From bf71244ed02ce697eab9bbd5beb0a23a31e2f99b Mon Sep 17 00:00:00 2001 From: Nerixyz Date: Thu, 20 Aug 2026 22:58:01 +0200 Subject: [PATCH] ci: Harden actions and dependabot (a bit) (#7188) To prevent issues from using GitHub actions and dependabot, I hardened the workflows using [zizmor](https://docs.zizmor.sh/). There are still 77 open findings. I only applied the ones that are easy wins. - Pin actions to a commit hash instead of tag - tags are not immutable (see [`unpinned-uses`](https://docs.zizmor.sh/audits/#unpinned-uses)) - Disable `persist-credentials` on checkout - we don't need it (see [`artipacked`](https://docs.zizmor.sh/audits/#artipacked)) - Set cooldown on dependabot updates (see [`dependabot-cooldown`](https://docs.zizmor.sh/audits/#dependabot-cooldown)). For our own packages, we can manually create PRs. I left the docker images unpinned, because they're frequently updated, but zizmor would like to see them pinned as well. Reviewed-by: pajlada --- .github/dependabot.yml | 4 +++ .github/workflows/build-freebsd.yml | 5 ++-- .github/workflows/build.yml | 31 +++++++++++--------- .github/workflows/check-formatting.yml | 6 ++-- .github/workflows/clang-tidy.yml | 9 +++--- .github/workflows/create-installer.yml | 9 +++--- .github/workflows/eventsub-test.yml | 3 +- .github/workflows/lint.yml | 6 ++-- .github/workflows/post-clang-tidy-review.yml | 2 +- .github/workflows/reuse.yml | 6 ++-- .github/workflows/test-arch-linux.yml | 3 +- .github/workflows/test-macos.yml | 5 ++-- .github/workflows/test-windows.yml | 11 +++---- .github/workflows/test.yml | 5 ++-- .github/workflows/winget.yml | 2 +- 15 files changed, 64 insertions(+), 43 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 34f3a9f0c..b968f33cf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,8 @@ updates: interval: "daily" labels: - "ci" + cooldown: + default-days: 7 - package-ecosystem: "gitsubmodule" directory: "/" schedule: @@ -13,3 +15,5 @@ updates: labels: - "ci" - "submodules" + cooldown: + default-days: 7 diff --git a/.github/workflows/build-freebsd.yml b/.github/workflows/build-freebsd.yml index c92e49a5e..e93c4c6bb 100644 --- a/.github/workflows/build-freebsd.yml +++ b/.github/workflows/build-freebsd.yml @@ -28,10 +28,11 @@ jobs: C2_ENABLE_LTO: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive fetch-depth: 0 # allows for tags access + persist-credentials: false - name: Get memory id: mem @@ -40,7 +41,7 @@ jobs: echo "mem_mb=$MEM_MB" >> $GITHUB_OUTPUT - name: Build using FreeBSD - uses: vmactions/freebsd-vm@v1.5.3 + uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3 with: envs: "C2_ENABLE_LTO" release: "14.4" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 252aae74d..3bc72e073 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -76,10 +76,11 @@ jobs: C2_ENABLE_CRASHPAD: ${{ matrix.skip-crashpad == false }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive fetch-depth: 0 # allows for tags access + persist-credentials: false - name: Fix git permission error run: | @@ -135,7 +136,7 @@ jobs: - name: Upload artifact - .deb (Ubuntu) if: matrix.build-deb - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: Chatterino-${{ matrix.os }}.deb path: build/Chatterino-${{ matrix.os }}-x86_64.deb @@ -165,10 +166,11 @@ jobs: C2_ENABLE_CRASHPAD: ${{ matrix.skip-crashpad == false }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive fetch-depth: 0 # allows for tags access + persist-credentials: false - name: Determine build type id: build-type @@ -195,7 +197,7 @@ jobs: - name: Install Qt6 if: startsWith(matrix.qt-version, '6.') - uses: jurplel/install-qt-action@v4.3.1 + uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1 with: cache: true cache-key-prefix: ${{ runner.os }}-QtCache-${{ matrix.qt-version }}-v2 @@ -205,11 +207,11 @@ jobs: # WINDOWS - name: Enable Developer Command Prompt (Windows) if: startsWith(matrix.os, 'windows') - uses: Chatterino/msvc-dev-cmd@v2.0.7 + uses: Chatterino/msvc-dev-cmd@24444121cb2805a7adbd23d0f4455d0916af896b # v2.0.7 - name: Setup sccache (Windows) # sccache v0.7.4 - uses: hendrikmuhs/ccache-action@v1.2.23 + uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23 if: startsWith(matrix.os, 'windows') with: variant: sccache @@ -221,7 +223,7 @@ jobs: - name: Cache conan packages (Windows) if: startsWith(matrix.os, 'windows') - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: ${{ runner.os }}-conan-user-${{ hashFiles('**/conanfile.py') }}-QT6 path: ~/.conan2/ @@ -299,14 +301,14 @@ jobs: - name: Upload artifact (Windows - binary) if: startsWith(matrix.os, 'windows') && !matrix.skip-artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: chatterino-windows-x86-64-Qt-${{ matrix.qt-version }}.zip path: build/chatterino-windows-x86-64-Qt-${{ matrix.qt-version }}.zip - name: Upload artifact (Windows - symbols) if: startsWith(matrix.os, 'windows') && !matrix.skip-artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: chatterino-windows-x86-64-Qt-${{ matrix.qt-version }}-symbols.pdb.7z path: build/bin/chatterino-Qt-${{ matrix.qt-version }}.pdb.7z @@ -357,7 +359,7 @@ jobs: - name: Upload artifact (MacOS) if: startsWith(matrix.os, 'macos') - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: chatterino-macos-Qt-${{ matrix.qt-version }}.dmg path: build/chatterino-macos-Qt-${{ matrix.qt-version }}.dmg @@ -368,11 +370,12 @@ jobs: if: (github.event_name == 'push' && github.ref == 'refs/heads/master') steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # allows for tags access + persist-credentials: false - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 name: Download artifacts with: path: release-artifacts/ @@ -389,7 +392,7 @@ jobs: shell: bash - name: Setup Python - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" @@ -405,7 +408,7 @@ jobs: shell: bash - name: Create release - uses: ncipollo/release-action@v1.21.0 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: replacesArtifacts: true allowUpdates: true diff --git a/.github/workflows/check-formatting.yml b/.github/workflows/check-formatting.yml index 963bbb3f8..81b9eea90 100644 --- a/.github/workflows/check-formatting.yml +++ b/.github/workflows/check-formatting.yml @@ -17,7 +17,9 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: apt-get update run: sudo apt-get update @@ -26,7 +28,7 @@ jobs: run: sudo apt-get -y install dos2unix - name: Check formatting - uses: DoozyX/clang-format-lint-action@v0.20 + uses: DoozyX/clang-format-lint-action@bcb4eb2cb0d707ee4f3e5cc3b456eb075f12cf73 # v0.20 with: source: "./src ./tests/src ./benchmarks/src ./mocks/include ./lib/twitch-eventsub-ws/include ./lib/twitch-eventsub-ws/src" extensions: "hpp,cpp" diff --git a/.github/workflows/clang-tidy.yml b/.github/workflows/clang-tidy.yml index bcd521951..87a9ea1a9 100644 --- a/.github/workflows/clang-tidy.yml +++ b/.github/workflows/clang-tidy.yml @@ -23,14 +23,15 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive fetch-depth: 0 # allows for tags access + persist-credentials: false - name: Install Qt6 if: startsWith(matrix.qt-version, '6.') - uses: jurplel/install-qt-action@v4.3.1 + uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1 with: cache: true cache-key-prefix: ${{ runner.os }}-QtCache-${{ matrix.qt-version }}-v2 @@ -41,7 +42,7 @@ jobs: - name: clang-tidy review timeout-minutes: 20 - uses: ZedThree/clang-tidy-review@v0.23.1 + uses: ZedThree/clang-tidy-review@438014136def4cb6242e9d0ef3da1a1cd48fa7ce # v0.23.1 with: build_dir: build-clang-tidy config_file: ".clang-tidy" @@ -68,4 +69,4 @@ jobs: curl, unzip - name: clang-tidy-review upload - uses: ZedThree/clang-tidy-review/upload@v0.23.1 + uses: ZedThree/clang-tidy-review/upload@438014136def4cb6242e9d0ef3da1a1cd48fa7ce # v0.23.1 diff --git a/.github/workflows/create-installer.yml b/.github/workflows/create-installer.yml index 8868c746c..341950b77 100644 --- a/.github/workflows/create-installer.yml +++ b/.github/workflows/create-installer.yml @@ -20,12 +20,13 @@ jobs: matrix: qt-version: ["6.8.3"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # allows for tags access + persist-credentials: false - name: Download artifact - uses: dawidd6/action-download-artifact@v20 + uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20 with: workflow: build.yml name: chatterino-windows-x86-64-Qt-${{ matrix.qt-version }}.zip @@ -43,7 +44,7 @@ jobs: run: echo "C:\Program Files (x86)\Inno Setup 6\" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append - name: Enable Developer Command Prompt - uses: Chatterino/msvc-dev-cmd@v2.0.7 + uses: Chatterino/msvc-dev-cmd@24444121cb2805a7adbd23d0f4455d0916af896b # v2.0.7 - name: Build installer id: build-installer @@ -52,7 +53,7 @@ jobs: shell: powershell - name: Upload installer - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: path: build/${{ steps.build-installer.outputs.C2_INSTALLER_BASE_NAME }}.exe name: ${{ steps.build-installer.outputs.C2_INSTALLER_BASE_NAME }}.exe diff --git a/.github/workflows/eventsub-test.yml b/.github/workflows/eventsub-test.yml index 06454c7db..3a45d2b15 100644 --- a/.github/workflows/eventsub-test.yml +++ b/.github/workflows/eventsub-test.yml @@ -16,9 +16,10 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive + persist-credentials: false - name: Install dependencies run: | diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 539b63b13..007f756a1 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -17,8 +17,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - name: Check formatting with Prettier run: | diff --git a/.github/workflows/post-clang-tidy-review.yml b/.github/workflows/post-clang-tidy-review.yml index f1abe62a6..c1de6f630 100644 --- a/.github/workflows/post-clang-tidy-review.yml +++ b/.github/workflows/post-clang-tidy-review.yml @@ -14,7 +14,7 @@ jobs: if: ${{ github.event.workflow_run.conclusion == 'success' }} steps: - - uses: ZedThree/clang-tidy-review/post@v0.23.1 + - uses: ZedThree/clang-tidy-review/post@438014136def4cb6242e9d0ef3da1a1cd48fa7ce # v0.23.1 with: lgtm_comment_body: "" num_comments_as_exitcode: false diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 023f101f0..ffa267835 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -13,9 +13,11 @@ jobs: reuse: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: REUSE license check - uses: fsfe/reuse-action@v6 + uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0 # I don't want to scare contributors yet, but I want to see progress in actions. continue-on-error: true diff --git a/.github/workflows/test-arch-linux.yml b/.github/workflows/test-arch-linux.yml index 7932f8f8c..65fe9ccf5 100644 --- a/.github/workflows/test-arch-linux.yml +++ b/.github/workflows/test-arch-linux.yml @@ -31,9 +31,10 @@ jobs: sudo pacman -Syu --noconfirm sudo pacman -S --noconfirm qt6-base qt6-tools boost-libs qt6-imageformats qtkeychain-qt6 qt6-svg libnotify git boost cmake benchmark - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive + persist-credentials: false - name: Create build directory run: mkdir build-test diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml index 14cd946a6..ec4848fed 100644 --- a/.github/workflows/test-macos.yml +++ b/.github/workflows/test-macos.yml @@ -33,13 +33,14 @@ jobs: QT_MODULES: qtimageformats steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive fetch-depth: 0 # allows for tags access + persist-credentials: false - name: Install Qt - uses: jurplel/install-qt-action@v4.3.1 + uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1 with: cache: true cache-key-prefix: ${{ runner.os }}-QtCache-${{ matrix.qt-version }}-v2 diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml index d1e73c2a9..6727245a3 100644 --- a/.github/workflows/test-windows.yml +++ b/.github/workflows/test-windows.yml @@ -38,13 +38,14 @@ jobs: run: | echo "C2_ENABLE_CRASHPAD=ON" >> "$Env:GITHUB_ENV" - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive fetch-depth: 0 # allows for tags access + persist-credentials: false - name: Install Qt - uses: jurplel/install-qt-action@v4.3.1 + uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1 with: cache: true cache-key-prefix: ${{ runner.os }}-QtCache-${{ matrix.qt-version }}-v2 @@ -52,11 +53,11 @@ jobs: version: ${{ matrix.qt-version }} - name: Enable Developer Command Prompt - uses: Chatterino/msvc-dev-cmd@v2.0.7 + uses: Chatterino/msvc-dev-cmd@24444121cb2805a7adbd23d0f4455d0916af896b # v2.0.7 - name: Setup sccache # sccache v0.7.4 - uses: hendrikmuhs/ccache-action@v1.2.23 + uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23 with: variant: sccache # only save on the default (master) branch @@ -66,7 +67,7 @@ jobs: sccache-test-${{ matrix.os }}-${{ matrix.qt-version }} - name: Cache conan packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: ${{ runner.os }}-conan-user-${{ hashFiles('**/conanfile.py') }}${{ env.C2_CONAN_CACHE_SUFFIX }} path: ~/.conan2/ diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index cdecade0b..441bcaeeb 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -26,9 +26,10 @@ jobs: container: ghcr.io/chatterino/chatterino2-build-ubuntu-26.04:latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: recursive + persist-credentials: false - name: Create build directory (Ubuntu) run: mkdir build-test @@ -87,7 +88,7 @@ jobs: - name: Upload coverage reports to Codecov if: github.repository_owner == 'Chatterino' - uses: codecov/codecov-action@v7.0.0 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }} plugins: gcov diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml index da38ce476..7c3fc47e9 100644 --- a/.github/workflows/winget.yml +++ b/.github/workflows/winget.yml @@ -7,7 +7,7 @@ jobs: runs-on: windows-latest if: ${{ startsWith(github.event.release.tag_name, 'v') }} && github.repository_owner == 'Chatterino' steps: - - uses: vedantmgoyal9/winget-releaser@main + - uses: vedantmgoyal9/winget-releaser@b3a5dae0047c6180023acba3f548c55fdf6b7193 # main with: identifier: ChatterinoTeam.Chatterino installers-regex: ^Chatterino.Installer.exe$