Skip to content

Commit cec7bd9

Browse files
nicktrnnicktrn
committed
ci: zizmor autofix - artipacked + template-injection across workflows
1 parent ed9bc46 commit cec7bd9

18 files changed

Lines changed: 113 additions & 40 deletions

‎.github/actions/get-image-tag/action.yml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,35 +23,37 @@ runs:
2323
id: get_tag
2424
shell: bash
2525
run: |
26-
if [[ -n "${{ inputs.tag }}" ]]; then
27-
tag="${{ inputs.tag }}"
28-
elif [[ "${{ github.ref_type }}" == "tag" ]]; then
29-
if [[ "${{ github.ref_name }}" == infra-*-* ]]; then
30-
env=$(echo ${{ github.ref_name }} | cut -d- -f2)
26+
if [[ -n "${INPUTS_TAG}" ]]; then
27+
tag="${INPUTS_TAG}"
28+
elif [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
29+
if [[ "${GITHUB_REF_NAME}" == infra-*-* ]]; then
30+
env=$(echo ${GITHUB_REF_NAME} | cut -d- -f2)
3131
sha=$(echo ${{ github.sha }} | head -c7)
3232
ts=$(date +%s)
3333
tag=${env}-${sha}-${ts}
34-
elif [[ "${{ github.ref_name }}" == re2-*-* ]]; then
35-
env=$(echo ${{ github.ref_name }} | cut -d- -f2)
34+
elif [[ "${GITHUB_REF_NAME}" == re2-*-* ]]; then
35+
env=$(echo ${GITHUB_REF_NAME} | cut -d- -f2)
3636
sha=$(echo ${{ github.sha }} | head -c7)
3737
ts=$(date +%s)
3838
tag=${env}-${sha}-${ts}
39-
elif [[ "${{ github.ref_name }}" == v.docker.* ]]; then
39+
elif [[ "${GITHUB_REF_NAME}" == v.docker.* ]]; then
4040
version="${GITHUB_REF_NAME#v.docker.}"
4141
tag="v${version}"
42-
elif [[ "${{ github.ref_name }}" == build-* ]]; then
42+
elif [[ "${GITHUB_REF_NAME}" == build-* ]]; then
4343
tag="${GITHUB_REF_NAME#build-}"
4444
else
45-
echo "Invalid git tag: ${{ github.ref_name }}"
45+
echo "Invalid git tag: ${GITHUB_REF_NAME}"
4646
exit 1
4747
fi
48-
elif [[ "${{ github.ref_name }}" == "main" ]]; then
48+
elif [[ "${GITHUB_REF_NAME}" == "main" ]]; then
4949
tag="main"
5050
else
51-
echo "Invalid git ref: ${{ github.ref }}"
51+
echo "Invalid git ref: ${GITHUB_REF}"
5252
exit 1
5353
fi
5454
echo "tag=${tag}" >> "$GITHUB_OUTPUT"
55+
env:
56+
INPUTS_TAG: ${{ inputs.tag }}
5557

5658
- name: 🔍 Check for validity
5759
id: check_validity

‎.github/workflows/changesets-pr.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ jobs:
2828
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2929
with:
3030
fetch-depth: 0
31+
persist-credentials: false
3132

3233
- name: Setup pnpm
3334
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -84,6 +85,7 @@ jobs:
8485
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8586
with:
8687
ref: changeset-release/main
88+
persist-credentials: false
8789

8890
- name: Setup pnpm
8991
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -133,6 +135,7 @@ jobs:
133135
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
134136
with:
135137
ref: changeset-release/main
138+
persist-credentials: false
136139

137140
- name: Bump Chart.yaml
138141
run: |

‎.github/workflows/claude-md-audit.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ jobs:
3030
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3131
with:
3232
fetch-depth: 0
33+
persist-credentials: false
3334

3435
- name: Run Claude Code
3536
id: claude

‎.github/workflows/claude.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ jobs:
2929
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3030
with:
3131
fetch-depth: 1
32+
persist-credentials: false
3233

3334
- name: ⎔ Setup pnpm
3435
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0

‎.github/workflows/docs.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ jobs:
2727
steps:
2828
- name: 📥 Checkout repository
2929
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
with:
31+
persist-credentials: false
3032

3133
- name: 📦 Cache npm
3234
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

‎.github/workflows/e2e-webapp.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ jobs:
4444
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4545
with:
4646
fetch-depth: 0
47+
persist-credentials: false
4748

4849
- name: ⎔ Setup pnpm
4950
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0

‎.github/workflows/e2e.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ jobs:
2727
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2828
with:
2929
fetch-depth: 0
30+
persist-credentials: false
3031

3132
- name: ⎔ Setup pnpm
3233
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0

‎.github/workflows/helm-prerelease.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ jobs:
3434
steps:
3535
- name: Checkout
3636
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
37+
with:
38+
persist-credentials: false
3739

3840
- name: Set up Helm
3941
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
@@ -78,6 +80,8 @@ jobs:
7880
steps:
7981
- name: Checkout
8082
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
83+
with:
84+
persist-credentials: false
8185

8286
- name: Set up Helm
8387
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
@@ -112,7 +116,7 @@ jobs:
112116
PRERELEASE_VERSION="${BASE_VERSION}-main.${SHORT_SHA}"
113117
else
114118
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
115-
REF_SLUG=$(echo "${{ github.ref_name }}" | tr '/' '-' | tr -cd 'a-zA-Z0-9-')
119+
REF_SLUG=$(echo "${GITHUB_REF_NAME}" | tr '/' '-' | tr -cd 'a-zA-Z0-9-')
116120
if [[ -z "$REF_SLUG" ]]; then
117121
REF_SLUG="manual"
118122
fi
@@ -123,7 +127,9 @@ jobs:
123127
124128
- name: Update Chart.yaml with prerelease version
125129
run: |
126-
sed -i "s/^version:.*/version: ${{ steps.version.outputs.version }}/" ./hosting/k8s/helm/Chart.yaml
130+
sed -i "s/^version:.*/version: ${STEPS_VERSION_OUTPUTS_VERSION}/" ./hosting/k8s/helm/Chart.yaml
131+
env:
132+
STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
127133

128134
- name: Override appVersion
129135
if: github.event_name == 'workflow_dispatch' && inputs.app_version != ''
@@ -138,26 +144,30 @@ jobs:
138144
139145
- name: Push Helm Chart to GHCR
140146
run: |
141-
VERSION="${{ steps.version.outputs.version }}"
147+
VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
142148
CHART_PACKAGE="/tmp/${{ env.CHART_NAME }}-${VERSION}.tgz"
143149
144150
# Push to GHCR OCI registry
145151
helm push "$CHART_PACKAGE" "oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts"
152+
env:
153+
STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
146154

147155
- name: Write run summary
148156
run: |
149157
{
150158
echo "### 🧭 Helm Chart Prerelease Published"
151159
echo ""
152-
echo "**Version:** \`${{ steps.version.outputs.version }}\`"
160+
echo "**Version:** \`${STEPS_VERSION_OUTPUTS_VERSION}\`"
153161
echo ""
154162
echo "**Install:**"
155163
echo '```bash'
156164
echo "helm upgrade --install trigger \\"
157165
echo " oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts/${{ env.CHART_NAME }} \\"
158-
echo " --version \"${{ steps.version.outputs.version }}\""
166+
echo " --version \"${STEPS_VERSION_OUTPUTS_VERSION}\""
159167
echo '```'
160168
} >> "$GITHUB_STEP_SUMMARY"
169+
env:
170+
STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
161171

162172
- name: Find existing comment
163173
if: github.event_name == 'pull_request'

‎.github/workflows/publish-webapp.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ jobs:
3030
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3131
with:
3232
submodules: recursive
33+
persist-credentials: false
3334

3435
- name: "#️⃣ Get the image tag"
3536
id: get_tag
@@ -46,28 +47,34 @@ jobs:
4647
id: set_tags
4748
run: |
4849
ref_without_tag=ghcr.io/triggerdotdev/trigger.dev
49-
image_tags=$ref_without_tag:${{ steps.get_tag.outputs.tag }}
50+
image_tags=$ref_without_tag:${STEPS_GET_TAG_OUTPUTS_TAG}
5051
5152
# if tag is a semver, also tag it as v4
52-
if [[ "${{ steps.get_tag.outputs.is_semver }}" == true ]]; then
53+
if [[ "${STEPS_GET_TAG_OUTPUTS_IS_SEMVER}" == true ]]; then
5354
# TODO: switch to v4 tag on GA
5455
image_tags=$image_tags,$ref_without_tag:v4-beta
5556
fi
5657
5758
echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
59+
env:
60+
STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
61+
STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}
5862

5963
- name: 📝 Set the build info
6064
id: set_build_info
6165
run: |
6266
{
63-
tag="${{ steps.get_tag.outputs.tag }}"
64-
if [[ "${{ steps.get_tag.outputs.is_semver }}" == true ]]; then
67+
tag="${STEPS_GET_TAG_OUTPUTS_TAG}"
68+
if [[ "${STEPS_GET_TAG_OUTPUTS_IS_SEMVER}" == true ]]; then
6569
echo "BUILD_APP_VERSION=${tag}"
6670
fi
6771
echo "BUILD_GIT_SHA=${{ github.sha }}"
68-
echo "BUILD_GIT_REF_NAME=${{ github.ref_name }}"
72+
echo "BUILD_GIT_REF_NAME=${GITHUB_REF_NAME}"
6973
echo "BUILD_TIMESTAMP_SECONDS=$(date +%s)"
7074
} >> "$GITHUB_OUTPUT"
75+
env:
76+
STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
77+
STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}
7178

7279
- name: 🐙 Login to GitHub Container Registry
7380
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

‎.github/workflows/publish-worker-v4.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ jobs:
4141

4242
- name: ⬇️ Checkout git repo
4343
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44+
with:
45+
persist-credentials: false
4446

4547
- name: 📦 Get image repo
4648
id: get_repository
@@ -63,16 +65,20 @@ jobs:
6365
- name: 📛 Set tags to push
6466
id: set_tags
6567
run: |
66-
ref_without_tag=ghcr.io/triggerdotdev/${{ steps.get_repository.outputs.repo }}
67-
image_tags=$ref_without_tag:${{ steps.get_tag.outputs.tag }}
68+
ref_without_tag=ghcr.io/triggerdotdev/${STEPS_GET_REPOSITORY_OUTPUTS_REPO}
69+
image_tags=$ref_without_tag:${STEPS_GET_TAG_OUTPUTS_TAG}
6870
6971
# if tag is a semver, also tag it as v4
70-
if [[ "${{ steps.get_tag.outputs.is_semver }}" == true ]]; then
72+
if [[ "${STEPS_GET_TAG_OUTPUTS_IS_SEMVER}" == true ]]; then
7173
# TODO: switch to v4 tag on GA
7274
image_tags=$image_tags,$ref_without_tag:v4-beta
7375
fi
7476
7577
echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
78+
env:
79+
STEPS_GET_REPOSITORY_OUTPUTS_REPO: ${{ steps.get_repository.outputs.repo }}
80+
STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
81+
STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}
7682

7783
- name: 🐙 Login to GitHub Container Registry
7884
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

0 commit comments

Comments
 (0)