You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "lidavidm (via GitHub)" <gi...@apache.org> on 2026/04/27 02:11:58 UTC
[PR] ci: analyze workflows with zizmor [arrow-adbc]
lidavidm opened a new pull request, #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270
- Add cooldowns to dependabot.yml
- Pin actions
- Use environment variables instead of directly expanding variables into shell blocks
- Disable caching in `packaging.yml` since this builds binaries
- Add some missing `permissions` and `concurrency` blocks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "amoeba (via GitHub)" <gi...@apache.org>.
amoeba commented on code in PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270#discussion_r3151766186
##########
.github/workflows/packaging.yml:
##########
@@ -168,10 +171,12 @@ jobs:
- name: Show inputs
run: |
echo "upload_artifacts: ${{ inputs.upload_artifacts }}" >> $GITHUB_STEP_SUMMARY
- echo "schedule: ${{ github.event.schedule }}" >> $GITHUB_STEP_SUMMARY
- echo "ref: ${{ github.ref }}" >> $GITHUB_STEP_SUMMARY
+ echo "schedule: ${GITHUB_EVENT_SCHEDULE}" >> $GITHUB_STEP_SUMMARY
+ echo "ref: ${GITHUB_REF}" >> $GITHUB_STEP_SUMMARY
+ env:
+ GITHUB_EVENT_SCHEDULE: ${{ github.event.schedule }}
Review Comment:
ah, carry on!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on code in PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270#discussion_r3152503002
##########
.github/workflows/asf-allowlist-check.yml:
##########
@@ -28,15 +28,28 @@ on:
paths:
- ".github/**"
+concurrency:
+ group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
+ cancel-in-progress: true
+
permissions:
contents: read
jobs:
- asf-allowlist-check:
- runs-on: ubuntu-slim
+ gha:
+ name: "Analyze Actions"
+ runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
+
+ # Check that actions are pinned and on the ASF allowlist.
# Intentionally unpinned to always use the latest allowlist from the ASF.
- uses: apache/infrastructure-actions/allowlist-check@main # zizmor: ignore[unpinned-uses]
+
+ # Analyze workflows with Zizmor
+ - name: Run zizmor 🌈
+ uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
Review Comment:
Updated, I think I just copied from an old Iceberg PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270#issuecomment-4324439700
It appears the .NET error was already there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270#issuecomment-4323741889
There's some followup work, but I believe both of our `cmd.exe` blocks are safe (they use `cmd.exe` for `vcvarsall.bat` but presumably that can be done in PowerShell too): https://github.com/apache/arrow-adbc/issues/4269
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270#issuecomment-4324204191
I think I'll suppress `secrets-outside-env` for now. Many of those secrets will be removed soon once @amoeba finishes #4140.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270#issuecomment-4323743358
I'm following iceberg-cpp, which also uses CodeQL. I haven't setup CodeQL here.
https://github.com/apache/iceberg-cpp/pull/618/files#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm merged PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on code in PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270#discussion_r3151761025
##########
.github/workflows/packaging.yml:
##########
@@ -168,10 +171,12 @@ jobs:
- name: Show inputs
run: |
echo "upload_artifacts: ${{ inputs.upload_artifacts }}" >> $GITHUB_STEP_SUMMARY
- echo "schedule: ${{ github.event.schedule }}" >> $GITHUB_STEP_SUMMARY
- echo "ref: ${{ github.ref }}" >> $GITHUB_STEP_SUMMARY
+ echo "schedule: ${GITHUB_EVENT_SCHEDULE}" >> $GITHUB_STEP_SUMMARY
+ echo "ref: ${GITHUB_REF}" >> $GITHUB_STEP_SUMMARY
+ env:
+ GITHUB_EVENT_SCHEDULE: ${{ github.event.schedule }}
Review Comment:
(This is zizmor's autofix.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: analyze workflows with zizmor [arrow-adbc]
Posted by "amoeba (via GitHub)" <gi...@apache.org>.
amoeba commented on code in PR #4270:
URL: https://github.com/apache/arrow-adbc/pull/4270#discussion_r3151669095
##########
.github/workflows/asf-allowlist-check.yml:
##########
@@ -28,15 +28,28 @@ on:
paths:
- ".github/**"
+concurrency:
+ group: ${{ github.repository }}-${{ github.head_ref || github.sha }}-${{ github.workflow }}
+ cancel-in-progress: true
+
permissions:
contents: read
jobs:
- asf-allowlist-check:
- runs-on: ubuntu-slim
+ gha:
+ name: "Analyze Actions"
+ runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
+
+ # Check that actions are pinned and on the ASF allowlist.
# Intentionally unpinned to always use the latest allowlist from the ASF.
- uses: apache/infrastructure-actions/allowlist-check@main # zizmor: ignore[unpinned-uses]
+
+ # Analyze workflows with Zizmor
+ - name: Run zizmor 🌈
+ uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
Review Comment:
```suggestion
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
```
Any reason not to use the latest version here?
##########
.github/workflows/packaging.yml:
##########
@@ -223,8 +228,10 @@ jobs:
- name: Show inputs
run: |
echo "upload_artifacts: ${{ inputs.upload_artifacts }}" >> $GITHUB_STEP_SUMMARY
- echo "schedule: ${{ github.event.schedule }}" >> $GITHUB_STEP_SUMMARY
- echo "ref: ${{ github.ref }}" >> $GITHUB_STEP_SUMMARY
+ echo "schedule: ${GITHUB_EVENT_SCHEDULE}" >> $GITHUB_STEP_SUMMARY
+ echo "ref: ${GITHUB_REF}" >> $GITHUB_STEP_SUMMARY
+ env:
+ GITHUB_EVENT_SCHEDULE: ${{ github.event.schedule }}
Review Comment:
same nit
##########
.github/workflows/packaging.yml:
##########
@@ -168,10 +171,12 @@ jobs:
- name: Show inputs
run: |
echo "upload_artifacts: ${{ inputs.upload_artifacts }}" >> $GITHUB_STEP_SUMMARY
- echo "schedule: ${{ github.event.schedule }}" >> $GITHUB_STEP_SUMMARY
- echo "ref: ${{ github.ref }}" >> $GITHUB_STEP_SUMMARY
+ echo "schedule: ${GITHUB_EVENT_SCHEDULE}" >> $GITHUB_STEP_SUMMARY
+ echo "ref: ${GITHUB_REF}" >> $GITHUB_STEP_SUMMARY
+ env:
+ GITHUB_EVENT_SCHEDULE: ${{ github.event.schedule }}
Review Comment:
nit, maybe move `env` above `run` just for the benefit of reading order?
##########
.github/workflows/packaging.yml:
##########
@@ -332,8 +339,10 @@ jobs:
- name: Show inputs
run: |
echo "upload_artifacts: ${{ inputs.upload_artifacts }}" >> $GITHUB_STEP_SUMMARY
- echo "schedule: ${{ github.event.schedule }}" >> $GITHUB_STEP_SUMMARY
- echo "ref: ${{ github.ref }}" >> $GITHUB_STEP_SUMMARY
+ echo "schedule: ${GITHUB_EVENT_SCHEDULE}" >> $GITHUB_STEP_SUMMARY
+ echo "ref: ${GITHUB_REF}" >> $GITHUB_STEP_SUMMARY
+ env:
+ GITHUB_EVENT_SCHEDULE: ${{ github.event.schedule }}
Review Comment:
same nit. and more below.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org