Skip to content

Commit c7aeda7

Browse files
simolus3simolus3
committed
Enable zizmor
1 parent 3181726 commit c7aeda7

5 files changed

Lines changed: 113 additions & 34 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ updates:
88
all-github-actions:
99
patterns:
1010
- "*"
11+
cooldown:
12+
default-days: 7
1113
- package-ecosystem: "pub"
1214
versioning-strategy: "increase-if-necessary"
1315
directory: "/"
@@ -17,3 +19,5 @@ updates:
1719
all-pub-dependencies:
1820
patterns:
1921
- "*"
22+
cooldown:
23+
default-days: 7

‎.github/workflows/compile_sqlite.yml‎

Lines changed: 47 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,16 @@ on:
1313
description: "ID of the artifact containing libraries compiled with sanitizers"
1414
value: ${{ jobs.build_with_sanitizers.outputs.libs }}
1515

16+
permissions: {}
17+
1618
jobs:
1719
download_sqlite:
1820
runs-on: ubuntu-slim
1921
name: Download SQLite sources
2022
steps:
2123
- uses: actions/checkout@v6
24+
with:
25+
persist-credentials: false
2226
- uses: actions/cache@v5
2327
id: cache_build
2428
with:
@@ -51,6 +55,8 @@ jobs:
5155
name: Compile sqlite3
5256
steps:
5357
- uses: actions/checkout@v6
58+
with:
59+
persist-credentials: false
5460
- uses: actions/cache@v5
5561
id: cache_build
5662
with:
@@ -95,6 +101,8 @@ jobs:
95101
libs: ${{ steps.upload.outputs.artifact-id }}
96102
steps:
97103
- uses: actions/checkout@v6
104+
with:
105+
persist-credentials: false
98106
- uses: actions/cache@v5
99107
id: cache_build
100108
with:
@@ -110,11 +118,9 @@ jobs:
110118
- uses: dart-lang/setup-dart@v1
111119
if: steps.cache_build.outputs.cache-hit != 'true'
112120

113-
- uses: dtolnay/rust-toolchain@stable
121+
- name: Install rust
114122
if: steps.cache_build.outputs.cache-hit != 'true'
115-
with:
116-
toolchain: nightly
117-
components: rust-src
123+
run: rustup toolchain install nightly --component rust-src
118124

119125
- name: Install LLVM toolchain
120126
shell: bash
@@ -147,6 +153,8 @@ jobs:
147153
runs-on: ubuntu-latest
148154
steps:
149155
- uses: actions/checkout@v6
156+
with:
157+
persist-credentials: false
150158
- uses: actions/cache@v5
151159
id: cache_build
152160
with:
@@ -156,19 +164,19 @@ jobs:
156164
# clang 18 that ships on ubuntu crashes when compiling the wasm sources
157165
- name: Install LLVM and Clang
158166
if: steps.cache_build.outputs.cache-hit != 'true'
159-
uses: KyleMayes/install-llvm-action@v2.0.9
167+
uses: KyleMayes/install-llvm-action@ebc0426251bc40c7cd31162802432c68818ab8f0 #v2.0.9
160168
with:
161169
version: "21"
162170

163171
- name: Download WASI SDK
164172
if: steps.cache_build.outputs.cache-hit != 'true'
165173
run: |
166-
ls -al ${{ env.LLVM_PATH }}
174+
ls -al ${LLVM_PATH}
167175
168176
curl -L https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-27/wasi-sdk-27.0-x86_64-linux.deb -o wasi-sdk.deb
169177
sudo dpkg -i wasi-sdk.deb
170178
sudo mkdir /usr/lib/llvm-18/lib/clang/18/lib/wasi
171-
sudo cp -r /opt/wasi-sdk/lib/clang/20/lib/* ${{ env.LLVM_PATH }}/lib/clang/21/lib/
179+
sudo cp -r /opt/wasi-sdk/lib/clang/20/lib/* ${LLVM_PATH}/lib/clang/21/lib/
172180
173181
curl -L https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-x86_64-linux.tar.gz -o binaryen.tar.gz
174182
tar --extract --gzip --file binaryen.tar.gz
@@ -196,17 +204,28 @@ jobs:
196204
runs-on: ubuntu-latest
197205
steps:
198206
- uses: actions/checkout@v6
207+
with:
208+
persist-credentials: false
199209
- uses: actions/cache@v5
200210
id: cache_build
201211
with:
202212
path: sqlite3_connection_pool/out
203213
key: pool-helper-${{ runner.os }}-${{ hashFiles('sqlite3_connection_pool/src/**', 'sqlite3_connection_pool/Cargo.toml', 'sqlite3_connection_pool/.cargo/**') }}
204-
- uses: dtolnay/rust-toolchain@stable
214+
- name: Install rust
205215
if: steps.cache_build.outputs.cache-hit != 'true'
206-
with:
207-
toolchain: nightly
208-
components: rust-src
209-
targets: aarch64-unknown-linux-gnu,x86_64-unknown-linux-gnu,riscv64gc-unknown-linux-gnu,armv7-unknown-linux-gnueabihf,aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android
216+
run: |
217+
rustup toolchain install nightly --component rust-src
218+
rustup target add --toolchain nightly aarch64-unknown-linux-gnu
219+
rustup target add --toolchain nightly x86_64-unknown-linux-gnu
220+
rustup target add --toolchain nightly riscv64gc-unknown-linux-gnu
221+
222+
rustup target add --toolchain nightly armv7-unknown-linux-gnueabihf
223+
rustup target add --toolchain nightly aarch64-linux-android
224+
rustup target add --toolchain nightly armv7-linux-androideabi
225+
rustup target add --toolchain nightly x86_64-linux-android
226+
- name: Install rust
227+
if: steps.cache_build.outputs.cache-hit != 'true'
228+
run: rustup toolchain install nightly --component rust-src
210229
- run: cargo install cargo-ndk
211230
if: steps.cache_build.outputs.cache-hit != 'true'
212231
- name: Install cross-compiling GCC
@@ -251,17 +270,19 @@ jobs:
251270
runs-on: macos-latest
252271
steps:
253272
- uses: actions/checkout@v6
273+
with:
274+
persist-credentials: false
254275
- uses: actions/cache@v5
255276
id: cache_build
256277
with:
257278
path: sqlite3_connection_pool/out
258279
key: pool-helper-${{ runner.os }}-${{ hashFiles('sqlite3_connection_pool/src/**', 'sqlite3_connection_pool/Cargo.toml', 'sqlite3_connection_pool/.cargo/**') }}
259-
- uses: dtolnay/rust-toolchain@stable
280+
- name: Install rust
260281
if: steps.cache_build.outputs.cache-hit != 'true'
261-
with:
262-
toolchain: nightly
263-
components: rust-src
264-
targets: x86_64-apple-darwin,aarch64-apple-darwin
282+
run: |
283+
rustup toolchain install nightly --component rust-src
284+
rustup target add --toolchain nightly x86_64-apple-darwin
285+
rustup target add --toolchain nightly aarch64-apple-darwin
265286
- name: Build for macOS and iOS
266287
if: steps.cache_build.outputs.cache-hit != 'true'
267288
working-directory: sqlite3_connection_pool
@@ -289,17 +310,19 @@ jobs:
289310
runs-on: windows-latest
290311
steps:
291312
- uses: actions/checkout@v6
313+
with:
314+
persist-credentials: false
292315
- uses: actions/cache@v5
293316
id: cache_build
294317
with:
295318
path: sqlite3_connection_pool/out
296319
key: pool-helper-${{ runner.os }}-${{ hashFiles('sqlite3_connection_pool/src/**', 'sqlite3_connection_pool/Cargo.toml', 'sqlite3_connection_pool/.cargo/**') }}
297-
- uses: dtolnay/rust-toolchain@stable
320+
- name: Install rust
298321
if: steps.cache_build.outputs.cache-hit != 'true'
299-
with:
300-
toolchain: nightly
301-
components: rust-src
302-
targets: x86_64-pc-windows-msvc,aarch64-pc-windows-msvc
322+
run: |
323+
rustup toolchain install nightly --component rust-src
324+
rustup target add --toolchain nightly x86_64-pc-windows-msvc
325+
rustup target add --toolchain nightly aarch64-pc-windows-msvc
303326
- name: Build for Windows
304327
if: steps.cache_build.outputs.cache-hit != 'true'
305328
working-directory: sqlite3_connection_pool
@@ -339,6 +362,8 @@ jobs:
339362

340363
steps:
341364
- uses: actions/checkout@v6
365+
with:
366+
persist-credentials: false
342367

343368
- uses: actions/download-artifact@v8
344369
with:

‎.github/workflows/main.yml‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,28 @@ on:
66
pull_request:
77
branches: [ main ]
88

9+
permissions: {}
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
913
jobs:
1014
fetch_sqlite:
1115
if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
1216
uses: ./.github/workflows/compile_sqlite.yml
1317

18+
zizmor:
19+
runs-on: ubuntu-latest
20+
permissions:
21+
security-events: write # To report results
22+
steps:
23+
- name: Checkout repository
24+
uses: actions/checkout@v6
25+
with:
26+
persist-credentials: false
27+
28+
- name: Run zizmor 🌈
29+
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
30+
1431
analyze:
1532
if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
1633
timeout-minutes: 5
@@ -22,6 +39,8 @@ jobs:
2239
runs-on: ubuntu-latest
2340
steps:
2441
- uses: actions/checkout@v6
42+
with:
43+
persist-credentials: false
2544
- uses: dart-lang/setup-dart@v1
2645
with:
2746
sdk: ${{ matrix.dart }}
@@ -67,6 +86,8 @@ jobs:
6786

6887
steps:
6988
- uses: actions/checkout@v6
89+
with:
90+
persist-credentials: false
7091
- uses: dart-lang/setup-dart@v1
7192
with:
7293
sdk: ${{ matrix.dart }}
@@ -168,6 +189,8 @@ jobs:
168189
runs-on: ubuntu-latest
169190
steps:
170191
- uses: actions/checkout@v6
192+
with:
193+
persist-credentials: false
171194
- uses: dart-lang/setup-dart@v1
172195
- name: Download compiled sqlite3
173196
uses: actions/download-artifact@v8
@@ -202,6 +225,8 @@ jobs:
202225
runs-on: ubuntu-latest
203226
steps:
204227
- uses: actions/checkout@v6
228+
with:
229+
persist-credentials: false
205230
- uses: dart-lang/setup-dart@v1
206231
- name: Download compiled sqlite3
207232
uses: actions/download-artifact@v8
@@ -278,7 +303,9 @@ jobs:
278303
xcrun simctl boot $IPHONE
279304
280305
- uses: actions/checkout@v6
281-
- uses: subosito/flutter-action@v2
306+
with:
307+
persist-credentials: false
308+
- uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 #v2.23.0
282309

283310
- name: Flutter version
284311
run: flutter --version
@@ -343,7 +370,7 @@ jobs:
343370
flutter test integration_test -d linux
344371
345372
- name: SQLite Android emulator tests
346-
uses: reactivecircus/android-emulator-runner@v2
373+
uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2.37.0
347374
if: runner.os == 'linux'
348375
with:
349376
api-level: 34
@@ -369,7 +396,7 @@ jobs:
369396
flutter test integration_test -Dsqlite3.multipleciphers=true -d macos
370397
371398
- name: sqlite3mc Android emulator tests
372-
uses: reactivecircus/android-emulator-runner@v2
399+
uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2.37.0
373400
if: runner.os == 'linux'
374401
with:
375402
api-level: 34

‎.github/workflows/release.yml‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,22 @@ on:
88
- 'sqlite3_web-[0-9]+.[0-9]+.[0-9]+*'
99
- 'sqlite3_connection_pool-[0-9]+.[0-9]+.[0-9]+*'
1010

11+
permissions: {}
12+
1113
jobs:
1214
fetch_sqlite:
1315
uses: ./.github/workflows/compile_sqlite.yml
1416

1517
prepare_release:
1618
needs: [fetch_sqlite]
1719
permissions:
18-
packages: write
19-
contents: write
20+
packages: write # Needed to upload release assets
21+
contents: write # Needed to upload release assets
2022
runs-on: ubuntu-latest
2123
steps:
2224
- uses: actions/checkout@v6
25+
with:
26+
persist-credentials: false
2327
- uses: dart-lang/setup-dart@v1
2428
- name: Pub get
2529
run: dart pub get
@@ -33,12 +37,14 @@ jobs:
3337
if: "${{ startsWith(github.ref_name, 'sqlite3-') }}"
3438
id: tag
3539
run: |
36-
tag=$(basename "${{ github.ref }}")
40+
tag=$(basename "${GITHUB_REF}")
3741
echo "tag=$tag" >> $GITHUB_OUTPUT
3842
3943
- name: Verify asset hashes
4044
if: "${{ startsWith(github.ref_name, 'sqlite3-') }}"
41-
run: dart run tool/write_asset_hashes.dart "${{ steps.tag.outputs.tag }}"
45+
run: dart run tool/write_asset_hashes.dart "${STEPS_TAG_OUTPUTS_TAG}"
46+
env:
47+
STEPS_TAG_OUTPUTS_TAG: ${{ steps.tag.outputs.tag }}
4248
- name: List libraries
4349
run: ls -al sqlite-compiled
4450

@@ -47,8 +53,9 @@ jobs:
4753
env:
4854
GH_TOKEN: ${{ github.token }}
4955
GH_REPO: ${{ github.repository }}
56+
STEPS_TAG_OUTPUTS_TAG: ${{ steps.tag.outputs.tag }}
5057
run: |
51-
tag="${{ steps.tag.outputs.tag }}"
58+
tag="${STEPS_TAG_OUTPUTS_TAG}"
5259
body="Pending release for $tag"
5360
gh release create --draft "$tag" --title "$tag" --notes "$body"
5461
@@ -57,7 +64,7 @@ jobs:
5764
publish_sqlite3:
5865
needs: [prepare_release]
5966
permissions:
60-
id-token: write
67+
id-token: write # Needed to create OIDC token for pub.dev
6168
if: "${{ startsWith(github.ref_name, 'sqlite3-') }}"
6269
uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
6370
with:
@@ -67,7 +74,7 @@ jobs:
6774
publish_sqlite3_test:
6875
needs: [prepare_release]
6976
permissions:
70-
id-token: write
77+
id-token: write # Needed to create OIDC token for pub.dev
7178
if: "${{ startsWith(github.ref_name, 'sqlite3_test-') }}"
7279
uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
7380
with:
@@ -77,7 +84,7 @@ jobs:
7784
publish_sqlite3_web:
7885
needs: [prepare_release]
7986
permissions:
80-
id-token: write
87+
id-token: write # Needed to create OIDC token for pub.dev
8188
if: "${{ startsWith(github.ref_name, 'sqlite3_web-') }}"
8289
uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
8390
with:
@@ -87,14 +94,16 @@ jobs:
8794
publish_sqlite3_connection_pool:
8895
needs: [fetch_sqlite, prepare_release]
8996
permissions:
90-
id-token: write
97+
id-token: write # Needed to create OIDC token for pub.dev
9198
if: "${{ startsWith(github.ref_name, 'sqlite3_connection_pool-') }}"
9299
runs-on: ubuntu-latest
93100
environment: 'pub.dev'
94101
# This can't use the workflow because we need to download assets to include in
95102
# the package.
96103
steps:
97104
- uses: actions/checkout@v6
105+
with:
106+
persist-credentials: false
98107
- uses: dart-lang/setup-dart@v1 # This will request an OIDC token for pub.dev
99108

100109
- name: Download connection pool libraries

‎.github/zizmor.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Configuration for https://zizmor.sh/, a static analysis tool for GitHub actions.
2+
rules:
3+
unpinned-uses:
4+
config:
5+
policies:
6+
"dart-lang/*": ref-pin
7+
"actions/*": ref-pin
8+
anonymous-definition:
9+
disable: true
10+
concurrency-limits:
11+
ignore:
12+
# We don't need to limit concurrency for publishing, as only maintainers can
13+
# push tags.
14+
- release.yml:3:1

0 commit comments

Comments
 (0)