Skip to content

Commit f882432

Browse files
YuriiMotovYuriiMotov
authored
🔒️ Add zizmor and fix audit findings (#373)
1 parent 1e90d0f commit f882432

15 files changed

Lines changed: 145 additions & 16 deletions

‎.github/dependabot.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,25 @@ updates:
55
directory: "/"
66
schedule:
77
interval: "daily"
8+
cooldown:
9+
default-days: 7
810
commit-message:
911
prefix: ⬆
1012
# Python
1113
- package-ecosystem: "uv"
1214
directory: "/"
1315
schedule:
1416
interval: "daily"
17+
cooldown:
18+
default-days: 7
19+
commit-message:
20+
prefix: ⬆
21+
# pre-commit
22+
- package-ecosystem: "pre-commit"
23+
directory: "/"
24+
schedule:
25+
interval: "daily"
26+
cooldown:
27+
default-days: 7
1528
commit-message:
1629
prefix: ⬆

‎.github/workflows/add-to-project.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,21 @@
11
name: Add to Project
22

33
on:
4-
pull_request_target:
4+
pull_request_target: # zizmor: ignore[dangerous-triggers]
55
issues:
66
types:
77
- opened
88
- reopened
99

10+
permissions: {}
11+
1012
jobs:
1113
add-to-project:
1214
name: Add to project
1315
runs-on: ubuntu-latest
16+
timeout-minutes: 5
1417
steps:
1518
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
1619
with:
1720
project-url: https://github.com/orgs/fastapi/projects/2
18-
github-token: ${{ secrets.PROJECTS_TOKEN }}
21+
github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]

‎.github/workflows/detect-conflicts.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,18 @@
11
name: "Conflict detector"
22
on:
33
push:
4-
pull_request_target:
4+
pull_request_target: # zizmor: ignore[dangerous-triggers]
55
types: [synchronize]
66

7+
permissions: {}
8+
79
jobs:
810
main:
911
permissions:
1012
contents: read
1113
pull-requests: write
1214
runs-on: ubuntu-latest
15+
timeout-minutes: 5
1316
steps:
1417
- name: Check if PRs have merge conflicts
1518
uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3

‎.github/workflows/issue-manager.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,22 @@ on:
99
issues:
1010
types:
1111
- labeled
12-
pull_request_target:
12+
pull_request_target: # zizmor: ignore[dangerous-triggers]
1313
types:
1414
- labeled
1515
workflow_dispatch:
1616

17-
permissions:
18-
issues: write
19-
pull-requests: write
17+
permissions: {}
18+
2019

2120
jobs:
2221
issue-manager:
2322
if: github.repository_owner == 'fastapi'
2423
runs-on: ubuntu-latest
24+
permissions:
25+
issues: write
26+
pull-requests: write
27+
timeout-minutes: 5
2528
steps:
2629
- name: Dump GitHub context
2730
env:

‎.github/workflows/labeler.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Labels
22
on:
3-
pull_request_target:
3+
pull_request_target: # zizmor: ignore[dangerous-triggers]
44
types:
55
- opened
66
- synchronize
@@ -9,12 +9,15 @@ on:
99
- labeled
1010
- unlabeled
1111

12+
permissions: {}
13+
1214
jobs:
1315
labeler:
1416
permissions:
1517
contents: read
1618
pull-requests: write
1719
runs-on: ubuntu-latest
20+
timeout-minutes: 5
1821
steps:
1922
- uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
2023
if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
@@ -26,6 +29,7 @@ jobs:
2629
permissions:
2730
pull-requests: read
2831
runs-on: ubuntu-latest
32+
timeout-minutes: 5
2933
steps:
3034
- uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
3135
with:

‎.github/workflows/latest-changes.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Latest Changes
22

33
on:
4-
pull_request_target:
4+
pull_request_target: # zizmor: ignore[dangerous-triggers]
55
branches:
66
- main
77
types:
@@ -16,9 +16,13 @@ on:
1616
required: false
1717
default: 'false'
1818

19+
permissions: {}
20+
1921
jobs:
2022
latest-changes:
2123
runs-on: ubuntu-latest
24+
if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
25+
timeout-minutes: 5
2226
steps:
2327
- name: Dump GitHub context
2428
env:
@@ -27,7 +31,8 @@ jobs:
2731
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2832
with:
2933
# To allow latest-changes to commit to the main branch
30-
token: ${{ secrets.LATEST_CHANGES }}
34+
token: ${{ secrets.LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
35+
persist-credentials: true # required by tiangolo/latest-changes
3136
# Allow debugging with tmate
3237
- name: Setup tmate session
3338
uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3.23

‎.github/workflows/pre-commit.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,16 @@ on:
66
- opened
77
- synchronize
88

9+
permissions: {}
10+
911
env:
1012
# Forks and Dependabot don't have access to secrets
1113
HAS_SECRETS: ${{ secrets.PRE_COMMIT != '' }}
1214

1315
jobs:
1416
pre-commit:
1517
runs-on: ubuntu-latest
18+
timeout-minutes: 5
1619
steps:
1720
- name: Dump GitHub context
1821
env:
@@ -28,7 +31,8 @@ jobs:
2831
# And it needs the full history to be able to compute diffs
2932
fetch-depth: 0
3033
# A token other than the default GITHUB_TOKEN is needed to be able to trigger CI
31-
token: ${{ secrets.PRE_COMMIT }}
34+
token: ${{ secrets.PRE_COMMIT }} # zizmor: ignore[secrets-outside-env]
35+
persist-credentials: true # Required for `git push` command
3236
# pre-commit lite ci needs the default checkout configs to work
3337
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3438
name: Checkout PR for fork
@@ -37,21 +41,25 @@ jobs:
3741
# To be able to commit it needs the head branch of the PR, the remote one
3842
ref: ${{ github.event.pull_request.head.sha }}
3943
fetch-depth: 0
44+
persist-credentials: false
4045
- name: Set up Python
4146
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
4247
with:
4348
python-version-file: ".python-version"
4449
- name: Setup uv
4550
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
4651
with:
52+
# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
53+
# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
54+
version: "0.11.4"
4755
cache-dependency-glob: |
4856
pyproject.toml
4957
uv.lock
5058
- name: Install Dependencies
5159
run: uv sync --locked --extra standard
5260
- name: Run prek - pre-commit
5361
id: precommit
54-
run: uvx prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
62+
run: uv run prek run --from-ref origin/${GITHUB_BASE_REF} --to-ref HEAD --show-diff-on-failure
5563
continue-on-error: true
5664
- name: Commit and push changes
5765
if: env.HAS_SECRETS == 'true'
@@ -79,6 +87,7 @@ jobs:
7987
needs:
8088
- pre-commit
8189
runs-on: ubuntu-latest
90+
timeout-minutes: 5
8291
steps:
8392
- name: Dump GitHub context
8493
env:

‎.github/workflows/publish.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,33 @@ on:
55
types:
66
- created
77

8+
permissions: {}
9+
810
jobs:
911
publish:
1012
runs-on: ubuntu-latest
1113
permissions:
1214
id-token: write
1315
contents: read
16+
timeout-minutes: 5
1417
steps:
1518
- name: Dump GitHub context
1619
env:
1720
GITHUB_CONTEXT: ${{ toJson(github) }}
1821
run: echo "$GITHUB_CONTEXT"
1922
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
persist-credentials: false
2025
- name: Set up Python
2126
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2227
with:
2328
python-version-file: ".python-version"
2429
- name: Install uv
2530
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
31+
with:
32+
# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
33+
# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
34+
version: "0.11.4"
2635
- name: Build distribution
2736
run: uv build
2837
- name: Publish

‎.github/workflows/smokeshow.yml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,35 @@
11
name: Smokeshow
22

33
on:
4-
workflow_run:
4+
workflow_run: # zizmor: ignore[dangerous-triggers]
55
workflows: [Test]
66
types: [completed]
77

8-
permissions:
9-
statuses: write
8+
permissions: {}
109

1110
jobs:
1211
smokeshow:
1312
runs-on: ubuntu-latest
13+
permissions:
14+
statuses: write
15+
timeout-minutes: 5
1416
steps:
1517
- name: Dump GitHub context
1618
env:
1719
GITHUB_CONTEXT: ${{ toJson(github) }}
1820
run: echo "$GITHUB_CONTEXT"
1921
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
2024
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2125
with:
2226
python-version-file: ".python-version"
2327
- name: Setup uv
2428
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
2529
with:
30+
# Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
31+
# See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
32+
version: "0.11.4"
2633
cache-dependency-glob: |
2734
pyproject.toml
2835
uv.lock
@@ -40,4 +47,4 @@ jobs:
4047
SMOKESHOW_GITHUB_CONTEXT: coverage
4148
SMOKESHOW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4249
SMOKESHOW_GITHUB_PR_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
43-
SMOKESHOW_AUTH_KEY: ${{ secrets.SMOKESHOW_AUTH_KEY }}
50+
SMOKESHOW_AUTH_KEY: ${{ secrets.SMOKESHOW_AUTH_KEY }} # zizmor: ignore[secrets-outside-env]

‎.github/workflows/test-redistribute.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,20 @@ on:
99
- opened
1010
- synchronize
1111

12+
permissions: {}
13+
1214
jobs:
1315
test-redistribute:
1416
runs-on: ubuntu-latest
17+
timeout-minutes: 5
1518
steps:
1619
- name: Dump GitHub context
1720
env:
1821
GITHUB_CONTEXT: ${{ toJson(github) }}
1922
run: echo "$GITHUB_CONTEXT"
2023
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24+
with:
25+
persist-credentials: false
2126
- name: Set up Python
2227
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2328
with:

0 commit comments

Comments
 (0)