Sitelet https://github.com/alloy-rs/hardforks/commit/10add2b395d88484f360dd3a74fc366c7b5ae062
Skip to content

Commit 10add2b

Browse files
decofegrandizzy
decofe
and
grandizzy
authored
chore(ci): scan GitHub Actions workflows (#101)
* chore(ci): scan GitHub Actions workflows Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * chore(ci): fix workflow scanner findings Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * chore(ci): preserve existing cargo-deny workflow Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> --------- Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com>
1 parent ca51448 commit 10add2b

3 files changed

Lines changed: 70 additions & 24 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 45 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,14 @@ jobs:
2727
id-token: write
2828
steps:
2929
- name: Secure runner
30-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
31-
- uses: actions/checkout@v4
32-
- uses: dtolnay/rust-toolchain@master
30+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
31+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
32+
with:
33+
persist-credentials: false
34+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
3335
with:
3436
toolchain: ${{ matrix.rust }}
35-
- uses: Swatinem/rust-cache@v2
37+
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
3638
with:
3739
cache-on-failure: true
3840
- name: build
@@ -42,18 +44,21 @@ jobs:
4244
run: cargo test --workspace ${{ matrix.flags }}
4345

4446
check-no-std:
45-
name: check no_std ${{ matrix.features }}
47+
name: check no_std
4648
runs-on: ubuntu-latest
4749
timeout-minutes: 30
4850
permissions:
4951
contents: read
5052
id-token: write
5153
steps:
5254
- name: Secure runner
53-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
54-
- uses: actions/checkout@v4
55-
- uses: dtolnay/rust-toolchain@stable
55+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
56+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
57+
with:
58+
persist-credentials: false
59+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
5660
with:
61+
toolchain: stable
5762
targets: riscv32imac-unknown-none-elf
5863
- run: cargo check --target riscv32imac-unknown-none-elf --no-default-features
5964

@@ -65,16 +70,20 @@ jobs:
6570
id-token: write
6671
steps:
6772
- name: Secure runner
68-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
69-
- uses: actions/checkout@v4
70-
- uses: dtolnay/rust-toolchain@stable
73+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
74+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
75+
with:
76+
persist-credentials: false
77+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
78+
with:
79+
toolchain: stable
7180
- name: Install cargo-hack
72-
uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@117919c943b804057be733b0c4034c5542e58959
81+
uses: tempoxyz/gh-actions/vendor/taiki-e/install-action@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
7382
with:
7483
tool: cargo-hack@0.6.45
7584
checksum: true
7685
fallback: none
77-
- uses: Swatinem/rust-cache@v2
86+
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
7887
with:
7988
cache-on-failure: true
8089
- name: cargo hack
@@ -88,10 +97,15 @@ jobs:
8897
id-token: write
8998
steps:
9099
- name: Secure runner
91-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
92-
- uses: actions/checkout@v4
93-
- uses: dtolnay/rust-toolchain@clippy
94-
- uses: Swatinem/rust-cache@v2
100+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
101+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
102+
with:
103+
persist-credentials: false
104+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
105+
with:
106+
toolchain: nightly
107+
components: clippy
108+
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
95109
with:
96110
cache-on-failure: true
97111
- run: cargo clippy --workspace --all-targets --all-features
@@ -106,10 +120,14 @@ jobs:
106120
id-token: write
107121
steps:
108122
- name: Secure runner
109-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
110-
- uses: actions/checkout@v4
111-
- uses: dtolnay/rust-toolchain@nightly
112-
- uses: Swatinem/rust-cache@v2
123+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
124+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
125+
with:
126+
persist-credentials: false
127+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
128+
with:
129+
toolchain: nightly
130+
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
113131
with:
114132
cache-on-failure: true
115133
- name: Build documentation
@@ -125,10 +143,13 @@ jobs:
125143
id-token: write
126144
steps:
127145
- name: Secure runner
128-
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959
129-
- uses: actions/checkout@v4
130-
- uses: dtolnay/rust-toolchain@nightly
146+
uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
147+
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
148+
with:
149+
persist-credentials: false
150+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
131151
with:
152+
toolchain: nightly
132153
components: rustfmt
133154
- run: cargo fmt --all --check
134155

‎.github/workflows/scan-github-actions.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Scan GitHub Actions
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches: [main]
7+
workflow_dispatch:
8+
9+
permissions: {}
10+
11+
jobs:
12+
scan:
13+
uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@b35994a23aaf6acf4d5e2f91d18235a6e2f90e95 # 2026-09-23T08-07-21Z-b35994a2
14+
permissions:
15+
actions: read
16+
contents: read
17+
id-token: write
18+
with:
19+
secure-runner-fail-on-violation: false

‎.pinact.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 3
2+
rules:
3+
# Keep the reviewed immutable deny pin; tempoxyz/ci has no release tags.
4+
- ignore: true
5+
conditions:
6+
- expr: ActionName == "tempoxyz/ci/.github/workflows/deny.yml" && ActionVersion == "feeee35d6e4047767f0d97881ac6e83fe3c9ebf3"

0 commit comments

Comments
 (0)