From 69b9f9f43d8e51730dc9ac8462b81853f5fe619f Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:41:48 -0400 Subject: [PATCH 1/4] ci: pin GitHub Actions and enforce zizmor policy Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/actions.lock | 52 +++++++++++++++++++++++++++++++ .github/workflows/build.yml | 4 +-- .github/workflows/e2e.yml | 14 ++++----- .github/workflows/lint.yml | 4 +-- .github/workflows/publish.yml | 4 +-- .github/workflows/release.yml | 2 +- .github/workflows/renovate.yml | 4 ++- .github/workflows/test.yml | 4 +-- .github/workflows/triage.yml | 2 +- .github/workflows/visual-tray.yml | 32 +++++++++---------- .github/zizmor.yml | 6 ++++ 11 files changed, 94 insertions(+), 34 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 89c4c72..10ffe32 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -4,36 +4,55 @@ version: 'v0.0.3' workflows: '.github/workflows/build.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' + - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/e2e.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' - 'actions/download-artifact@v8.0.2' + - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'actions/upload-artifact@v7.0.2' + - 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1' - 'peter-evans/create-pull-request@v8.1.1' + - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/lint.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' + - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/publish.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' + - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/release.yml': + - 'googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7' - 'googleapis/release-please-action@v5.0.0' '.github/workflows/renovate.yml': [] '.github/workflows/test.yml': + - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' + - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/triage.yml': + - 'amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50' - 'amannn/action-semantic-pull-request@v6.1.1' '.github/workflows/visual-tray.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' - 'actions/download-artifact@v8.0.2' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'actions/upload-artifact@v7.0.2' + - 'awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9' - 'awalsh128/cache-apt-pkgs-action@v1.6.3' + - 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1' - 'peter-evans/create-pull-request@v8.1.1' + - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' dependencies: 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': @@ -51,6 +70,11 @@ dependencies: commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 + 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 'actions/download-artifact@v8.0.2': ref: 'v8.0.2' commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' @@ -71,11 +95,24 @@ dependencies: commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 + 'amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50': + ref: 'v6.1.1' + commit: 'sha1-48f256284bd46cdaab1048c3721360e808335d50' + owner_id: 4038316 + repo_id: 220418983 'amannn/action-semantic-pull-request@v6.1.1': ref: 'v6.1.1' commit: 'sha1-48f256284bd46cdaab1048c3721360e808335d50' owner_id: 4038316 repo_id: 220418983 + 'awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9': + ref: 'v1.6.3' + commit: 'sha1-553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9' + owner_id: 2087466 + repo_id: 408212054 + uses: + - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' + - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'awalsh128/cache-apt-pkgs-action@v1.6.3': ref: 'v1.6.3' commit: 'sha1-553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9' @@ -84,16 +121,31 @@ dependencies: uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' + 'googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7': + ref: 'v5.0.0' + commit: 'sha1-45996ed1f6d02564a971a2fa1b5860e934307cf7' + owner_id: 16785467 + repo_id: 262236530 'googleapis/release-please-action@v5.0.0': ref: 'v5.0.0' commit: 'sha1-45996ed1f6d02564a971a2fa1b5860e934307cf7' owner_id: 16785467 repo_id: 262236530 + 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1': + ref: 'v8.1.1' + commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1' + owner_id: 18365890 + repo_id: 197176365 'peter-evans/create-pull-request@v8.1.1': ref: 'v8.1.1' commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1' owner_id: 18365890 repo_id: 197176365 + 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e': + ref: 'v3.1.2' + commit: 'sha1-fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' + owner_id: 21320719 + repo_id: 1235693694 'pnpm/setup@v3.1.2': ref: 'v3.1.2' commit: 'sha1-fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 28077e3..11a8b02 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,11 +19,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@v3.1.2 + uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index e29d061..b6c4eac 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -47,11 +47,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@v3.1.2 + uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true @@ -89,7 +89,7 @@ jobs: run: pnpm exec playwright test --config tests/e2e/playwright.config.ts - name: Upload platform result if: always() - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: platform-${{ matrix.key }} path: test-results/platforms/${{ matrix.key }}.json @@ -106,17 +106,17 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@v3.1.2 + uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true install: false - name: Download all platform results - uses: actions/download-artifact@v8.0.2 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: platform-* merge-multiple: true @@ -128,7 +128,7 @@ jobs: pnpm install --frozen-lockfile --ignore-scripts pnpm exec oxfmt PLATFORMS.md - name: Open PR if changed - uses: peter-evans/create-pull-request@v8.1.1 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: commit-message: 'docs: refresh tested platforms table' title: 'docs: refresh tested platforms table' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 6691048..7f39c96 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -19,11 +19,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@v3.1.2 + uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 84e109a..852b196 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -16,11 +16,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@v3.1.2 + uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cb417c8..8673b93 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Run release-please id: release - uses: googleapis/release-please-action@v5.0.0 + uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 publish: name: Publish diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index f7df8df..c9042b9 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -12,4 +12,6 @@ on: jobs: validate: - uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@196aa8e3616c99a3f52918306caeaa01923168f3 # main + permissions: + contents: read + uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 5d88e9b..7382abb 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -19,11 +19,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@v3.1.2 + uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml index 25cd709..a08a267 100644 --- a/.github/workflows/triage.yml +++ b/.github/workflows/triage.yml @@ -27,6 +27,6 @@ jobs: permissions: pull-requests: read steps: - - uses: amannn/action-semantic-pull-request@v6.1.1 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/visual-tray.yml b/.github/workflows/visual-tray.yml index a5d3660..b813002 100644 --- a/.github/workflows/visual-tray.yml +++ b/.github/workflows/visual-tray.yml @@ -31,10 +31,10 @@ jobs: label: macOS 14 (Sonoma) key: macos-14 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@v3.1.2 + - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true @@ -67,7 +67,7 @@ jobs: run: pnpm run test:visual - name: Upload artifacts if: always() - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: visual-${{ matrix.key }} path: test-results/visual/ @@ -185,10 +185,10 @@ jobs: panel_warmup: 18 post_ready_delay: 10000 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@v3.1.2 + - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true @@ -228,7 +228,7 @@ jobs: # 'com.solus-project.budgie-panel' is not installed". - name: Install desktop environment (cached) if: matrix.cache_apt - uses: awalsh128/cache-apt-pkgs-action@v1.6.3 + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: ${{ matrix.apt }} version: '1.0' @@ -340,7 +340,7 @@ jobs: exit $EXIT - name: Upload artifacts if: always() - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: visual-${{ matrix.key }} path: test-results/visual/ @@ -373,10 +373,10 @@ jobs: key: linux-sway apt: sway waybar grim steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@v3.1.2 + - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true @@ -466,7 +466,7 @@ jobs: " - name: Upload artifacts if: always() - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: visual-${{ matrix.key }} path: test-results/visual/ @@ -495,7 +495,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@v3.1.2 + - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true @@ -609,7 +609,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@v3.1.2 + - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true @@ -672,17 +672,17 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@v3.1.2 + uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 with: node-version-file: .nvmrc cache: true install: false - name: Download all visual artifacts - uses: actions/download-artifact@v8.0.2 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: visual-* merge-multiple: true @@ -745,7 +745,7 @@ jobs: pnpm install --frozen-lockfile --ignore-scripts pnpm exec oxfmt PLATFORMS.md - name: Open PR if changed - uses: peter-evans/create-pull-request@v8.1.1 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: commit-message: 'docs: refresh visual tray rendering table' title: 'docs: refresh visual tray rendering table' diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..b22a2a2 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,6 @@ +rules: + unpinned-uses: + config: + policies: + "*": hash-pin + "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin From 7b1f65b16f4877060b2a41b0d1b5546e218a871c Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:43:42 -0400 Subject: [PATCH 2/4] ci: limit PR to validator trust policy Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> From b1d26aad803baf945c55b46322e9d77f5829334b Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:44:10 -0400 Subject: [PATCH 3/4] ci: restore unrelated workflow action refs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/actions.lock | 52 ------------------------------- .github/workflows/build.yml | 4 +-- .github/workflows/e2e.yml | 14 ++++----- .github/workflows/lint.yml | 4 +-- .github/workflows/publish.yml | 4 +-- .github/workflows/release.yml | 2 +- .github/workflows/test.yml | 4 +-- .github/workflows/triage.yml | 2 +- .github/workflows/visual-tray.yml | 32 +++++++++---------- 9 files changed, 33 insertions(+), 85 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 10ffe32..89c4c72 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -4,55 +4,36 @@ version: 'v0.0.3' workflows: '.github/workflows/build.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' - - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/e2e.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' - - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' - 'actions/download-artifact@v8.0.2' - - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'actions/upload-artifact@v7.0.2' - - 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1' - 'peter-evans/create-pull-request@v8.1.1' - - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/lint.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' - - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/publish.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' - - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/release.yml': - - 'googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7' - 'googleapis/release-please-action@v5.0.0' '.github/workflows/renovate.yml': [] '.github/workflows/test.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' - - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' '.github/workflows/triage.yml': - - 'amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50' - 'amannn/action-semantic-pull-request@v6.1.1' '.github/workflows/visual-tray.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/checkout@v7.0.1' - - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' - 'actions/download-artifact@v8.0.2' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'actions/upload-artifact@v7.0.2' - - 'awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9' - 'awalsh128/cache-apt-pkgs-action@v1.6.3' - - 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1' - 'peter-evans/create-pull-request@v8.1.1' - - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - 'pnpm/setup@v3.1.2' dependencies: 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9': @@ -70,11 +51,6 @@ dependencies: commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333': - ref: 'v8.0.2' - commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' - owner_id: 44036562 - repo_id: 192626254 'actions/download-artifact@v8.0.2': ref: 'v8.0.2' commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' @@ -95,24 +71,11 @@ dependencies: commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 - 'amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50': - ref: 'v6.1.1' - commit: 'sha1-48f256284bd46cdaab1048c3721360e808335d50' - owner_id: 4038316 - repo_id: 220418983 'amannn/action-semantic-pull-request@v6.1.1': ref: 'v6.1.1' commit: 'sha1-48f256284bd46cdaab1048c3721360e808335d50' owner_id: 4038316 repo_id: 220418983 - 'awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9': - ref: 'v1.6.3' - commit: 'sha1-553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9' - owner_id: 2087466 - repo_id: 408212054 - uses: - - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'awalsh128/cache-apt-pkgs-action@v1.6.3': ref: 'v1.6.3' commit: 'sha1-553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9' @@ -121,31 +84,16 @@ dependencies: uses: - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9' - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7': - ref: 'v5.0.0' - commit: 'sha1-45996ed1f6d02564a971a2fa1b5860e934307cf7' - owner_id: 16785467 - repo_id: 262236530 'googleapis/release-please-action@v5.0.0': ref: 'v5.0.0' commit: 'sha1-45996ed1f6d02564a971a2fa1b5860e934307cf7' owner_id: 16785467 repo_id: 262236530 - 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1': - ref: 'v8.1.1' - commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1' - owner_id: 18365890 - repo_id: 197176365 'peter-evans/create-pull-request@v8.1.1': ref: 'v8.1.1' commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1' owner_id: 18365890 repo_id: 197176365 - 'pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e': - ref: 'v3.1.2' - commit: 'sha1-fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' - owner_id: 21320719 - repo_id: 1235693694 'pnpm/setup@v3.1.2': ref: 'v3.1.2' commit: 'sha1-fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e' diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 11a8b02..28077e3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,11 +19,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index b6c4eac..e29d061 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -47,11 +47,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true @@ -89,7 +89,7 @@ jobs: run: pnpm exec playwright test --config tests/e2e/playwright.config.ts - name: Upload platform result if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: platform-${{ matrix.key }} path: test-results/platforms/${{ matrix.key }}.json @@ -106,17 +106,17 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true install: false - name: Download all platform results - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: pattern: platform-* merge-multiple: true @@ -128,7 +128,7 @@ jobs: pnpm install --frozen-lockfile --ignore-scripts pnpm exec oxfmt PLATFORMS.md - name: Open PR if changed - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + uses: peter-evans/create-pull-request@v8.1.1 with: commit-message: 'docs: refresh tested platforms table' title: 'docs: refresh tested platforms table' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 7f39c96..6691048 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -19,11 +19,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 852b196..84e109a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -16,11 +16,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8673b93..cb417c8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Run release-please id: release - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 + uses: googleapis/release-please-action@v5.0.0 publish: name: Publish diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7382abb..5d88e9b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -19,11 +19,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml index a08a267..25cd709 100644 --- a/.github/workflows/triage.yml +++ b/.github/workflows/triage.yml @@ -27,6 +27,6 @@ jobs: permissions: pull-requests: read steps: - - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 + - uses: amannn/action-semantic-pull-request@v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/visual-tray.yml b/.github/workflows/visual-tray.yml index b813002..a5d3660 100644 --- a/.github/workflows/visual-tray.yml +++ b/.github/workflows/visual-tray.yml @@ -31,10 +31,10 @@ jobs: label: macOS 14 (Sonoma) key: macos-14 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + - uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true @@ -67,7 +67,7 @@ jobs: run: pnpm run test:visual - name: Upload artifacts if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: visual-${{ matrix.key }} path: test-results/visual/ @@ -185,10 +185,10 @@ jobs: panel_warmup: 18 post_ready_delay: 10000 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + - uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true @@ -228,7 +228,7 @@ jobs: # 'com.solus-project.budgie-panel' is not installed". - name: Install desktop environment (cached) if: matrix.cache_apt - uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 + uses: awalsh128/cache-apt-pkgs-action@v1.6.3 with: packages: ${{ matrix.apt }} version: '1.0' @@ -340,7 +340,7 @@ jobs: exit $EXIT - name: Upload artifacts if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: visual-${{ matrix.key }} path: test-results/visual/ @@ -373,10 +373,10 @@ jobs: key: linux-sway apt: sway waybar grim steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + - uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true @@ -466,7 +466,7 @@ jobs: " - name: Upload artifacts if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: visual-${{ matrix.key }} path: test-results/visual/ @@ -495,7 +495,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + - uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true @@ -609,7 +609,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + - uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true @@ -672,17 +672,17 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm and Node.js - uses: pnpm/setup@fa36a5ef7dcdefc3a7cb25655c122e00cf6e636e # v3.1.2 + uses: pnpm/setup@v3.1.2 with: node-version-file: .nvmrc cache: true install: false - name: Download all visual artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: pattern: visual-* merge-multiple: true @@ -745,7 +745,7 @@ jobs: pnpm install --frozen-lockfile --ignore-scripts pnpm exec oxfmt PLATFORMS.md - name: Open PR if changed - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + uses: peter-evans/create-pull-request@v8.1.1 with: commit-message: 'docs: refresh visual tray rendering table' title: 'docs: refresh visual tray rendering table' From 049f3b3957e78c7243d7f4e3a362fde2eca33719 Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 14:37:23 -0400 Subject: [PATCH 4/4] style: format zizmor policy Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/zizmor.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index b22a2a2..4078f01 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -2,5 +2,5 @@ rules: unpinned-uses: config: policies: - "*": hash-pin - "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin + '*': hash-pin + 'gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml': ref-pin