Oh hello there zizmor.

crate-py · Nov 6, 2024 · 32c53dc · 32c53dc
1 parent da707ab
commit 32c53dc
Show file tree

Hide file tree

Showing 4 changed files with 57 additions and 0 deletions.
diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
@@ -21,6  21,8 @@ jobs:
       noxenvs: ${{ steps.noxenvs-matrix.outputs.noxenvs }}
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - name: Set up nox
         uses: wntrblm/[email protected]
       - id: noxenvs-matrix
@@ -40,6  42,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - name: Install dependencies
         run: sudo apt-get update && sudo apt-get install -y libenchant-2-dev
         if: runner.os == 'Linux' && startsWith(matrix.noxenv, 'docs')
@@ -75,6  79,8 @@ jobs:
         target: [x86_64, x86, aarch64, armv7, s390x, ppc64le]
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: |
@@ -110,6  116,8 @@ jobs:
           - x86_64-unknown-linux-musl
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: |
@@ -142,6  150,8 @@ jobs:
         target: [x64, x86] # x86 is not supported by pypy
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: |
@@ -174,6  184,8 @@ jobs:
         target: [x86_64, aarch64]
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: |
@@ -202,6  214,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: |

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -0,0  1,34 @@
 name: GitHub Actions Security Analysis with zizmor 🌈
 
 on:
   push:
     branches: ["main"]
   pull_request:
     branches: ["**"]
 
 jobs:
   zizmor:
     runs-on: ubuntu-latest
 
     permissions:
       security-events: write
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
       - name: Setup Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
       - name: Install zizmor
         run: cargo install zizmor
       - name: Run zizmor 🌈
         run: zizmor --format sarif . > results.sarif
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload SARIF file
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: results.sarif
           category: zizmor
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
@@ -0,0  1,5 @@
 rules:
   template-injection:
     ignore:
       # our matrix is dynamically generated via `nox -l` but with no user input
       - CI.yml:71:9
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -31,3  31,7 @@ repos:
     rev: "v4.0.0-alpha.8"
     hooks:
       - id: prettier
   - repo: https://github.com/woodruffw/zizmor
     rev: v0.1.6
     hooks:
       - id: zizmor