Skip to content

Commit 2a15f41

Browse files
lqiu96lqiu96
committed
ci: restore zizmor security pins and permissions across workflows
1 parent a9ebb0b commit 2a15f41

13 files changed

Lines changed: 317 additions & 110 deletions

‎.github/workflows/ci.yaml‎

Lines changed: 35 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@ jobs:
3232
# runnable is true if there are changes outside the .github/workflows directory OR if ci.yaml itself (or kokoro scripts) is modified.
3333
runnable: ${{ fromJSON(steps.filter.outputs.all_count) > fromJSON(steps.filter.outputs.workflows_count) || fromJSON(steps.filter.outputs.ci_count) > 0 }}
3434
steps:
35-
- uses: actions/checkout@v6
35+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
36+
with:
37+
persist-credentials: false
3638
# Use this action, rather than a file filter so that we can make this
3739
# mandatory.
3840
# See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-including-branches
@@ -61,7 +63,9 @@ jobs:
6163
matrix:
6264
java: [11, 17, 21, 25, 26]
6365
steps:
64-
- uses: actions/checkout@v4
66+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
67+
with:
68+
persist-credentials: false
6569
if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
6670
- if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
6771
uses: ./.github/actions/setup-java-cached
@@ -79,7 +83,9 @@ jobs:
7983
needs: bulk-filter
8084
name: "units (8)"
8185
steps:
82-
- uses: actions/checkout@v4
86+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
87+
with:
88+
persist-credentials: false
8389
if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
8490
- if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
8591
uses: ./.github/actions/setup-java-cached
@@ -111,7 +117,9 @@ jobs:
111117
outputs:
112118
packages: ${{ steps.filter.outputs.changes }}
113119
steps:
114-
- uses: actions/checkout@v6
120+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
121+
with:
122+
persist-credentials: false
115123
- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
116124
id: filter
117125
with:
@@ -206,7 +214,9 @@ jobs:
206214
package: ${{ fromJSON(needs.changes.outputs.packages) }}
207215
java: [11, 17, 21, 25, 26]
208216
steps:
209-
- uses: actions/checkout@v4
217+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
218+
with:
219+
persist-credentials: false
210220
- uses: ./.github/actions/setup-java-cached
211221
with:
212222
java-version: ${{matrix.java}}
@@ -234,7 +244,9 @@ jobs:
234244
package: ${{ fromJSON(needs.changes.outputs.packages) }}
235245
java: [8]
236246
steps:
237-
- uses: actions/checkout@v4
247+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
248+
with:
249+
persist-credentials: false
238250
- uses: ./.github/actions/setup-java-cached
239251
with:
240252
java-version: 11
@@ -289,7 +301,9 @@ jobs:
289301
matrix:
290302
package: ${{ fromJSON(needs.changes.outputs.packages) }}
291303
steps:
292-
- uses: actions/checkout@v4
304+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
305+
with:
306+
persist-credentials: false
293307
- uses: ./.github/actions/setup-java-cached
294308
with:
295309
java-version: 11
@@ -314,7 +328,9 @@ jobs:
314328
matrix:
315329
package: ${{ fromJSON(needs.changes.outputs.packages) }}
316330
steps:
317-
- uses: actions/checkout@v4
331+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
332+
with:
333+
persist-credentials: false
318334
- uses: ./.github/actions/setup-java-cached
319335
with:
320336
java-version: 17
@@ -348,7 +364,9 @@ jobs:
348364
steps:
349365
- name: Support longpaths
350366
run: git config --system core.longpaths true
351-
- uses: actions/checkout@v4
367+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
368+
with:
369+
persist-credentials: false
352370
- uses: ./.github/actions/setup-java-cached
353371
with:
354372
java-version: 11
@@ -362,8 +380,9 @@ jobs:
362380
if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
363381
runs-on: ubuntu-latest
364382
steps:
365-
- uses: actions/checkout@v4
383+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
366384
with:
385+
persist-credentials: false
367386
fetch-depth: 0
368387
- uses: ./.github/actions/setup-java-cached
369388
with:
@@ -379,7 +398,9 @@ jobs:
379398
if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
380399
runs-on: ubuntu-latest
381400
steps:
382-
- uses: actions/checkout@v4
401+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
402+
with:
403+
persist-credentials: false
383404
- uses: ./.github/actions/setup-java-cached
384405
with:
385406
java-version: 11
@@ -395,7 +416,9 @@ jobs:
395416
if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
396417
runs-on: ubuntu-latest
397418
steps:
398-
- uses: actions/checkout@v4
419+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
420+
with:
421+
persist-credentials: false
399422
- uses: ./.github/actions/setup-java-cached
400423
with:
401424
java-version: 11

‎.github/workflows/java-bigtable-ci.yaml‎

Lines changed: 39 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,14 @@ on:
1919
- main
2020
pull_request:
2121
name: java-bigtable ci
22+
permissions:
23+
contents: read
24+
25+
on:
26+
push:
27+
branches:
28+
- main
29+
pull_request:
2230
env:
2331
BUILD_SUBDIR: java-bigtable
2432
jobs:
@@ -27,7 +35,9 @@ jobs:
2735
outputs:
2836
library: ${{ steps.filter.outputs.library }}
2937
steps:
30-
- uses: actions/checkout@v4
38+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
39+
with:
40+
persist-credentials: false
3141
- uses: dorny/paths-filter@v3
3242
id: filter
3343
with:
@@ -43,8 +53,10 @@ jobs:
4353
matrix:
4454
java: [11, 17, 21, 25, 26]
4555
steps:
46-
- uses: actions/checkout@v4
47-
- uses: actions/setup-java@v4
56+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
57+
with:
58+
persist-credentials: false
59+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
4860
with:
4961
distribution: temurin
5062
java-version: ${{matrix.java}}
@@ -59,8 +71,10 @@ jobs:
5971
name: "units (8)"
6072
runs-on: ubuntu-latest
6173
steps:
62-
- uses: actions/checkout@v4
63-
- uses: actions/setup-java@v4
74+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
75+
with:
76+
persist-credentials: false
77+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
6478
with:
6579
java-version: 11
6680
distribution: temurin
@@ -69,7 +83,7 @@ jobs:
6983
# https://maven.apache.org/surefire/maven-surefire-plugin/test-mojo.html#jvm
7084
run: echo "SUREFIRE_JVM_OPT=-Djvm=${JAVA_HOME}/bin/java -P !java17" >> $GITHUB_ENV
7185
shell: bash
72-
- uses: actions/setup-java@v4
86+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
7387
with:
7488
java-version: 17
7589
distribution: temurin
@@ -83,8 +97,10 @@ jobs:
8397
steps:
8498
- name: Support longpaths
8599
run: git config --system core.longpaths true
86-
- uses: actions/checkout@v4
87-
- uses: actions/setup-java@v4
100+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
101+
with:
102+
persist-credentials: false
103+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
88104
with:
89105
distribution: temurin
90106
java-version: 11
@@ -100,8 +116,10 @@ jobs:
100116
matrix:
101117
java: [17]
102118
steps:
103-
- uses: actions/checkout@v4
104-
- uses: actions/setup-java@v4
119+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
120+
with:
121+
persist-credentials: false
122+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
105123
with:
106124
distribution: temurin
107125
java-version: ${{matrix.java}}
@@ -112,8 +130,10 @@ jobs:
112130
if: ${{ needs.filter.outputs.library == 'true' }}
113131
runs-on: ubuntu-latest
114132
steps:
115-
- uses: actions/checkout@v4
116-
- uses: actions/setup-java@v4
133+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
134+
with:
135+
persist-credentials: false
136+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
117137
with:
118138
distribution: temurin
119139
java-version: 17
@@ -126,10 +146,11 @@ jobs:
126146
if: ${{ needs.filter.outputs.library == 'true' }}
127147
runs-on: ubuntu-latest
128148
steps:
129-
- uses: actions/checkout@v4
149+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
130150
with:
151+
persist-credentials: false
131152
fetch-depth: 0
132-
- uses: actions/setup-java@v4
153+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
133154
with:
134155
distribution: temurin
135156
java-version: 17
@@ -144,8 +165,10 @@ jobs:
144165
if: ${{ needs.filter.outputs.library == 'true' }}
145166
runs-on: ubuntu-latest
146167
steps:
147-
- uses: actions/checkout@v4
148-
- uses: actions/setup-java@v4
168+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
169+
with:
170+
persist-credentials: false
171+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
149172
with:
150173
distribution: temurin
151174
java-version: 11

‎.github/workflows/java-bigtable-conformance.yaml‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,14 @@ on:
1919
- main
2020
pull_request:
2121
name: java-bigtable conformance
22+
permissions:
23+
contents: read
24+
25+
on:
26+
push:
27+
branches:
28+
- main
29+
pull_request:
2230
env:
2331
BUILD_SUBDIR: java-bigtable
2432
jobs:
@@ -27,7 +35,9 @@ jobs:
2735
outputs:
2836
library: ${{ steps.filter.outputs.library }}
2937
steps:
30-
- uses: actions/checkout@v4
38+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
39+
with:
40+
persist-credentials: false
3141
- uses: dorny/paths-filter@v3
3242
id: filter
3343
with:
@@ -39,13 +49,16 @@ jobs:
3949
if: ${{ needs.filter.outputs.library == 'true' }}
4050
runs-on: ubuntu-latest
4151
steps:
42-
- uses: actions/checkout@v4
43-
- uses: actions/checkout@v4
52+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
53+
with:
54+
persist-credentials: false
55+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4456
with:
57+
persist-credentials: false
4558
repository: googleapis/cloud-bigtable-clients-test
4659
ref: main
4760
path: cloud-bigtable-clients-test
48-
- uses: actions/setup-java@v4
61+
- uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
4962
with:
5063
distribution: zulu
5164
java-version: 11

0 commit comments

Comments
 (0)