Skip to content

Address zizmor findings: #1431

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cushon merged 3 commits into from
Aug 3, 2026
+36 −17
Merged

Address zizmor findings: #1431

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
db3a73b
Address `zizmor` findings:
cpovirk Jul 31, 2026
1ebd195
Have `zizmor` fix `zizmor`-inserted version comments.
cpovirk Aug 3, 2026
e439e34
Address https://docs.zizmor.sh/audits/#excessive-permissions and http…
cpovirk Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 18 additions & 9 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,9 @@ on:
branches:
- master

permissions:
contents: read

jobs:
test-OpenJDK:
name: "JDK ${{ matrix.java }} on ${{ matrix.os }}"
Expand All @@ -47,20 +50,22 @@ jobs:
continue-on-error: ${{ matrix.experimental }}
steps:
- name: Cancel previous
uses: styfle/cancel-workflow-action@0.13.1
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
with:
access_token: ${{ github.token }}
- name: "Check out repository"
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false
- name: "Set up JDK ${{ matrix.java }} from jdk.java.net"
if: ${{ matrix.java == 'EA' }}
uses: oracle-actions/setup-java@v1
uses: oracle-actions/setup-java@ec7274acdd237c7fe61395ed2edda22d756b5afe # v1
with:
website: jdk.java.net
release: ${{ matrix.java }}
- name: "Set up JDK ${{ matrix.java }} from Zulu"
if: ${{ matrix.java != 'EA' && matrix.java != 'GraalVM' }}
uses: actions/setup-java@v5
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
with:
java-version: ${{ matrix.java }}
distribution: "zulu"
Expand All @@ -85,13 +90,15 @@ jobs:
continue-on-error: true
steps:
- name: Cancel previous
uses: styfle/cancel-workflow-action@0.13.1
uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
with:
access_token: ${{ github.token }}
- name: "Check out repository"
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false
- name: "Set up GraalVM ${{ matrix.java }}"
uses: graalvm/setup-graalvm@v1
uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1
with:
java-version: "25"
distribution: "graalvm-community"
Expand All @@ -113,9 +120,11 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: "Check out repository"
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false
- name: "Set up JDK 21"
uses: actions/setup-java@v5
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
with:
java-version: 21
distribution: "zulu"
Expand Down
26 changes: 18 additions & 8 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,12 @@
contents: write
steps:
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false

- name: Set up JDK
uses: actions/setup-java@v5
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
with:
java-version: 21
distribution: "zulu"
Expand Down Expand Up @@ -74,7 +76,7 @@
GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}

- name: Add Artifacts to Release Entry
uses: softprops/action-gh-release@v3.0.1
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1

Check notice on line 79 in .github/workflows/release.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

superfluous-actions 

release.yml:79: action functionality is already included by the runner: use `gh release` in a script step
with:
draft: true
name: ${{ github.event.input.version }}
Expand All @@ -87,6 +89,9 @@
build-native-image:
name: "Build GraalVM native-image on ${{ matrix.os }}"
runs-on: ${{ matrix.os }}
defaults:
run:
shell: bash
permissions:
contents: write
needs: build-maven-jars
Expand All @@ -102,23 +107,28 @@
EXTENSION: ${{ matrix.os == 'windows-latest' && '.exe' || '' }}
steps:
- name: "Check out repository"
uses: actions/checkout@v7
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false
- name: "Set up GraalVM"
uses: graalvm/setup-graalvm@v1
uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1
with:
java-version: "25"
distribution: "graalvm-community"
github-token: ${{ secrets.GITHUB_TOKEN }}
native-image-job-reports: "true"
cache: "maven"
- name: Bump Version Number
run: mvn --no-transfer-progress versions:set versions:commit -DnewVersion="${{ github.event.inputs.version }}"
env:
GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}
run: mvn --no-transfer-progress versions:set versions:commit -DnewVersion="${GITHUB_EVENT_INPUTS_VERSION}"
- name: "Native"
run: mvn -Pnative -DskipTests package -pl core -am
- name: "Move outputs"
run: cp core/target/google-java-format${{ env.EXTENSION }} google-java-format_${{ env.SUFFIX }}${{ env.EXTENSION }}
run: cp core/target/google-java-format${EXTENSION} google-java-format_${SUFFIX}${EXTENSION}
- name: "Upload native-image"
env:
GH_TOKEN: ${{ github.token }}
GH_REPO: ${{ github.repository }}
run: gh release upload "v${{ github.event.inputs.version }}" "google-java-format_${{ env.SUFFIX }}${{ env.EXTENSION }}"
GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}
run: gh release upload "v${GITHUB_EVENT_INPUTS_VERSION}" "google-java-format_${SUFFIX}${EXTENSION}"
Loading