From c8a61ae2882e3dd70767f5fcb004faae96446ab6 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Fri, 21 Aug 2026 13:54:37 +0200 Subject: [PATCH 1/2] ci: pin GitHub Actions to current stable SHAs --- .github/workflows/build.yml | 26 +++++++++++++------------- .github/workflows/docs.yml | 14 ++++++++------ .github/workflows/labels.yml | 15 ++++++++------- .github/workflows/released.yml | 8 +++----- .github/workflows/zizmor.yml | 26 ++++++++++++++++++++++++++ 5 files changed, 58 insertions(+), 31 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 26c30a16..ae17898e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,18 +1,19 @@ name: build -# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read on: - pull_request: - branches: - - 'master' push: branches: - 'master' tags: - '*.*.*' + pull_request: env: VERSION: "0.0.0" @@ -21,8 +22,7 @@ jobs: release: runs-on: windows-latest permissions: - # required to create GitHub release - contents: write + contents: write # required to create GitHub release steps: - name: Prepare @@ -33,28 +33,28 @@ jobs: shell: bash - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@v3 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: 1.19 cache: true - name: Mage build - uses: magefile/mage-action@v2 + uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0 with: version: latest args: build - name: Mage chocoPack - uses: magefile/mage-action@v2 + uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0 with: version: latest args: chocoPack - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: WindowsSpyBlocker path: | @@ -62,7 +62,7 @@ jobs: bin/windowsspyblocker.${{ env.VERSION }}.nupkg - name: GitHub Release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 if: startsWith(github.ref, 'refs/tags/') with: draft: true @@ -72,7 +72,7 @@ jobs: name: ${{ env.VERSION }} - name: Mage chocoPush - uses: magefile/mage-action@v2 + uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4.0.0 if: startsWith(github.ref, 'refs/tags/') env: CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }} diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 5b36bfff..ae262615 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -1,6 +1,9 @@ name: docs -# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read @@ -25,12 +28,11 @@ jobs: publish: runs-on: ubuntu-latest permissions: - # required to push to gh-pages - contents: write + contents: write # required to push to gh-pages steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - @@ -57,13 +59,13 @@ jobs: sudo chown -R $(id -u):$(id -g) ./site - name: Check GitHub Pages status - uses: crazy-max/ghaction-github-status@v3 + uses: crazy-max/ghaction-github-status@f0ef9e1cf727f9f76f8485f8c525fa03afc4ec02 # v5.0.0 with: pages_threshold: major_outage - name: Deploy if: github.event_name != 'pull_request' && (endsWith(github.ref, github.event.repository.default_branch) || env.RELEASE == 'true') - uses: crazy-max/ghaction-github-pages@v3 + uses: crazy-max/ghaction-github-pages@1d6ee9b181a81033a16bd707a1401afa978daab4 # v5.0.0 with: target_branch: gh-pages build_dir: site diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c49a6173..d2157b9b 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,6 +1,9 @@ name: labels -# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read @@ -20,16 +23,14 @@ jobs: labeler: runs-on: ubuntu-latest permissions: - # same as global permissions - contents: read - # required to update labels - issues: write + contents: read # same as global permissions + issues: write # required to update labels steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run Labeler - uses: crazy-max/ghaction-github-labeler@v5 + uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0 with: dry-run: ${{ github.event_name == 'pull_request' }} diff --git a/.github/workflows/released.yml b/.github/workflows/released.yml index 18b2a178..98dc9c1b 100644 --- a/.github/workflows/released.yml +++ b/.github/workflows/released.yml @@ -1,6 +1,5 @@ name: released -# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions permissions: contents: read @@ -13,12 +12,11 @@ jobs: virustotal: runs-on: ubuntu-latest permissions: - # required to write GitHub Release body - contents: write + contents: write # required to write GitHub Release body steps: - name: VirusTotal Monitor Scan - uses: crazy-max/ghaction-virustotal@v4 + uses: crazy-max/ghaction-virustotal@936d8c5c00afe97d3d9a1af26d017cfdf26800a2 # v5.0.0 with: vt_api_key: ${{ secrets.VT_MONITOR_API_KEY }} vt_monitor: true @@ -28,7 +26,7 @@ jobs: WindowsSpyBlocker.exe - name: VirusTotal Scan - uses: crazy-max/ghaction-virustotal@v4 + uses: crazy-max/ghaction-virustotal@936d8c5c00afe97d3d9a1af26d017cfdf26800a2 # v5.0.0 with: vt_api_key: ${{ secrets.VT_API_KEY }} update_release_body: true diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..09388bca --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,26 @@ +name: zizmor + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +on: + workflow_dispatch: + push: + branches: + - 'master' + pull_request: + +jobs: + run: + uses: crazy-max/.github/.github/workflows/zizmor.yml@f91220cba053bd54299ba645a599ee8ed436f222 # v1.11.0 + permissions: + contents: read + security-events: write + with: + min-severity: medium + min-confidence: medium + persona: pedantic From 6c823428d587527e796fa228eb381e7ed9c20953 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Fri, 21 Aug 2026 14:07:01 +0200 Subject: [PATCH 2/2] fix zizmor findings --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6123ee36..181e54f9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,8 @@ updates: directory: "/" schedule: interval: "daily" + cooldown: + default-days: 7 labels: - ":game_die: dependencies" - ":robot: bot" @@ -11,6 +13,8 @@ updates: directory: "/" schedule: interval: "daily" + cooldown: + default-days: 7 labels: - ":game_die: dependencies" - ":robot: bot"