You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pekko.apache.org by en...@apache.org on 2025/10/10 15:28:40 UTC
(pekko) branch main updated: chore: harden GHA (#2311)
This is an automated email from the ASF dual-hosted git repository.
engelen pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pekko.git
The following commit(s) were added to refs/heads/main by this push:
new 8bcc69691b chore: harden GHA (#2311)
8bcc69691b is described below
commit 8bcc69691bed94d40e90f7fd104241252ff17ede
Author: Arnout Engelen <ar...@bzzt.net>
AuthorDate: Fri Oct 10 17:28:34 2025 +0200
chore: harden GHA (#2311)
apply zizmor suggestions. I don't think there's anything severe here, so
no need to backport.
---
.github/workflows/binary-compatibility-checks.yml | 1 +
.github/workflows/build-test-prValidation.yml | 4 ++++
.github/workflows/dependency-graph.yml | 2 ++
.github/workflows/generate-doc-check.yml | 1 +
.github/workflows/headers.yml | 2 ++
.github/workflows/link-validator.yml | 2 ++
.github/workflows/nightly-1.0-builds.yml | 3 +++
.github/workflows/nightly-1.1-builds.yml | 3 +++
.github/workflows/nightly-1.2-builds.yml | 3 +++
.github/workflows/nightly-1.3-builds.yml | 3 +++
.github/workflows/nightly-builds-aeron.yml | 1 +
.github/workflows/nightly-builds.yml | 3 +++
.github/workflows/publish-1.0-docs.yml | 1 +
.github/workflows/publish-1.0-nightly.yml | 1 +
.github/workflows/publish-1.1-docs.yml | 1 +
.github/workflows/publish-1.1-nightly.yml | 1 +
.github/workflows/publish-1.2-docs.yml | 1 +
.github/workflows/publish-1.2-nightly.yml | 1 +
.github/workflows/publish-1.3-nightly.yml | 1 +
.github/workflows/publish-nightly.yml | 11 +++++++----
.github/workflows/scala3-build.yml | 1 +
.github/workflows/timing-tests.yml | 1 +
22 files changed, 44 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/binary-compatibility-checks.yml b/.github/workflows/binary-compatibility-checks.yml
index 1e8284530e..5748bf71db 100644
--- a/.github/workflows/binary-compatibility-checks.yml
+++ b/.github/workflows/binary-compatibility-checks.yml
@@ -43,6 +43,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: 0
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
diff --git a/.github/workflows/build-test-prValidation.yml b/.github/workflows/build-test-prValidation.yml
index 68eb131313..67342c26da 100644
--- a/.github/workflows/build-test-prValidation.yml
+++ b/.github/workflows/build-test-prValidation.yml
@@ -31,6 +31,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Cache Coursier cache
uses: coursier/cache-action@4e2615869d13561d626ed48655e1a39e5b192b3c # 6.4.7
@@ -63,6 +64,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: 0
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
@@ -126,6 +128,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
@@ -169,6 +172,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: 0
+ persist-credentials: false
- name: Setup Java 21
uses: actions/setup-java@v5
diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml
index d3fa384388..8db81869da 100644
--- a/.github/workflows/dependency-graph.yml
+++ b/.github/workflows/dependency-graph.yml
@@ -34,6 +34,8 @@ jobs:
contents: write
steps:
- uses: actions/checkout@v5
+ with:
+ persist-credentials: false
- name: Install sbt
uses: sbt/setup-sbt@3e125ece5c3e5248e18da9ed8d2cce3d335ec8dd # v1.1.14
- uses: scalacenter/sbt-dependency-submission@64084844d2b0a9b6c3765f33acde2fbe3f5ae7d3 # v3.1.0
diff --git a/.github/workflows/generate-doc-check.yml b/.github/workflows/generate-doc-check.yml
index 339ca09022..370b78f378 100644
--- a/.github/workflows/generate-doc-check.yml
+++ b/.github/workflows/generate-doc-check.yml
@@ -34,6 +34,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
diff --git a/.github/workflows/headers.yml b/.github/workflows/headers.yml
index df362d375e..6847e3b9ee 100644
--- a/.github/workflows/headers.yml
+++ b/.github/workflows/headers.yml
@@ -29,6 +29,8 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v5
+ with:
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
diff --git a/.github/workflows/link-validator.yml b/.github/workflows/link-validator.yml
index 234390f360..a1cb751b6a 100644
--- a/.github/workflows/link-validator.yml
+++ b/.github/workflows/link-validator.yml
@@ -22,6 +22,8 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v5
+ with:
+ persist-credentials: false
- name: Checkout GitHub merge
if: github.event.pull_request
diff --git a/.github/workflows/nightly-1.0-builds.yml b/.github/workflows/nightly-1.0-builds.yml
index cb32658f8c..8062c44d24 100644
--- a/.github/workflows/nightly-1.0-builds.yml
+++ b/.github/workflows/nightly-1.0-builds.yml
@@ -25,6 +25,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.0.x
- name: Setup Java 11
@@ -79,6 +80,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.0.x
- name: Setup Java 11
@@ -129,6 +131,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.0.x
- name: Setup Java ${{ matrix.javaVersion }}
diff --git a/.github/workflows/nightly-1.1-builds.yml b/.github/workflows/nightly-1.1-builds.yml
index 914423cb46..ae82a265fb 100644
--- a/.github/workflows/nightly-1.1-builds.yml
+++ b/.github/workflows/nightly-1.1-builds.yml
@@ -25,6 +25,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.1.x
- name: Setup Java 11
@@ -80,6 +81,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.1.x
- name: Setup Java 11
@@ -131,6 +133,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.1.x
- name: Setup Java ${{ matrix.javaVersion }}
diff --git a/.github/workflows/nightly-1.2-builds.yml b/.github/workflows/nightly-1.2-builds.yml
index 02bd209c38..02a1df431e 100644
--- a/.github/workflows/nightly-1.2-builds.yml
+++ b/.github/workflows/nightly-1.2-builds.yml
@@ -25,6 +25,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.2.x
- name: Setup Java 11
@@ -80,6 +81,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.2.x
- name: Setup Java 11
@@ -131,6 +133,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.2.x
- name: Setup Java ${{ matrix.javaVersion }}
diff --git a/.github/workflows/nightly-1.3-builds.yml b/.github/workflows/nightly-1.3-builds.yml
index 5014130995..c7453063a4 100644
--- a/.github/workflows/nightly-1.3-builds.yml
+++ b/.github/workflows/nightly-1.3-builds.yml
@@ -26,6 +26,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.3.x
- name: Setup Java 11
@@ -81,6 +82,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.3.x
- name: Setup Java 11
@@ -132,6 +134,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.3.x
- name: Setup Java ${{ matrix.javaVersion }}
diff --git a/.github/workflows/nightly-builds-aeron.yml b/.github/workflows/nightly-builds-aeron.yml
index 95db1b602c..2dd7a26ab3 100644
--- a/.github/workflows/nightly-builds-aeron.yml
+++ b/.github/workflows/nightly-builds-aeron.yml
@@ -34,6 +34,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
diff --git a/.github/workflows/nightly-builds.yml b/.github/workflows/nightly-builds.yml
index 81312ede13..86b0473f04 100644
--- a/.github/workflows/nightly-builds.yml
+++ b/.github/workflows/nightly-builds.yml
@@ -18,6 +18,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
@@ -72,6 +73,7 @@ jobs:
# we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
@@ -124,6 +126,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java ${{ matrix.javaVersion }}
uses: actions/setup-java@v5
diff --git a/.github/workflows/publish-1.0-docs.yml b/.github/workflows/publish-1.0-docs.yml
index a59737724c..56b5675ec9 100644
--- a/.github/workflows/publish-1.0-docs.yml
+++ b/.github/workflows/publish-1.0-docs.yml
@@ -37,6 +37,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.0.x
- name: Setup Java 11
diff --git a/.github/workflows/publish-1.0-nightly.yml b/.github/workflows/publish-1.0-nightly.yml
index 7dbd6e882d..ba56707bd4 100644
--- a/.github/workflows/publish-1.0-nightly.yml
+++ b/.github/workflows/publish-1.0-nightly.yml
@@ -39,6 +39,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.0.x
- name: Setup Java 11
diff --git a/.github/workflows/publish-1.1-docs.yml b/.github/workflows/publish-1.1-docs.yml
index 5963b5341a..2e201a4d79 100644
--- a/.github/workflows/publish-1.1-docs.yml
+++ b/.github/workflows/publish-1.1-docs.yml
@@ -37,6 +37,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.1.x
- name: Setup Java 11
diff --git a/.github/workflows/publish-1.1-nightly.yml b/.github/workflows/publish-1.1-nightly.yml
index fa0f99b5d7..8912213bfb 100644
--- a/.github/workflows/publish-1.1-nightly.yml
+++ b/.github/workflows/publish-1.1-nightly.yml
@@ -39,6 +39,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.1.x
- name: Setup Java 11
diff --git a/.github/workflows/publish-1.2-docs.yml b/.github/workflows/publish-1.2-docs.yml
index cd60b89ecd..660f6b2710 100644
--- a/.github/workflows/publish-1.2-docs.yml
+++ b/.github/workflows/publish-1.2-docs.yml
@@ -37,6 +37,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.2.x
- name: Setup Java 11
diff --git a/.github/workflows/publish-1.2-nightly.yml b/.github/workflows/publish-1.2-nightly.yml
index 8d22c2e964..4702241029 100644
--- a/.github/workflows/publish-1.2-nightly.yml
+++ b/.github/workflows/publish-1.2-nightly.yml
@@ -39,6 +39,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.2.x
- name: Setup Java 11
diff --git a/.github/workflows/publish-1.3-nightly.yml b/.github/workflows/publish-1.3-nightly.yml
index 3b29d70345..02677533d9 100644
--- a/.github/workflows/publish-1.3-nightly.yml
+++ b/.github/workflows/publish-1.3-nightly.yml
@@ -40,6 +40,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
ref: 1.3.x
- name: Setup Java 11
diff --git a/.github/workflows/publish-nightly.yml b/.github/workflows/publish-nightly.yml
index 803c489d23..1a5a23da51 100644
--- a/.github/workflows/publish-nightly.yml
+++ b/.github/workflows/publish-nightly.yml
@@ -40,6 +40,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
@@ -74,10 +75,12 @@ jobs:
# Create directory structure upfront since rsync does not create intermediate directories otherwise
- name: Create nightly directory structure
run: |-
- mkdir -p target/nightly-docs/docs/pekko/${{ github.ref_name }}-snapshot/
- mv docs/target/paradox/site/main/ target/nightly-docs/docs/pekko/${{ github.ref_name }}-snapshot/docs
- mv target/scala-2.13/unidoc target/nightly-docs/docs/pekko/${{ github.ref_name }}-snapshot/api
- mv target/javaunidoc target/nightly-docs/docs/pekko/${{ github.ref_name }}-snapshot/japi
+ mkdir -p target/nightly-docs/docs/pekko/$REF-snapshot/
+ mv docs/target/paradox/site/main/ target/nightly-docs/docs/pekko/$REF-snapshot/docs
+ mv target/scala-2.13/unidoc target/nightly-docs/docs/pekko/$REF-snapshot/api
+ mv target/javaunidoc target/nightly-docs/docs/pekko/$REF-snapshot/japi
+ env:
+ REF: ${{ github.ref_name }}
- name: Upload nightly docs
uses: ./.github/actions/sync-nightlies
diff --git a/.github/workflows/scala3-build.yml b/.github/workflows/scala3-build.yml
index 1143adba90..b7cf642cad 100644
--- a/.github/workflows/scala3-build.yml
+++ b/.github/workflows/scala3-build.yml
@@ -43,6 +43,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
diff --git a/.github/workflows/timing-tests.yml b/.github/workflows/timing-tests.yml
index 599fd78f47..1ecc4d6e3f 100644
--- a/.github/workflows/timing-tests.yml
+++ b/.github/workflows/timing-tests.yml
@@ -28,6 +28,7 @@ jobs:
with:
fetch-depth: 0
fetch-tags: true
+ persist-credentials: false
- name: Setup Java 17
uses: actions/setup-java@v5
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pekko.apache.org
For additional commands, e-mail: commits-help@pekko.apache.org