From 2ee20a3ac445a33e51bc160c073734de1fc4358f Mon Sep 17 00:00:00 2001 From: black-sliver <59490463+black-sliver@users.noreply.github.com> Date: Mon, 30 Mar 2026 19:46:43 +0000 Subject: [PATCH] CI: set permissions, update and pin actions, CodeQL for actions (#6073) * CI: reduce default permissions to minimum * CI: update pin actions Most of them. CodeQL and action-gh-release is untouched for now. Immutable actions and actions/* are pinned to version, other actions are pinned to hash. * CI: make use of archive: false in upload-artifact also set compression level and error behavior for scan-build upload. * CI: update codeql and enable scanning actions --- .github/workflows/analyze-modified-files.yml | 6 ++-- .github/workflows/build.yml | 31 ++++++++++---------- .github/workflows/codeql-analysis.yml | 24 ++++++++++----- .github/workflows/ctest.yml | 4 ++- .github/workflows/docker.yml | 16 +++++----- .github/workflows/label-pull-requests.yml | 2 +- .github/workflows/release.yml | 12 ++++---- .github/workflows/scan-build.yml | 10 +++++-- .github/workflows/strict-type-check.yml | 6 ++-- .github/workflows/unittests.yml | 10 ++++--- 10 files changed, 71 insertions(+), 50 deletions(-) diff --git a/.github/workflows/analyze-modified-files.yml b/.github/workflows/analyze-modified-files.yml index 862a050c51..79c4f983a4 100644 --- a/.github/workflows/analyze-modified-files.yml +++ b/.github/workflows/analyze-modified-files.yml @@ -14,6 +14,8 @@ env: BEFORE: ${{ github.event.before }} AFTER: ${{ github.event.after }} +permissions: {} + jobs: flake8-or-mypy: strategy: @@ -25,7 +27,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - name: "Determine modified files (pull_request)" if: github.event_name == 'pull_request' @@ -50,7 +52,7 @@ jobs: run: | echo "diff=." >> $GITHUB_ENV - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v6.2.0 if: env.diff != '' with: python-version: '3.11' diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 772a6c0be3..8ed0c3523c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -41,9 +41,9 @@ jobs: runs-on: windows-latest steps: # - copy code below to release.yml - - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - name: Install python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6.2.0 with: python-version: '~3.12.7' check-latest: true @@ -82,7 +82,7 @@ jobs: # - copy code above to release.yml - - name: Attest Build if: ${{ github.event_name == 'workflow_dispatch' }} - uses: actions/attest-build-provenance@v2 + uses: actions/attest@v4.1.0 with: subject-path: | build/exe.*/ArchipelagoLauncher.exe @@ -110,18 +110,17 @@ jobs: cp Players/Templates/VVVVVV.yaml Players/ timeout 30 ./ArchipelagoGenerate - name: Store 7z - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7.0.0 with: - name: ${{ env.ZIP_NAME }} path: dist/${{ env.ZIP_NAME }} - compression-level: 0 # .7z is incompressible by zip + archive: false if-no-files-found: error retention-days: 7 # keep for 7 days, should be enough - name: Store Setup - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7.0.0 with: - name: ${{ env.SETUP_NAME }} path: setups/${{ env.SETUP_NAME }} + archive: false if-no-files-found: error retention-days: 7 # keep for 7 days, should be enough @@ -129,14 +128,14 @@ jobs: runs-on: ubuntu-22.04 steps: # - copy code below to release.yml - - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - name: Install base dependencies run: | sudo apt update sudo apt -y install build-essential p7zip xz-utils wget libglib2.0-0 sudo apt -y install python3-gi libgirepository1.0-dev # should pull dependencies for gi installation below - name: Get a recent python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6.2.0 with: python-version: '~3.12.7' check-latest: true @@ -173,7 +172,7 @@ jobs: # - copy code above to release.yml - - name: Attest Build if: ${{ github.event_name == 'workflow_dispatch' }} - uses: actions/attest-build-provenance@v2 + uses: actions/attest@v4.1.0 with: subject-path: | build/exe.*/ArchipelagoLauncher @@ -204,17 +203,17 @@ jobs: cp Players/Templates/VVVVVV.yaml Players/ timeout 30 ./ArchipelagoGenerate - name: Store AppImage - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7.0.0 with: - name: ${{ env.APPIMAGE_NAME }} path: dist/${{ env.APPIMAGE_NAME }} + archive: false + # TODO: decide if we want to also upload the zsync if-no-files-found: error retention-days: 7 - name: Store .tar.gz - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7.0.0 with: - name: ${{ env.TAR_NAME }} path: dist/${{ env.TAR_NAME }} - compression-level: 0 # .gz is incompressible by zip + archive: false if-no-files-found: error retention-days: 7 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 3abbb5f644..5751dce857 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -17,17 +17,26 @@ on: paths: - '**.py' - '**.js' - - '.github/workflows/codeql-analysis.yml' + - '.github/workflows/*.yml' + - '.github/workflows/*.yaml' + - '**/action.yml' + - '**/action.yaml' pull_request: # The branches below must be a subset of the branches above branches: [ main ] paths: - '**.py' - '**.js' - - '.github/workflows/codeql-analysis.yml' + - '.github/workflows/*.yml' + - '.github/workflows/*.yaml' + - '**/action.yml' + - '**/action.yaml' schedule: - cron: '44 8 * * 1' +permissions: + security-events: write + jobs: analyze: name: Analyze @@ -36,18 +45,17 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'javascript', 'python' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] + language: [ 'javascript', 'python', 'actions' ] # Learn more: # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6.0.2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4.35.1 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -58,7 +66,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@v4.35.1 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -72,4 +80,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4.35.1 diff --git a/.github/workflows/ctest.yml b/.github/workflows/ctest.yml index 610f6d7477..1a39afa11d 100644 --- a/.github/workflows/ctest.yml +++ b/.github/workflows/ctest.yml @@ -24,6 +24,8 @@ on: - '**/CMakeLists.txt' - '.github/workflows/ctest.yml' +permissions: {} + jobs: ctest: runs-on: ${{ matrix.os }} @@ -35,7 +37,7 @@ jobs: os: [ubuntu-latest, windows-latest] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 if: startsWith(matrix.os,'windows') - uses: Bacondish2023/setup-googletest@49065d1f7a6d21f6134864dd65980fe5dbe06c73 diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 0061dd15b0..231fb59dc5 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -19,6 +19,8 @@ on: env: REGISTRY: ghcr.io +permissions: {} + jobs: prepare: runs-on: ubuntu-latest @@ -29,7 +31,7 @@ jobs: package-name: ${{ steps.package.outputs.name }} steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6.0.2 - name: Set lowercase image name id: image @@ -43,7 +45,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6.0.0 with: images: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }} tags: | @@ -92,13 +94,13 @@ jobs: cache-scope: arm64 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6.0.2 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -115,7 +117,7 @@ jobs: echo "tags=$(IFS=','; echo "${suffixed[*]}")" >> $GITHUB_OUTPUT - name: Build and push Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7.0.0 with: context: . file: ./Dockerfile @@ -135,7 +137,7 @@ jobs: packages: write steps: - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} diff --git a/.github/workflows/label-pull-requests.yml b/.github/workflows/label-pull-requests.yml index 1675c942bd..341735e5dd 100644 --- a/.github/workflows/label-pull-requests.yml +++ b/.github/workflows/label-pull-requests.yml @@ -14,7 +14,7 @@ jobs: name: 'Apply content-based labels' runs-on: ubuntu-latest steps: - - uses: actions/labeler@v5 + - uses: actions/labeler@v6.0.1 with: sync-labels: false peer_review: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7f81e57507..21e1a24b88 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -48,9 +48,9 @@ jobs: shell: bash run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV # - code below copied from build.yml - - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - name: Install python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6.2.0 with: python-version: '~3.12.7' check-latest: true @@ -88,7 +88,7 @@ jobs: echo "SETUP_NAME=$SETUP_NAME" >> $Env:GITHUB_ENV # - code above copied from build.yml - - name: Attest Build - uses: actions/attest-build-provenance@v2 + uses: actions/attest@v4.1.0 with: subject-path: | build/exe.*/ArchipelagoLauncher.exe @@ -114,14 +114,14 @@ jobs: - name: Set env run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV # - code below copied from build.yml - - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - name: Install base dependencies run: | sudo apt update sudo apt -y install build-essential p7zip xz-utils wget libglib2.0-0 sudo apt -y install python3-gi libgirepository1.0-dev # should pull dependencies for gi installation below - name: Get a recent python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6.2.0 with: python-version: '~3.12.7' check-latest: true @@ -157,7 +157,7 @@ jobs: echo "TAR_NAME=$TAR_NAME" >> $GITHUB_ENV # - code above copied from build.yml - - name: Attest Build - uses: actions/attest-build-provenance@v2 + uses: actions/attest@v4.1.0 with: subject-path: | build/exe.*/ArchipelagoLauncher diff --git a/.github/workflows/scan-build.yml b/.github/workflows/scan-build.yml index ac84207062..64f51af4a2 100644 --- a/.github/workflows/scan-build.yml +++ b/.github/workflows/scan-build.yml @@ -28,12 +28,14 @@ on: - 'requirements.txt' - '.github/workflows/scan-build.yml' +permissions: {} + jobs: scan-build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 with: submodules: recursive - name: Install newer Clang @@ -45,7 +47,7 @@ jobs: run: | sudo apt install clang-tools-19 - name: Get a recent python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6.2.0 with: python-version: '3.11' - name: Install dependencies @@ -59,7 +61,9 @@ jobs: scan-build-19 --status-bugs -o scan-build-reports -disable-checker deadcode.DeadStores python setup.py build -y - name: Store report if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7.0.0 with: name: scan-build-reports path: scan-build-reports + compression-level: 9 # highly compressible + if-no-files-found: error diff --git a/.github/workflows/strict-type-check.yml b/.github/workflows/strict-type-check.yml index 2ccdad8d11..4a876bf98e 100644 --- a/.github/workflows/strict-type-check.yml +++ b/.github/workflows/strict-type-check.yml @@ -14,13 +14,15 @@ on: - ".github/workflows/strict-type-check.yml" - "**.pyi" +permissions: {} + jobs: pyright: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v6.2.0 with: python-version: "3.11" diff --git a/.github/workflows/unittests.yml b/.github/workflows/unittests.yml index b08b389005..cfffa6cc4a 100644 --- a/.github/workflows/unittests.yml +++ b/.github/workflows/unittests.yml @@ -29,6 +29,8 @@ on: - '!.github/workflows/**' - '.github/workflows/unittests.yml' +permissions: {} + jobs: unit: runs-on: ${{ matrix.os }} @@ -51,9 +53,9 @@ jobs: os: macos-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - name: Set up Python ${{ matrix.python.version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@v6.2.0 with: python-version: ${{ matrix.python.version }} - name: Install dependencies @@ -78,9 +80,9 @@ jobs: - {version: '3.13'} # current steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - name: Set up Python ${{ matrix.python.version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@v6.2.0 with: python-version: ${{ matrix.python.version }} - name: Install dependencies