-web
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -174,9 +175,11 @@ jobs:
working-directory: apps/web
run: |
pnpm playwright test \
--shard "${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}" \
--shard "$SHARD" \
--project="${{ matrix.project }}" \
${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
env:
SHARD: ${{ format('{0}/{1}', matrix.runner, needs.build.outputs.num-runners) }}
- name: Upload blob report to GitHub Actions Artifacts
if: always()
@@ -190,7 +193,7 @@ jobs:
name: Downstream Playwright tests [element-modules]
needs: build
if: inputs.skip != true && github.event_name == 'merge_group'
uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main
uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main # zizmor: ignore[unpinned-uses]
with:
webapp-artifact: webapp
.github/workflows/localazy_download.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ permissions:
pull-requests: write # needed to auto-approve PRs
jobs:
download:
uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
with:
packageManager: pnpm
secrets:
.github/workflows/localazy_upload.yaml
+1 -1
View File
@@ -9,6 +9,6 @@ on:
permissions: {} # No permissions needed
jobs:
upload:
uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
secrets:
LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}
.github/workflows/netlify.yaml
+3 -1
View File
@@ -2,7 +2,9 @@
# and uploading it to netlify
name: Upload Preview Build to Netlify
on:
workflow_run:
# Privilege escalation necessary to publish to Netlify
# 🚨 We must not execute any checked out code here.
workflow_run: # zizmor: ignore[dangerous-triggers]
workflows: ["Build"]
types:
- completed
.github/workflows/pull_request.yaml
+4 -2
View File
@@ -1,13 +1,15 @@
name: Pull Request
on:
pull_request_target:
# Privilege escalation necessary access members of the review teams
# 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
pull_request_target: # zizmor: ignore[dangerous-triggers]
types: [opened, edited, labeled, unlabeled, synchronize]
merge_group:
types: [checks_requested]
permissions: {}
jobs:
action:
uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
permissions:
pull-requests: write
secrets:
.github/workflows/release-drafter.yml
+1 -1
View File
@@ -9,4 +9,4 @@ jobs:
draft:
permissions:
contents: write
uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]
.github/workflows/release-gitflow.yml
+1 -1
View File
@@ -7,7 +7,7 @@ concurrency: ${{ github.repository }}-${{ github.workflow }}
permissions: {} # We use ELEMENT_BOT_TOKEN instead
jobs:
merge:
uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
secrets:
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
with:
.github/workflows/release.yml
+1 -1
View File
@@ -14,7 +14,7 @@ concurrency: ${{ github.workflow }}
permissions: {}
jobs:
release:
uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
permissions:
contents: write
issues: write
.github/workflows/release_prepare.yml
+4 -1
View File
@@ -27,7 +27,7 @@ jobs:
- matrix-org/matrix-js-sdk
- element-hq/element-web
- element-hq/element-desktop
uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop
uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop # zizmor: ignore[unpinned-uses]
secrets:
ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
with:
@@ -50,6 +50,7 @@ jobs:
fetch-depth: 0
fetch-tags: true
token: ${{ secrets.ELEMENT_BOT_TOKEN }}
persist-credentials: true
- name: Checkout Element Web
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
if: inputs.element-web
@@ -60,6 +61,7 @@ jobs:
fetch-depth: 0
fetch-tags: true
token: ${{ secrets.ELEMENT_BOT_TOKEN }}
persist-credentials: true
- name: Checkout Matrix JS SDK
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
if: inputs.matrix-js-sdk
@@ -70,6 +72,7 @@ jobs:
fetch-depth: 0
fetch-tags: true
token: ${{ secrets.ELEMENT_BOT_TOKEN }}
persist-credentials: true
- name: Prepare Git
run: |
.github/workflows/shared-component-publish.yaml
+2
View File
@@ -14,6 +14,8 @@ jobs:
steps:
- name: 🧮 Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- name: 🔧 Set up node environment
.github/workflows/shared-component-storybook-build.yml
+2
View File
@@ -13,6 +13,8 @@ jobs:
steps:
- name: 🧮 Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- name: 🔧 Pnpm cache
.github/workflows/sonarqube.yml
+1 -1
View File
@@ -12,7 +12,7 @@ jobs:
sonarqube:
name: 🩻 SonarQube
if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop
uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop # zizmor: ignore[unpinned-uses]
permissions:
actions: read
statuses: write
.github/workflows/static_analysis.yaml
+16 -1
View File
@@ -49,6 +49,8 @@ jobs:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -73,6 +75,19 @@ jobs:
run: git diff --exit-code
if: matrix.assert-diff
zizmor:
name: Zizmor Github Actions lint
runs-on: ubuntu-24.04
permissions:
security-events: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Run zizmor
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
i18n:
strategy:
fail-fast: false
@@ -95,7 +110,7 @@ jobs:
- name: Shared Components
path: "packages/shared-components"
name: "i18n Check (${{ matrix.name }})"
uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@abf186831e2acb3e98fca13a0711a3fa1364d2b1
permissions:
pull-requests: read
with:
.github/workflows/sync-labels.yml
+1 -1
View File
@@ -13,7 +13,7 @@ permissions: {} # We use ELEMENT_BOT_TOKEN instead
jobs:
sync-labels:
uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
uses: element-hq/element-meta/.github/workflows/sync-labels.yml@dac99c67f08f8f2a079e885ffb682a2f39cd3960
with:
LABELS: |
element-hq/element-meta
.github/workflows/tests.yml
+11 -5
View File
@@ -43,6 +43,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- name: pnpm cache
@@ -70,21 +71,25 @@ jobs:
working-directory: apps/web
run: |
pnpm test \
--coverage=${{ env.ENABLE_COVERAGE }} \
--coverage=$ENABLE_COVERAGE \
--ci \
--max-workers ${{ steps.cpu-cores.outputs.count }} \
--shard ${{ matrix.runner }}/${{ strategy.job-total }} \
--max-workers $MAX_WORKERS \
--shard "$SHARD" \
--cacheDirectory /tmp/jest_cache
env:
JEST_SONAR_UNIQUE_OUTPUT_NAME: true
# tell jest to use coloured output
FORCE_COLOR: true
MAX_WORKERS: ${{ steps.cpu-cores.outputs.count }}
SHARD: ${{ format('{0}/{1}', matrix.runner, strategy.job-total) }}
- name: Move coverage files into place
if: env.ENABLE_COVERAGE == 'true'
working-directory: apps/web
run: mv coverage/lcov.info coverage/${{ steps.setupNode.outputs.node-version }}-${{ matrix.runner }}.lcov.info
run: mv coverage/lcov.info coverage/$NODE_VERSION-${{ matrix.runner }}.lcov.info
env:
NODE_VERSION: ${{ steps.setupNode.outputs.node-version }}
- name: Upload Artifact
if: env.ENABLE_COVERAGE == 'true'
@@ -125,6 +130,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- name: pnpm cache
@@ -164,7 +170,7 @@ jobs:
- name: Run tests
working-directory: "packages/shared-components"
run: pnpm test:unit --coverage=${{ env.ENABLE_COVERAGE }}
run: pnpm test:unit --coverage=$ENABLE_COVERAGE
- name: Upload Artifact
if: env.ENABLE_COVERAGE == 'true'
.github/workflows/update-jitsi.yml
+2
View File
@@ -10,6 +10,8 @@ jobs:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6