starred/chatterino2
1
0
Fork 0
mirror of https://github.com/Chatterino/chatterino2.git synced 2026-08-24 02:24:18 -05:00
Code Issues Packages Projects Releases Wiki Activity

ci: Harden actions and dependabot (a bit) (#7188)

Browse Source 
To prevent issues from using GitHub actions and dependabot, I hardened
the workflows using [zizmor](https://docs.zizmor.sh/). There are still
77 open findings. I only applied the ones that are easy wins.

- Pin actions to a commit hash instead of tag - tags are not immutable
(see [`unpinned-uses`](https://docs.zizmor.sh/audits/#unpinned-uses))
- Disable `persist-credentials` on checkout - we don't need it (see
[`artipacked`](https://docs.zizmor.sh/audits/#artipacked))
- Set cooldown on dependabot updates (see
[`dependabot-cooldown`](https://docs.zizmor.sh/audits/#dependabot-cooldown)).
For our own packages, we can manually create PRs.

I left the docker images unpinned, because they're frequently updated,
but zizmor would like to see them pinned as well.

Reviewed-by: pajlada <rasmus.karlsson@pajlada.com>
This commit is contained in:
Nerixyz
2026-08-20 20:58:01 +00:00
committed by GitHub
parent 58f9ff32a2
commit bf71244ed0
15 changed files with 64 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/dependabot.yml
+4
View File
@@ -6,6 +6,8 @@ updates:
interval: "daily"
labels:
- "ci"
cooldown:
default-days: 7
- package-ecosystem: "gitsubmodule"
directory: "/"
schedule:
@@ -13,3 +15,5 @@ updates:
labels:
- "ci"
- "submodules"
cooldown:
default-days: 7
.github/workflows/build-freebsd.yml
+3 -2
View File
@@ -28,10 +28,11 @@ jobs:
C2_ENABLE_LTO: false
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
fetch-depth: 0 # allows for tags access
persist-credentials: false
- name: Get memory
id: mem
@@ -40,7 +41,7 @@ jobs:
echo "mem_mb=$MEM_MB" >> $GITHUB_OUTPUT
- name: Build using FreeBSD
uses: vmactions/freebsd-vm@v1.5.3
uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3
with:
envs: "C2_ENABLE_LTO"
release: "14.4"
.github/workflows/build.yml
+17 -14
View File
@@ -76,10 +76,11 @@ jobs:
C2_ENABLE_CRASHPAD: ${{ matrix.skip-crashpad == false }}
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
fetch-depth: 0 # allows for tags access
persist-credentials: false
- name: Fix git permission error
run: |
@@ -135,7 +136,7 @@ jobs:
- name: Upload artifact - .deb (Ubuntu)
if: matrix.build-deb
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: Chatterino-${{ matrix.os }}.deb
path: build/Chatterino-${{ matrix.os }}-x86_64.deb
@@ -165,10 +166,11 @@ jobs:
C2_ENABLE_CRASHPAD: ${{ matrix.skip-crashpad == false }}
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
fetch-depth: 0 # allows for tags access
persist-credentials: false
- name: Determine build type
id: build-type
@@ -195,7 +197,7 @@ jobs:
- name: Install Qt6
if: startsWith(matrix.qt-version, '6.')
uses: jurplel/install-qt-action@v4.3.1
uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1
with:
cache: true
cache-key-prefix: ${{ runner.os }}-QtCache-${{ matrix.qt-version }}-v2
@@ -205,11 +207,11 @@ jobs:
# WINDOWS
- name: Enable Developer Command Prompt (Windows)
if: startsWith(matrix.os, 'windows')
uses: Chatterino/msvc-dev-cmd@v2.0.7
uses: Chatterino/msvc-dev-cmd@24444121cb2805a7adbd23d0f4455d0916af896b # v2.0.7
- name: Setup sccache (Windows)
# sccache v0.7.4
uses: hendrikmuhs/ccache-action@v1.2.23
uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
if: startsWith(matrix.os, 'windows')
with:
variant: sccache
@@ -221,7 +223,7 @@ jobs:
- name: Cache conan packages (Windows)
if: startsWith(matrix.os, 'windows')
uses: actions/cache@v6
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
key: ${{ runner.os }}-conan-user-${{ hashFiles('**/conanfile.py') }}-QT6
path: ~/.conan2/
@@ -299,14 +301,14 @@ jobs:
- name: Upload artifact (Windows - binary)
if: startsWith(matrix.os, 'windows') && !matrix.skip-artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: chatterino-windows-x86-64-Qt-${{ matrix.qt-version }}.zip
path: build/chatterino-windows-x86-64-Qt-${{ matrix.qt-version }}.zip
- name: Upload artifact (Windows - symbols)
if: startsWith(matrix.os, 'windows') && !matrix.skip-artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: chatterino-windows-x86-64-Qt-${{ matrix.qt-version }}-symbols.pdb.7z
path: build/bin/chatterino-Qt-${{ matrix.qt-version }}.pdb.7z
@@ -357,7 +359,7 @@ jobs:
- name: Upload artifact (MacOS)
if: startsWith(matrix.os, 'macos')
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: chatterino-macos-Qt-${{ matrix.qt-version }}.dmg
path: build/chatterino-macos-Qt-${{ matrix.qt-version }}.dmg
@@ -368,11 +370,12 @@ jobs:
if: (github.event_name == 'push' && github.ref == 'refs/heads/master')
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # allows for tags access
persist-credentials: false
- uses: actions/download-artifact@v8
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
name: Download artifacts
with:
path: release-artifacts/
@@ -389,7 +392,7 @@ jobs:
shell: bash
- name: Setup Python
uses: actions/setup-python@v7
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.12"
@@ -405,7 +408,7 @@ jobs:
shell: bash
- name: Create release
uses: ncipollo/release-action@v1.21.0
uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
with:
replacesArtifacts: true
allowUpdates: true
.github/workflows/check-formatting.yml
+4 -2
View File
@@ -17,7 +17,9 @@ jobs:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: apt-get update
run: sudo apt-get update
@@ -26,7 +28,7 @@ jobs:
run: sudo apt-get -y install dos2unix
- name: Check formatting
uses: DoozyX/clang-format-lint-action@v0.20
uses: DoozyX/clang-format-lint-action@bcb4eb2cb0d707ee4f3e5cc3b456eb075f12cf73 # v0.20
with:
source: "./src ./tests/src ./benchmarks/src ./mocks/include ./lib/twitch-eventsub-ws/include ./lib/twitch-eventsub-ws/src"
extensions: "hpp,cpp"
.github/workflows/clang-tidy.yml
+5 -4
View File
@@ -23,14 +23,15 @@ jobs:
fail-fast: false
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
fetch-depth: 0 # allows for tags access
persist-credentials: false
- name: Install Qt6
if: startsWith(matrix.qt-version, '6.')
uses: jurplel/install-qt-action@v4.3.1
uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1
with:
cache: true
cache-key-prefix: ${{ runner.os }}-QtCache-${{ matrix.qt-version }}-v2
@@ -41,7 +42,7 @@ jobs:
- name: clang-tidy review
timeout-minutes: 20
uses: ZedThree/clang-tidy-review@v0.23.1
uses: ZedThree/clang-tidy-review@438014136def4cb6242e9d0ef3da1a1cd48fa7ce # v0.23.1
with:
build_dir: build-clang-tidy
config_file: ".clang-tidy"
@@ -68,4 +69,4 @@ jobs:
curl, unzip
- name: clang-tidy-review upload
uses: ZedThree/clang-tidy-review/upload@v0.23.1
uses: ZedThree/clang-tidy-review/upload@438014136def4cb6242e9d0ef3da1a1cd48fa7ce # v0.23.1
.github/workflows/create-installer.yml
+5 -4
View File
@@ -20,12 +20,13 @@ jobs:
matrix:
qt-version: ["6.8.3"]
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # allows for tags access
persist-credentials: false
- name: Download artifact
uses: dawidd6/action-download-artifact@v20
uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
with:
workflow: build.yml
name: chatterino-windows-x86-64-Qt-${{ matrix.qt-version }}.zip
@@ -43,7 +44,7 @@ jobs:
run: echo "C:\Program Files (x86)\Inno Setup 6\" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
- name: Enable Developer Command Prompt
uses: Chatterino/msvc-dev-cmd@v2.0.7
uses: Chatterino/msvc-dev-cmd@24444121cb2805a7adbd23d0f4455d0916af896b # v2.0.7
- name: Build installer
id: build-installer
@@ -52,7 +53,7 @@ jobs:
shell: powershell
- name: Upload installer
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
path: build/${{ steps.build-installer.outputs.C2_INSTALLER_BASE_NAME }}.exe
name: ${{ steps.build-installer.outputs.C2_INSTALLER_BASE_NAME }}.exe
.github/workflows/eventsub-test.yml
+2 -1
View File
@@ -16,9 +16,10 @@ jobs:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
persist-credentials: false
- name: Install dependencies
run: |
.github/workflows/lint.yml
+4 -2
View File
@@ -17,8 +17,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
- name: Check formatting with Prettier
run: |
.github/workflows/post-clang-tidy-review.yml
+1 -1
View File
@@ -14,7 +14,7 @@ jobs:
if: ${{ github.event.workflow_run.conclusion == 'success' }}
steps:
- uses: ZedThree/clang-tidy-review/post@v0.23.1
- uses: ZedThree/clang-tidy-review/post@438014136def4cb6242e9d0ef3da1a1cd48fa7ce # v0.23.1
with:
lgtm_comment_body: ""
num_comments_as_exitcode: false
.github/workflows/reuse.yml
+4 -2
View File
@@ -13,9 +13,11 @@ jobs:
reuse:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: REUSE license check
uses: fsfe/reuse-action@v6
uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
# I don't want to scare contributors yet, but I want to see progress in actions.
continue-on-error: true
.github/workflows/test-arch-linux.yml
+2 -1
View File
@@ -31,9 +31,10 @@ jobs:
sudo pacman -Syu --noconfirm
sudo pacman -S --noconfirm qt6-base qt6-tools boost-libs qt6-imageformats qtkeychain-qt6 qt6-svg libnotify git boost cmake benchmark
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
persist-credentials: false
- name: Create build directory
run: mkdir build-test
.github/workflows/test-macos.yml
+3 -2
View File
@@ -33,13 +33,14 @@ jobs:
QT_MODULES: qtimageformats
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
fetch-depth: 0 # allows for tags access
persist-credentials: false
- name: Install Qt
uses: jurplel/install-qt-action@v4.3.1
uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1
with:
cache: true
cache-key-prefix: ${{ runner.os }}-QtCache-${{ matrix.qt-version }}-v2
.github/workflows/test-windows.yml
+6 -5
View File
@@ -38,13 +38,14 @@ jobs:
run: |
echo "C2_ENABLE_CRASHPAD=ON" >> "$Env:GITHUB_ENV"
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
fetch-depth: 0 # allows for tags access
persist-credentials: false
- name: Install Qt
uses: jurplel/install-qt-action@v4.3.1
uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1
with:
cache: true
cache-key-prefix: ${{ runner.os }}-QtCache-${{ matrix.qt-version }}-v2
@@ -52,11 +53,11 @@ jobs:
version: ${{ matrix.qt-version }}
- name: Enable Developer Command Prompt
uses: Chatterino/msvc-dev-cmd@v2.0.7
uses: Chatterino/msvc-dev-cmd@24444121cb2805a7adbd23d0f4455d0916af896b # v2.0.7
- name: Setup sccache
# sccache v0.7.4
uses: hendrikmuhs/ccache-action@v1.2.23
uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
with:
variant: sccache
# only save on the default (master) branch
@@ -66,7 +67,7 @@ jobs:
sccache-test-${{ matrix.os }}-${{ matrix.qt-version }}
- name: Cache conan packages
uses: actions/cache@v6
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
key: ${{ runner.os }}-conan-user-${{ hashFiles('**/conanfile.py') }}${{ env.C2_CONAN_CACHE_SUFFIX }}
path: ~/.conan2/
.github/workflows/test.yml
+3 -2
View File
@@ -26,9 +26,10 @@ jobs:
container: ghcr.io/chatterino/chatterino2-build-ubuntu-26.04:latest
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: recursive
persist-credentials: false
- name: Create build directory (Ubuntu)
run: mkdir build-test
@@ -87,7 +88,7 @@ jobs:
- name: Upload coverage reports to Codecov
if: github.repository_owner == 'Chatterino'
uses: codecov/codecov-action@v7.0.0
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
with:
token: ${{ secrets.CODECOV_TOKEN }}
plugins: gcov
.github/workflows/winget.yml
+1 -1
View File
@@ -7,7 +7,7 @@ jobs:
runs-on: windows-latest
if: ${{ startsWith(github.event.release.tag_name, 'v') }} && github.repository_owner == 'Chatterino'
steps:
- uses: vedantmgoyal9/winget-releaser@main
- uses: vedantmgoyal9/winget-releaser@b3a5dae0047c6180023acba3f548c55fdf6b7193 # main
with:
identifier: ChatterinoTeam.Chatterino
installers-regex: ^Chatterino.Installer.exe$