From b95d53d14e106b8ec4f71600c766c51c18bf2f50 Mon Sep 17 00:00:00 2001 From: Carlo Goetz Date: Mon, 9 Nov 2026 10:45:59 +0100 Subject: [PATCH 1/2] chore(ci): add gha linter (zizmore) and fix issues - pin each action to hash - use persist-credentials: false on checkout actions - scope GITHUB_TOKEN to create git tags step STACKITSDK-614 --- .github/workflows/ci.yaml | 29 ++++++++++++++++++++++++----- .github/workflows/labeler.yaml | 2 +- scripts/publish.sh | 3 ++- 3 files changed, 27 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 2f56cc76..ad743660 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1,5 +1,7 @@ name: CI/CD +permissions: {} + on: pull_request: workflow_dispatch: @@ -15,10 +17,12 @@ jobs: version: [17, 21, 25] steps: - name: Checkout - uses: actions/checkout@v7.0.1 - + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install java - uses: actions/setup-java@v6.1.0 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: 'temurin' java-version: '${{ matrix.version }}' @@ -39,6 +43,20 @@ jobs: - name: Publish to local maven repo run: make install + zizmor: + name: zizmor + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 + cd: name: CD runs-on: ubuntu-latest @@ -46,13 +64,13 @@ jobs: needs: [ci] permissions: contents: write - actions: write steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # we need to fetch all existing git tags fetch-depth: 0 + persist-credentials: false - name: Create git tags and publish to Maven Central env: @@ -60,6 +78,7 @@ jobs: GPG_SIGNING_PASSWORD: "${{ secrets.GPG_SIGNING_PASSWORD }}" ORG_GRADLE_PROJECT_mavenCentralUsername: "${{ secrets.MAVEN_CENTRAL_USERNAME }}" ORG_GRADLE_PROJECT_mavenCentralPassword: "${{ secrets.MAVEN_CENTRAL_PASSWORD }}" + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | git config --global user.name "SDK Releaser Bot" git config --global user.email "noreply@stackit.de" diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml index 700e3aac..efc901b7 100644 --- a/.github/workflows/labeler.yaml +++ b/.github/workflows/labeler.yaml @@ -23,7 +23,7 @@ jobs: run: | curl -sSL -o remote-labeler.yml https://raw.githubusercontent.com/stackitcloud/stackit-sdk-go/main/.github/labeler.yml - name: Labeler action - uses: actions/labeler@v7.0.0 + uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 with: configuration-path: "remote-labeler.yml" sync-labels: false diff --git a/scripts/publish.sh b/scripts/publish.sh index 45dd9182..35b396f6 100755 --- a/scripts/publish.sh +++ b/scripts/publish.sh @@ -27,7 +27,8 @@ for file in $(find . -print | sed 's|^./||' | grep -E "(^services/[^/]+/VERSION$ # Tag doesn't exist. Create a tag and push it. echo "Tag '$expected_tag' does not exist." git tag -a $expected_tag -m "Release $version" - git push origin tag $expected_tag + auth_header=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0) + git -c http.extraheader="AUTHORIZATION: basic $auth_header" push origin tag "$expected_tag" ./gradlew "${gradle_subproject}:publishToMavenCentral" fi From 7ceb5a18fa8eef3918a83cc9940895955b982916 Mon Sep 17 00:00:00 2001 From: Carlo Goetz Date: Thu, 12 Nov 2026 14:42:31 +0100 Subject: [PATCH 2/2] fix(gha): configure zizmor as separate workflow, use explicit persist-credentials --- .github/workflows/ci.yaml | 18 ++---------------- .github/workflows/zizmor.yaml | 24 ++++++++++++++++++++++++ scripts/publish.sh | 3 +-- 3 files changed, 27 insertions(+), 18 deletions(-) create mode 100644 .github/workflows/zizmor.yaml diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ad743660..3c1e8613 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -43,20 +43,6 @@ jobs: - name: Publish to local maven repo run: make install - zizmor: - name: zizmor - runs-on: ubuntu-latest - permissions: - security-events: write - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Run zizmor - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 - cd: name: CD runs-on: ubuntu-latest @@ -70,7 +56,8 @@ jobs: with: # we need to fetch all existing git tags fetch-depth: 0 - persist-credentials: false + # Required to push release tags from scripts/publish.sh. + persist-credentials: true - name: Create git tags and publish to Maven Central env: @@ -78,7 +65,6 @@ jobs: GPG_SIGNING_PASSWORD: "${{ secrets.GPG_SIGNING_PASSWORD }}" ORG_GRADLE_PROJECT_mavenCentralUsername: "${{ secrets.MAVEN_CENTRAL_USERNAME }}" ORG_GRADLE_PROJECT_mavenCentralPassword: "${{ secrets.MAVEN_CENTRAL_PASSWORD }}" - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | git config --global user.name "SDK Releaser Bot" git config --global user.email "noreply@stackit.de" diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml new file mode 100644 index 00000000..ab1b5a50 --- /dev/null +++ b/.github/workflows/zizmor.yaml @@ -0,0 +1,24 @@ +name: zizmor + +permissions: {} + +on: + pull_request: + workflow_dispatch: + push: + branches: ["main"] + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 diff --git a/scripts/publish.sh b/scripts/publish.sh index 35b396f6..a515cbe0 100755 --- a/scripts/publish.sh +++ b/scripts/publish.sh @@ -27,8 +27,7 @@ for file in $(find . -print | sed 's|^./||' | grep -E "(^services/[^/]+/VERSION$ # Tag doesn't exist. Create a tag and push it. echo "Tag '$expected_tag' does not exist." git tag -a $expected_tag -m "Release $version" - auth_header=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0) - git -c http.extraheader="AUTHORIZATION: basic $auth_header" push origin tag "$expected_tag" + git push origin tag "$expected_tag" ./gradlew "${gradle_subproject}:publishToMavenCentral" fi