Skip to content

Commit 13a8e2e

Browse files
dduuggdduugg
authored
Update GitHub Actions, add zizmor security linter, and configure Dependabot (#16)
* Update GitHub Actions to latest major versions - actions/checkout v4 → v6 - slackapi/slack-github-action v1 → v3 (migrate to new input API) - actions/stale v9 → v10 * Add zizmor GitHub Actions security linter - Add zizmor workflow as a PR check - Add persist-credentials: false to all checkout steps - Add .zizmor.yml config to disable unpinned-uses and secrets-outside-env (intentional for reusable workflows) - Add inline ignores for template-injection on trusted workflow_call inputs and step outputs * Fix zizmor-action version to v0.5.3 No v0 major version tag exists; pin to latest point release. * Add Dependabot config for GitHub Actions updates * Pass .zizmor.yml config to zizmor-action Without this, the action runs with default settings and reports unpinned-uses findings that we've intentionally disabled. * Pin all actions to SHA hashes and remove blanket zizmor disables Replace tag references with SHA-pinned references for all actions. Replace blanket unpinned-uses and secrets-outside-env disables with targeted inline ignores where appropriate. Remove .zizmor.yml since no global rule overrides are needed. * Clean up zizmor workflow style to match other workflows * Expand README with workflow documentation and usage examples
1 parent 5254cec commit 13a8e2e

6 files changed

Lines changed: 123 additions & 27 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: monthly
7+
cooldown:
8+
default-days: 7

‎.github/workflows/cd.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,35 +3,35 @@ name: CD
33
on:
44
workflow_call:
55
jobs:
6-
deploy:
6+
deploy: # zizmor: ignore[secrets-outside-env] reusable workflow; environments are managed by callers
77
runs-on: ubuntu-latest
88
if: ${{ github.event.workflow_run.conclusion == 'success' }}
99
steps:
10-
- uses: actions/checkout@v4
10+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
11+
with:
12+
persist-credentials: false
1113
- name: Tag and Push Gem
1214
id: tag-and-push-gem
13-
uses: discourse/publish-rubygems-action@v3
15+
uses: discourse/publish-rubygems-action@4bd305c65315cb691bad1e8de97a87aaf29a0a85 # v3
1416
env:
1517
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
1618
GIT_EMAIL: ${{secrets.GUSTO_GIT_EMAIL}}
1719
GIT_NAME: ${{secrets.GUSTO_GIT_NAME}}
1820
RUBYGEMS_API_KEY: ${{secrets.RUBYGEMS_API_KEY}}
1921
- name: Create GitHub Release
22+
# zizmor: ignore[template-injection] gem_version comes from a trusted prior step
2023
run: gh release create v${{steps.tag-and-push-gem.outputs.gem_version}} --generate-notes
2124
if: ${{ steps.tag-and-push-gem.outputs.new_version == 'true' }}
2225
env:
2326
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
24-
notify_on_failure:
27+
notify_on_failure: # zizmor: ignore[secrets-outside-env] reusable workflow; environments are managed by callers
2528
runs-on: ubuntu-latest
2629
needs: [deploy]
2730
if: ${{ failure() && github.ref == 'refs/heads/main' }}
28-
env:
29-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
30-
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
3131
steps:
32-
- uses: slackapi/slack-github-action@v1.25.0
32+
- uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3
3333
with:
34+
webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
35+
webhook-type: incoming-webhook
3436
payload: |
35-
{
36-
"text": "${{ github.repository }}/${{ github.ref }}: FAILED\n${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
37-
}
37+
text: "${{ github.repository }}/${{ github.ref }}: FAILED\n${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

‎.github/workflows/ci.yml‎

Lines changed: 19 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,28 @@ jobs:
2727
BUNDLE_GEMFILE: Gemfile
2828
name: "Run tests: Ruby ${{ matrix.ruby }}"
2929
steps:
30-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
31+
with:
32+
persist-credentials: false
3133
- name: Install ripgrep
3234
run: sudo apt-get install -y ripgrep
3335
- name: Set up Ruby ${{ matrix.ruby }}
34-
uses: ruby/setup-ruby@v1
36+
uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1
3537
with:
3638
bundler-cache: true
3739
ruby-version: ${{ matrix.ruby }}
3840
- name: Run tests
41+
# zizmor: ignore[template-injection] workflow_call inputs are controlled by the caller
3942
run: ${{ inputs.test-command }}
4043
static_type_check:
4144
name: "Type Check"
4245
runs-on: ubuntu-latest
4346
steps:
44-
- uses: actions/checkout@v4
47+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
48+
with:
49+
persist-credentials: false
4550
- name: Set up Ruby
46-
uses: ruby/setup-ruby@v1
51+
uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1
4752
with:
4853
bundler-cache: true
4954
ruby-version: 3.4
@@ -53,25 +58,25 @@ jobs:
5358
runs-on: ubuntu-latest
5459
name: "Linter"
5560
steps:
56-
- uses: actions/checkout@v4
61+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
62+
with:
63+
persist-credentials: false
5764
- name: Set up Ruby
58-
uses: ruby/setup-ruby@v1
65+
uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1
5966
with:
6067
bundler-cache: true
6168
ruby-version: 3.4
6269
- name: Run linter
70+
# zizmor: ignore[template-injection] workflow_call inputs are controlled by the caller
6371
run: ${{ inputs.linter-command }}
64-
notify_on_failure:
72+
notify_on_failure: # zizmor: ignore[secrets-outside-env] reusable workflow; environments are managed by callers
6573
runs-on: ubuntu-latest
6674
needs: [run_tests, static_type_check, run_linter]
6775
if: ${{ failure() && github.ref == 'refs/heads/main' }}
68-
env:
69-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
70-
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
7176
steps:
72-
- uses: slackapi/slack-github-action@v1.25.0
77+
- uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3
7378
with:
79+
webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
80+
webhook-type: incoming-webhook
7481
payload: |
75-
{
76-
"text": "${{ github.repository }}/${{ github.ref }}: FAILED\n${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
77-
}
82+
text: "${{ github.repository }}/${{ github.ref }}: FAILED\n${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

‎.github/workflows/stale.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
stale:
77
runs-on: ubuntu-latest
88
steps:
9-
- uses: actions/stale@v9
9+
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
1010
with:
1111
stale-issue-message: 'This issue has been marked stale because it has been open for six months with no activity. To prevent this issue from automatically being closed in one week, update it or remove the stale label.'
1212
stale-pr-message: 'This PR has been marked stale because it has been open for six months with no activity. To prevent this PR from automatically being closed in one week, update it or remove the stale label.'

‎.github/workflows/zizmor.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: GitHub Actions Security Analysis
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions: {}
10+
11+
jobs:
12+
zizmor:
13+
runs-on: ubuntu-latest
14+
permissions:
15+
security-events: write
16+
contents: read
17+
actions: read
18+
steps:
19+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
20+
with:
21+
persist-credentials: false
22+
- name: Run zizmor
23+
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

‎README.md‎

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,61 @@
1-
# shared-config
1+
# shared-config
2+
3+
Shared reusable GitHub Actions workflows for [rubyatscale](https://github.com/rubyatscale) gems.
4+
5+
## Workflows
6+
7+
### Reusable workflows (`workflow_call`)
8+
9+
These workflows are called from individual gem repos via `uses: rubyatscale/shared-config/.github/workflows/<name>.yml@main`.
10+
11+
| Workflow | Description |
12+
|----------|-------------|
13+
| **CI** (`ci.yml`) | Runs tests across Ruby 3.2–4.0, Sorbet type checking, and linting (RuboCop). Test and linter commands are configurable via inputs. |
14+
| **CD** (`cd.yml`) | Publishes the gem to RubyGems and creates a GitHub Release on successful main builds. |
15+
| **Stale** (`stale.yml`) | Marks issues and PRs as stale after 180 days of inactivity, then closes them after 7 more days. |
16+
| **Triage** (`triage.yml`) | Labels new issues with `triage`. |
17+
18+
### Repository workflows
19+
20+
| Workflow | Description |
21+
|----------|-------------|
22+
| **zizmor** (`zizmor.yml`) | Runs the [zizmor](https://github.com/zizmorcore/zizmor) security linter against all workflow files on every push and PR. |
23+
24+
## Usage
25+
26+
In a gem repo, create a workflow that calls the shared workflow:
27+
28+
```yaml
29+
# .github/workflows/ci.yml
30+
name: CI
31+
32+
on:
33+
push:
34+
branches: [main]
35+
pull_request:
36+
37+
jobs:
38+
ci:
39+
uses: rubyatscale/shared-config/.github/workflows/ci.yml@main
40+
```
41+
42+
### CI inputs
43+
44+
| Input | Default | Description |
45+
|-------|---------|-------------|
46+
| `test-command` | `bundle exec rspec` | Command to run tests |
47+
| `linter-command` | `bundle exec rubocop` | Command to run the linter |
48+
49+
### Required secrets
50+
51+
The **CD** workflow requires the following secrets in the calling repo:
52+
53+
- `GUSTO_GIT_EMAIL` / `GUSTO_GIT_NAME` — Git identity for tagging
54+
- `RUBYGEMS_API_KEY` — API key for publishing to RubyGems
55+
- `SLACK_WEBHOOK_URL` — Incoming webhook URL for failure notifications (used by both CI and CD)
56+
57+
## Security
58+
59+
- All action references are pinned to SHA hashes
60+
- [zizmor](https://github.com/zizmorcore/zizmor) runs on every PR to lint workflows for security issues
61+
- [Dependabot](https://docs.github.com/en/code-security/dependabot) is configured for monthly GitHub Actions updates

0 commit comments

Comments
 (0)