mirror/Archipelago
1
0
Fork 1
mirror of https://github.com/ArchipelagoMW/Archipelago.git synced 2026-05-27 15:09:54 -07:00
Code Issues Packages Projects Releases Wiki Activity

CI: set permissions, update and pin actions, CodeQL for actions (#6073)

Browse Source 
* CI: reduce default permissions to minimum

* CI: update pin actions

Most of them. CodeQL and action-gh-release is untouched for now.
Immutable actions and actions/* are pinned to version,
other actions are pinned to hash.

* CI: make use of archive: false in upload-artifact

also set compression level and error behavior for scan-build upload.

* CI: update codeql and enable scanning actions
This commit is contained in:
black-sliver
2026-03-30 19:46:43 +00:00
committed by GitHub
parent c640d2fa24
commit 2ee20a3ac4
10 changed files with 71 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/analyze-modified-files.yml
+4 -2
View File
@@ -14,6 +14,8 @@ env:
BEFORE: ${{ github.event.before }} BEFORE: ${{ github.event.before }}
AFTER: ${{ github.event.after }} AFTER: ${{ github.event.after }}
permissions: {}
jobs: jobs:
flake8-or-mypy: flake8-or-mypy:
strategy: strategy:
@@ -25,7 +27,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- name: "Determine modified files (pull_request)" - name: "Determine modified files (pull_request)"
if: github.event_name == 'pull_request' if: github.event_name == 'pull_request'
@@ -50,7 +52,7 @@ jobs:
run: | run: |
echo "diff=." >> $GITHUB_ENV echo "diff=." >> $GITHUB_ENV
- uses: actions/setup-python@v5 - uses: actions/setup-python@v6.2.0
if: env.diff != '' if: env.diff != ''
with: with:
python-version: '3.11' python-version: '3.11'
.github/workflows/build.yml
+15 -16
View File
@@ -41,9 +41,9 @@ jobs:
runs-on: windows-latest runs-on: windows-latest
steps: steps:
# - copy code below to release.yml - # - copy code below to release.yml -
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- name: Install python - name: Install python
uses: actions/setup-python@v5 uses: actions/setup-python@v6.2.0
with: with:
python-version: '~3.12.7' python-version: '~3.12.7'
check-latest: true check-latest: true
@@ -82,7 +82,7 @@ jobs:
# - copy code above to release.yml - # - copy code above to release.yml -
- name: Attest Build - name: Attest Build
if: ${{ github.event_name == 'workflow_dispatch' }} if: ${{ github.event_name == 'workflow_dispatch' }}
uses: actions/attest-build-provenance@v2 uses: actions/attest@v4.1.0
with: with:
subject-path: | subject-path: |
build/exe.*/ArchipelagoLauncher.exe build/exe.*/ArchipelagoLauncher.exe
@@ -110,18 +110,17 @@ jobs:
cp Players/Templates/VVVVVV.yaml Players/ cp Players/Templates/VVVVVV.yaml Players/
timeout 30 ./ArchipelagoGenerate timeout 30 ./ArchipelagoGenerate
- name: Store 7z - name: Store 7z
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7.0.0
with: with:
name: ${{ env.ZIP_NAME }}
path: dist/${{ env.ZIP_NAME }} path: dist/${{ env.ZIP_NAME }}
compression-level: 0 # .7z is incompressible by zip archive: false
if-no-files-found: error if-no-files-found: error
retention-days: 7 # keep for 7 days, should be enough retention-days: 7 # keep for 7 days, should be enough
- name: Store Setup - name: Store Setup
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7.0.0
with: with:
name: ${{ env.SETUP_NAME }}
path: setups/${{ env.SETUP_NAME }} path: setups/${{ env.SETUP_NAME }}
archive: false
if-no-files-found: error if-no-files-found: error
retention-days: 7 # keep for 7 days, should be enough retention-days: 7 # keep for 7 days, should be enough
@@ -129,14 +128,14 @@ jobs:
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
steps: steps:
# - copy code below to release.yml - # - copy code below to release.yml -
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- name: Install base dependencies - name: Install base dependencies
run: | run: |
sudo apt update sudo apt update
sudo apt -y install build-essential p7zip xz-utils wget libglib2.0-0 sudo apt -y install build-essential p7zip xz-utils wget libglib2.0-0
sudo apt -y install python3-gi libgirepository1.0-dev # should pull dependencies for gi installation below sudo apt -y install python3-gi libgirepository1.0-dev # should pull dependencies for gi installation below
- name: Get a recent python - name: Get a recent python
uses: actions/setup-python@v5 uses: actions/setup-python@v6.2.0
with: with:
python-version: '~3.12.7' python-version: '~3.12.7'
check-latest: true check-latest: true
@@ -173,7 +172,7 @@ jobs:
# - copy code above to release.yml - # - copy code above to release.yml -
- name: Attest Build - name: Attest Build
if: ${{ github.event_name == 'workflow_dispatch' }} if: ${{ github.event_name == 'workflow_dispatch' }}
uses: actions/attest-build-provenance@v2 uses: actions/attest@v4.1.0
with: with:
subject-path: | subject-path: |
build/exe.*/ArchipelagoLauncher build/exe.*/ArchipelagoLauncher
@@ -204,17 +203,17 @@ jobs:
cp Players/Templates/VVVVVV.yaml Players/ cp Players/Templates/VVVVVV.yaml Players/
timeout 30 ./ArchipelagoGenerate timeout 30 ./ArchipelagoGenerate
- name: Store AppImage - name: Store AppImage
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7.0.0
with: with:
name: ${{ env.APPIMAGE_NAME }}
path: dist/${{ env.APPIMAGE_NAME }} path: dist/${{ env.APPIMAGE_NAME }}
archive: false
# TODO: decide if we want to also upload the zsync
if-no-files-found: error if-no-files-found: error
retention-days: 7 retention-days: 7
- name: Store .tar.gz - name: Store .tar.gz
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7.0.0
with: with:
name: ${{ env.TAR_NAME }}
path: dist/${{ env.TAR_NAME }} path: dist/${{ env.TAR_NAME }}
compression-level: 0 # .gz is incompressible by zip archive: false
if-no-files-found: error if-no-files-found: error
retention-days: 7 retention-days: 7
.github/workflows/codeql-analysis.yml
+16 -8
View File
@@ -17,17 +17,26 @@ on:
paths: paths:
- '**.py' - '**.py'
- '**.js' - '**.js'
- '.github/workflows/codeql-analysis.yml' - '.github/workflows/*.yml'
- '.github/workflows/*.yaml'
- '**/action.yml'
- '**/action.yaml'
pull_request: pull_request:
# The branches below must be a subset of the branches above # The branches below must be a subset of the branches above
branches: [ main ] branches: [ main ]
paths: paths:
- '**.py' - '**.py'
- '**.js' - '**.js'
- '.github/workflows/codeql-analysis.yml' - '.github/workflows/*.yml'
- '.github/workflows/*.yaml'
- '**/action.yml'
- '**/action.yaml'
schedule: schedule:
- cron: '44 8 * * 1' - cron: '44 8 * * 1'
permissions:
security-events: write
jobs: jobs:
analyze: analyze:
name: Analyze name: Analyze
@@ -36,18 +45,17 @@ jobs:
strategy: strategy:
fail-fast: false fail-fast: false
matrix: matrix:
language: [ 'javascript', 'python' ] language: [ 'javascript', 'python', 'actions' ]
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
# Learn more: # Learn more:
# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
steps: steps:
- name: Checkout repository - name: Checkout repository
uses: actions/checkout@v4 uses: actions/checkout@v6.0.2
# Initializes the CodeQL tools for scanning. # Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL - name: Initialize CodeQL
uses: github/codeql-action/init@v3 uses: github/codeql-action/init@v4.35.1
with: with:
languages: ${{ matrix.language }} languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file. # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +66,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below) # If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild - name: Autobuild
uses: github/codeql-action/autobuild@v3 uses: github/codeql-action/autobuild@v4.35.1
# ℹ️ Command-line programs to run using the OS shell. # ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl # 📚 https://git.io/JvXDl
@@ -72,4 +80,4 @@ jobs:
# make release # make release
- name: Perform CodeQL Analysis - name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3 uses: github/codeql-action/analyze@v4.35.1
.github/workflows/ctest.yml
+3 -1
View File
@@ -24,6 +24,8 @@ on:
- '**/CMakeLists.txt' - '**/CMakeLists.txt'
- '.github/workflows/ctest.yml' - '.github/workflows/ctest.yml'
permissions: {}
jobs: jobs:
ctest: ctest:
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
@@ -35,7 +37,7 @@ jobs:
os: [ubuntu-latest, windows-latest] os: [ubuntu-latest, windows-latest]
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
if: startsWith(matrix.os,'windows') if: startsWith(matrix.os,'windows')
- uses: Bacondish2023/setup-googletest@49065d1f7a6d21f6134864dd65980fe5dbe06c73 - uses: Bacondish2023/setup-googletest@49065d1f7a6d21f6134864dd65980fe5dbe06c73
.github/workflows/docker.yml
+9 -7
View File
@@ -19,6 +19,8 @@ on:
env: env:
REGISTRY: ghcr.io REGISTRY: ghcr.io
permissions: {}
jobs: jobs:
prepare: prepare:
runs-on: ubuntu-latest runs-on: ubuntu-latest
@@ -29,7 +31,7 @@ jobs:
package-name: ${{ steps.package.outputs.name }} package-name: ${{ steps.package.outputs.name }}
steps: steps:
- name: Checkout repository - name: Checkout repository
uses: actions/checkout@v4 uses: actions/checkout@v6.0.2
- name: Set lowercase image name - name: Set lowercase image name
id: image id: image
@@ -43,7 +45,7 @@ jobs:
- name: Extract metadata - name: Extract metadata
id: meta id: meta
uses: docker/metadata-action@v5 uses: docker/metadata-action@v6.0.0
with: with:
images: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }} images: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}
tags: | tags: |
@@ -92,13 +94,13 @@ jobs:
cache-scope: arm64 cache-scope: arm64
steps: steps:
- name: Checkout repository - name: Checkout repository
uses: actions/checkout@v4 uses: actions/checkout@v6.0.2
- name: Set up Docker Buildx - name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Log in to GitHub Container Registry - name: Log in to GitHub Container Registry
uses: docker/login-action@v3 uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with: with:
registry: ${{ env.REGISTRY }} registry: ${{ env.REGISTRY }}
username: ${{ github.actor }} username: ${{ github.actor }}
@@ -115,7 +117,7 @@ jobs:
echo "tags=$(IFS=','; echo "${suffixed[*]}")" >> $GITHUB_OUTPUT echo "tags=$(IFS=','; echo "${suffixed[*]}")" >> $GITHUB_OUTPUT
- name: Build and push Docker image - name: Build and push Docker image
uses: docker/build-push-action@v5 uses: docker/build-push-action@v7.0.0
with: with:
context: . context: .
file: ./Dockerfile file: ./Dockerfile
@@ -135,7 +137,7 @@ jobs:
packages: write packages: write
steps: steps:
- name: Log in to GitHub Container Registry - name: Log in to GitHub Container Registry
uses: docker/login-action@v3 uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with: with:
registry: ${{ env.REGISTRY }} registry: ${{ env.REGISTRY }}
username: ${{ github.actor }} username: ${{ github.actor }}
.github/workflows/label-pull-requests.yml
+1 -1
View File
@@ -14,7 +14,7 @@ jobs:
name: 'Apply content-based labels' name: 'Apply content-based labels'
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/labeler@v5 - uses: actions/labeler@v6.0.1
with: with:
sync-labels: false sync-labels: false
peer_review: peer_review:
.github/workflows/release.yml
+6 -6
View File
@@ -48,9 +48,9 @@ jobs:
shell: bash shell: bash
run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
# - code below copied from build.yml - # - code below copied from build.yml -
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- name: Install python - name: Install python
uses: actions/setup-python@v5 uses: actions/setup-python@v6.2.0
with: with:
python-version: '~3.12.7' python-version: '~3.12.7'
check-latest: true check-latest: true
@@ -88,7 +88,7 @@ jobs:
echo "SETUP_NAME=$SETUP_NAME" >> $Env:GITHUB_ENV echo "SETUP_NAME=$SETUP_NAME" >> $Env:GITHUB_ENV
# - code above copied from build.yml - # - code above copied from build.yml -
- name: Attest Build - name: Attest Build
uses: actions/attest-build-provenance@v2 uses: actions/attest@v4.1.0
with: with:
subject-path: | subject-path: |
build/exe.*/ArchipelagoLauncher.exe build/exe.*/ArchipelagoLauncher.exe
@@ -114,14 +114,14 @@ jobs:
- name: Set env - name: Set env
run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
# - code below copied from build.yml - # - code below copied from build.yml -
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- name: Install base dependencies - name: Install base dependencies
run: | run: |
sudo apt update sudo apt update
sudo apt -y install build-essential p7zip xz-utils wget libglib2.0-0 sudo apt -y install build-essential p7zip xz-utils wget libglib2.0-0
sudo apt -y install python3-gi libgirepository1.0-dev # should pull dependencies for gi installation below sudo apt -y install python3-gi libgirepository1.0-dev # should pull dependencies for gi installation below
- name: Get a recent python - name: Get a recent python
uses: actions/setup-python@v5 uses: actions/setup-python@v6.2.0
with: with:
python-version: '~3.12.7' python-version: '~3.12.7'
check-latest: true check-latest: true
@@ -157,7 +157,7 @@ jobs:
echo "TAR_NAME=$TAR_NAME" >> $GITHUB_ENV echo "TAR_NAME=$TAR_NAME" >> $GITHUB_ENV
# - code above copied from build.yml - # - code above copied from build.yml -
- name: Attest Build - name: Attest Build
uses: actions/attest-build-provenance@v2 uses: actions/attest@v4.1.0
with: with:
subject-path: | subject-path: |
build/exe.*/ArchipelagoLauncher build/exe.*/ArchipelagoLauncher
.github/workflows/scan-build.yml
+7 -3
View File
@@ -28,12 +28,14 @@ on:
- 'requirements.txt' - 'requirements.txt'
- '.github/workflows/scan-build.yml' - '.github/workflows/scan-build.yml'
permissions: {}
jobs: jobs:
scan-build: scan-build:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
with: with:
submodules: recursive submodules: recursive
- name: Install newer Clang - name: Install newer Clang
@@ -45,7 +47,7 @@ jobs:
run: | run: |
sudo apt install clang-tools-19 sudo apt install clang-tools-19
- name: Get a recent python - name: Get a recent python
uses: actions/setup-python@v5 uses: actions/setup-python@v6.2.0
with: with:
python-version: '3.11' python-version: '3.11'
- name: Install dependencies - name: Install dependencies
@@ -59,7 +61,9 @@ jobs:
scan-build-19 --status-bugs -o scan-build-reports -disable-checker deadcode.DeadStores python setup.py build -y scan-build-19 --status-bugs -o scan-build-reports -disable-checker deadcode.DeadStores python setup.py build -y
- name: Store report - name: Store report
if: failure() if: failure()
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@v7.0.0
with: with:
name: scan-build-reports name: scan-build-reports
path: scan-build-reports path: scan-build-reports
compression-level: 9 # highly compressible
if-no-files-found: error
.github/workflows/strict-type-check.yml
+4 -2
View File
@@ -14,13 +14,15 @@ on:
- ".github/workflows/strict-type-check.yml" - ".github/workflows/strict-type-check.yml"
- "**.pyi" - "**.pyi"
permissions: {}
jobs: jobs:
pyright: pyright:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- uses: actions/setup-python@v5 - uses: actions/setup-python@v6.2.0
with: with:
python-version: "3.11" python-version: "3.11"
.github/workflows/unittests.yml
+6 -4
View File
@@ -29,6 +29,8 @@ on:
- '!.github/workflows/**' - '!.github/workflows/**'
- '.github/workflows/unittests.yml' - '.github/workflows/unittests.yml'
permissions: {}
jobs: jobs:
unit: unit:
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
@@ -51,9 +53,9 @@ jobs:
os: macos-latest os: macos-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- name: Set up Python ${{ matrix.python.version }} - name: Set up Python ${{ matrix.python.version }}
uses: actions/setup-python@v5 uses: actions/setup-python@v6.2.0
with: with:
python-version: ${{ matrix.python.version }} python-version: ${{ matrix.python.version }}
- name: Install dependencies - name: Install dependencies
@@ -78,9 +80,9 @@ jobs:
- {version: '3.13'} # current - {version: '3.13'} # current
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v6.0.2
- name: Set up Python ${{ matrix.python.version }} - name: Set up Python ${{ matrix.python.version }}
uses: actions/setup-python@v5 uses: actions/setup-python@v6.2.0
with: with:
python-version: ${{ matrix.python.version }} python-version: ${{ matrix.python.version }}
- name: Install dependencies - name: Install dependencies