Skip to content

Commit 5aadc28

Browse files
IvanIsCodingIvanIsCoding
committed
Start using zizmor on CI
1 parent 6501354 commit 5aadc28

10 files changed

Lines changed: 148 additions & 122 deletions

‎.github/workflows/main.yml‎

Lines changed: 46 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ jobs:
2020
name: Build (Linux x86-64)
2121
runs-on: ubuntu-latest
2222
steps:
23-
- uses: actions/checkout@v7
23+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
2424
with:
2525
persist-credentials: false
2626

2727
- name: Install Rust MSRV
28-
uses: dtolnay/rust-toolchain@1.94.1
28+
uses: dtolnay/rust-toolchain@75be91dd2711b583df57c31d0873b4145c89f1d9 # 1.94.1
2929

3030
- name: Build with locked dependencies
3131
run: cargo build --locked
@@ -37,12 +37,12 @@ jobs:
3737
name: Format Check
3838
runs-on: ubuntu-slim
3939
steps:
40-
- uses: actions/checkout@v7
40+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
4141
with:
4242
persist-credentials: false
4343

4444
- name: Install Rust stable
45-
uses: dtolnay/rust-toolchain@stable
45+
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
4646
with:
4747
components: rustfmt
4848

@@ -53,12 +53,12 @@ jobs:
5353
name: Clippy
5454
runs-on: ubuntu-latest
5555
steps:
56-
- uses: actions/checkout@v7
56+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
5757
with:
5858
persist-credentials: false
5959

6060
- name: Install Rust MSRV
61-
uses: dtolnay/rust-toolchain@1.94.1
61+
uses: dtolnay/rust-toolchain@75be91dd2711b583df57c31d0873b4145c89f1d9 # 1.94.1
6262
with:
6363
components: clippy
6464

@@ -95,12 +95,12 @@ jobs:
9595
rust: stable
9696
runs-on: ${{ matrix.os }}
9797
steps:
98-
- uses: actions/checkout@v7
98+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
9999
with:
100100
persist-credentials: false
101101

102102
- name: Install Rust ${{ matrix.rust }}
103-
uses: dtolnay/rust-toolchain@master
103+
uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
104104
with:
105105
toolchain: ${{ matrix.rust }}
106106
targets: ${{ matrix.target }}
@@ -129,12 +129,12 @@ jobs:
129129
- "--no-default-features --features greppable"
130130
- "--all-features"
131131
steps:
132-
- uses: actions/checkout@v7
132+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
133133
with:
134134
persist-credentials: false
135135

136136
- name: Install Rust MSRV
137-
uses: dtolnay/rust-toolchain@1.94.1
137+
uses: dtolnay/rust-toolchain@75be91dd2711b583df57c31d0873b4145c89f1d9 # 1.94.1
138138

139139
- name: Run tests
140140
run: cargo test --locked ${{ matrix.features }}
@@ -144,20 +144,20 @@ jobs:
144144
needs: [build, format, clippy]
145145
runs-on: ubuntu-slim
146146
steps:
147-
- uses: actions/checkout@v7
147+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
148148
with:
149149
persist-credentials: false
150150

151151
- name: Install Rust stable
152-
uses: dtolnay/rust-toolchain@stable
152+
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
153153

154154
- name: Build documentation
155155
run: cargo doc --no-deps --all-features
156156
env:
157157
RUSTDOCFLAGS: "-D warnings"
158158

159159
- name: Upload documentation
160-
uses: actions/upload-artifact@v7
160+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
161161
with:
162162
name: documentation
163163
path: target/doc/
@@ -196,35 +196,35 @@ jobs:
196196
zigtargetsuffix: ""
197197
runs-on: ${{ matrix.os }}
198198
steps:
199-
- uses: actions/checkout@v7
199+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
200200
with:
201201
persist-credentials: false
202202

203203
- name: Install Rust Stable
204-
uses: dtolnay/rust-toolchain@stable
204+
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
205205
if: matrix.target != 'aarch64-unknown-freebsd'
206206
with:
207207
targets: ${{ matrix.target }}
208208
components: rust-src
209209

210210
- name: Install Rust 1.94.1 (FreeBSD aarch64 special case)
211-
uses: dtolnay/rust-toolchain@1.94.1
211+
uses: dtolnay/rust-toolchain@75be91dd2711b583df57c31d0873b4145c89f1d9 # 1.94.1
212212
if: matrix.target == 'aarch64-unknown-freebsd'
213213
with:
214214
components: rust-src
215215

216216
- name: Install Zig
217-
uses: mlugg/setup-zig@v2
217+
uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
218218
with:
219219
version: 0.15.2
220220

221221
- name: Install cargo-zigbuild via cargo-binstall
222-
uses: taiki-e/install-action@v2
222+
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
223223
with:
224224
tool: cargo-zigbuild@0.23.2
225225

226226
- name: Install cargo-auditable
227-
uses: taiki-e/install-action@v2
227+
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
228228
with:
229229
tool: cargo-auditable@0.7.5
230230
fallback: none
@@ -241,7 +241,7 @@ jobs:
241241
-Z build-std=std,panic_abort
242242
243243
- name: Upload celq binary
244-
uses: actions/upload-artifact@v7
244+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
245245
with:
246246
name: celq-${{ matrix.target }}
247247
path: target/${{ matrix.target }}/debug/celq
@@ -252,25 +252,25 @@ jobs:
252252
needs: zigbuild
253253
runs-on: ubuntu-latest
254254
steps:
255-
- uses: actions/checkout@v7
255+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
256256
with:
257257
persist-credentials: false
258258

259259
- name: Download celq binary
260-
uses: actions/download-artifact@v8
260+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
261261
with:
262262
name: celq-x86_64-unknown-linux-gnu
263263
path: ./bin
264264

265265
- name: Install cargo-audit
266-
uses: taiki-e/install-action@v2
266+
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
267267
with:
268268
tool: cargo-audit@0.22.2
269269
fallback: none
270270

271271
- name: Install Syft
272272
id: syft
273-
uses: anchore/sbom-action/download-syft@v0.24.0
273+
uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
274274

275275
- name: Print binary packages
276276
run: '"${{ steps.syft.outputs.cmd }}" scan ./bin/celq --output table'
@@ -293,17 +293,17 @@ jobs:
293293
target: x86_64-pc-windows-msvc
294294
runs-on: ${{ matrix.os }}
295295
steps:
296-
- uses: actions/checkout@v7
296+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
297297
with:
298298
persist-credentials: false
299299

300300
- name: Install Rust MSRV
301-
uses: dtolnay/rust-toolchain@1.94.1
301+
uses: dtolnay/rust-toolchain@75be91dd2711b583df57c31d0873b4145c89f1d9 # 1.94.1
302302
with:
303303
targets: ${{ matrix.target }}
304304

305305
- name: Install uv
306-
uses: astral-sh/setup-uv@v7
306+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
307307
with:
308308
version: "0.9.22"
309309

@@ -312,13 +312,13 @@ jobs:
312312

313313
- name: Install cargo-zigbuild
314314
if: runner.os == 'Linux'
315-
uses: taiki-e/install-action@v2
315+
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
316316
with:
317317
tool: cargo-zigbuild@0.23.2
318318
fallback: none
319319

320320
- name: Install cargo-auditable
321-
uses: taiki-e/install-action@v2
321+
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
322322
with:
323323
tool: cargo-auditable@0.7.5
324324
fallback: none
@@ -361,12 +361,12 @@ jobs:
361361
container:
362362
image: debian:oldoldstable
363363
steps:
364-
- uses: actions/checkout@v7
364+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
365365
with:
366366
persist-credentials: false
367367

368368
- name: Download celq binary
369-
uses: actions/download-artifact@v8
369+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
370370
with:
371371
name: celq-${{ matrix.target }}
372372
path: ./bin
@@ -394,18 +394,18 @@ jobs:
394394
artifact: celq-aarch64-unknown-freebsd
395395

396396
steps:
397-
- uses: actions/checkout@v7
397+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
398398
with:
399399
persist-credentials: false
400400

401401
- name: Download celq binary
402-
uses: actions/download-artifact@v8
402+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
403403
with:
404404
name: ${{ matrix.artifact }}
405405
path: ./bin
406406

407407
- name: Test on FreeBSD
408-
uses: vmactions/freebsd-vm@v1
408+
uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1
409409
with:
410410
release: ${{ matrix.release }}
411411
arch: ${{ matrix.arch }}
@@ -427,18 +427,18 @@ jobs:
427427
- riscv64gc-unknown-linux-musl
428428

429429
steps:
430-
- uses: actions/checkout@v7
430+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
431431
with:
432432
persist-credentials: false
433433

434434
- name: Download celq binary
435-
uses: actions/download-artifact@v8
435+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
436436
with:
437437
name: celq-${{ matrix.target }}
438438
path: ./bin
439439

440440
- name: Test on Debian
441-
uses: vmactions/debian-vm@v1
441+
uses: vmactions/debian-vm@389ba1da28ff5b440cba52db8e03fc2e08e2affa # v1
442442
with:
443443
release: "13"
444444
arch: riscv64
@@ -453,17 +453,17 @@ jobs:
453453
runs-on: ubuntu-24.04
454454

455455
steps:
456-
- uses: actions/checkout@v7
456+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
457457
with:
458458
persist-credentials: false
459459

460460
- name: Install Rust stable
461-
uses: dtolnay/rust-toolchain@stable
461+
uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
462462
with:
463463
components: llvm-tools-preview
464464

465465
- name: Install cargo-llvm-cov via binstall
466-
uses: taiki-e/install-action@v2
466+
uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2
467467
with:
468468
tool: cargo-llvm-cov
469469

@@ -480,7 +480,7 @@ jobs:
480480
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
481481

482482
steps:
483-
- uses: actions/checkout@v7
483+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
484484
with:
485485
persist-credentials: false
486486

@@ -501,7 +501,7 @@ jobs:
501501
502502
- name: Test on OpenBSD
503503
if: steps.filter.outputs.rust == 'true'
504-
uses: vmactions/openbsd-vm@v1
504+
uses: vmactions/openbsd-vm@86cdc08415d9d0865267e686561e276c52d62530 # v1
505505
with:
506506
release: "7.9"
507507
usesh: true
@@ -518,7 +518,7 @@ jobs:
518518
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
519519

520520
steps:
521-
- uses: actions/checkout@v7
521+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
522522
with:
523523
persist-credentials: false
524524

@@ -539,7 +539,7 @@ jobs:
539539
540540
- name: Test on NetBSD
541541
if: steps.filter.outputs.rust == 'true'
542-
uses: vmactions/netbsd-vm@v1
542+
uses: vmactions/netbsd-vm@07366ff288a2661e3998b69c5d48eda270050635 # v1
543543
with:
544544
release: "10.1"
545545
usesh: true
@@ -556,7 +556,7 @@ jobs:
556556
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
557557

558558
steps:
559-
- uses: actions/checkout@v7
559+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
560560
with:
561561
persist-credentials: false
562562

@@ -577,7 +577,7 @@ jobs:
577577
578578
- name: Test on FreeBSD
579579
if: steps.filter.outputs.rust == 'true'
580-
uses: vmactions/freebsd-vm@v1
580+
uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1
581581
with:
582582
release: "14.4"
583583
usesh: true

‎.github/workflows/release_calculate_nix_hashes.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ jobs:
1717

1818
steps:
1919
- name: Checkout repository
20-
uses: actions/checkout@v7
20+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
2121
with:
2222
persist-credentials: false
2323

2424
- name: Install Nix
25-
uses: cachix/install-nix-action@v31
25+
uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
2626
with:
2727
github_access_token: ${{ secrets.GITHUB_TOKEN }}
2828
nix_path: nixpkgs=channel:nixos-unstable

0 commit comments

Comments
 (0)