mirror of
https://github.com/Chatterino/chatterino2.git
synced 2026-09-24 07:25:14 -05:00
Nerixyz
bf71244ed0
To prevent issues from using GitHub actions and dependabot, I hardened the workflows using [zizmor](https://docs.zizmor.sh/). There are still 77 open findings. I only applied the ones that are easy wins. - Pin actions to a commit hash instead of tag - tags are not immutable (see [`unpinned-uses`](https://docs.zizmor.sh/audits/#unpinned-uses)) - Disable `persist-credentials` on checkout - we don't need it (see [`artipacked`](https://docs.zizmor.sh/audits/#artipacked)) - Set cooldown on dependabot updates (see [`dependabot-cooldown`](https://docs.zizmor.sh/audits/#dependabot-cooldown)). For our own packages, we can manually create PRs. I left the docker images unpinned, because they're frequently updated, but zizmor would like to see them pinned as well. Reviewed-by: pajlada <rasmus.karlsson@pajlada.com>
24 lines
618 B
YAML
24 lines
618 B
YAML
# SPDX-FileCopyrightText: 2025 Rasmus Karlsson <rasmus.karlsson@pajlada.com>
|
|
# SPDX-License-Identifier: CC0-1.0
|
|
---
|
|
name: REUSE license check
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
reuse:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: REUSE license check
|
|
uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
|
|
# I don't want to scare contributors yet, but I want to see progress in actions.
|
|
continue-on-error: true
|