Skip to content

Commit 1e9d70f

Browse files
TonyCTHsuTonyCTHsu
authored
Merge pull request #4456 from DataDog/tonycthsu/zizmore
Scan with zizmor
2 parents 34bf118 + ca054d3 commit 1e9d70f

18 files changed

+155
-22
lines changed

‎.github/workflows/_unit_test.yml

+10-1
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,16 @@ jobs:
3434
image: ghcr.io/datadog/images-rb/engines/${{ inputs.engine }}:${{ inputs.version }}
3535
steps:
3636
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
37+
with:
38+
persist-credentials: false
3739
- name: Generate lockfile
3840
id: lockfile
41+
env:
42+
LOCKFILE: lockfile-${{ inputs.alias }}-${{ github.run_id }}
3943
run: |
4044
bundle lock
41-
echo "lockfile=lockfile-${{ inputs.alias }}-${{ github.run_id }}" >> $GITHUB_OUTPUT
45+
echo "lockfile=$LOCKFILE" >> $GITHUB_OUTPUT
46+
4247
- name: Upload lockfile
4348
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
4449
with:
@@ -148,6 +153,8 @@ jobs:
148153
image: ghcr.io/datadog/images-rb/services/redis:6.2
149154
steps:
150155
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
156+
with:
157+
persist-credentials: false
151158
- name: Restore bundle cache
152159
uses: ./.github/actions/bundle-restore
153160
with:
@@ -221,6 +228,8 @@ jobs:
221228
image: ghcr.io/datadog/images-rb/services/starburstdata/presto:332-e.9
222229
steps:
223230
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
231+
with:
232+
persist-credentials: false
224233
- name: Restore bundle cache
225234
uses: ./.github/actions/bundle-restore
226235
with:

‎.github/workflows/add-milestone-to-pull-requests.yml

+1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ jobs:
1616
# Checks out the branch that the pull request is merged into
1717
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1818
with:
19+
persist-credentials: false
1920
ref: ${{ github.event.pull_request.base.ref }}
2021

2122
- name: Get major version from gemspec

‎.github/workflows/build-gem.yml

+10-10
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
branches:
1616
- master
1717

18+
# Default permissions for all jobs
19+
permissions: {}
20+
1821
env:
1922
GEM_HOST: 'https://rubygems.pkg.github.com/DataDog'
2023

@@ -31,24 +34,21 @@ jobs:
3134
steps:
3235
- name: Checkout
3336
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
37+
with:
38+
persist-credentials: false
3439
- uses: ruby/setup-ruby@8388f20e6a9c43cd241131b678469a9f89579f37 # v1.216.0
3540
with:
3641
ruby-version: '3.2'
3742
bundler-cache: true # runs 'bundle install' and caches installed gems automatically
3843
- name: Patch version
3944
if: ${{ matrix.type != 'final' }}
45+
env:
46+
GHA_RUN_ID: ${{ github.run_id }}
47+
GIT_REF: ${{ github.ref }}
48+
GIT_SHA: ${{ github.sha }}
4049
run: |
41-
# Obtain context information
42-
gha_run_id='${{ github.run_id }}'
43-
git_ref='${{ github.ref }}'
44-
git_sha='${{ github.sha }}'
45-
46-
# Output info for CI debug
47-
echo gha_run_id="${gha_run_id}"
48-
echo git_ref="${git_ref}"
49-
echo git_sha="${git_sha}"
50+
.gitlab/patch_gem_version.sh gha $GHA_RUN_ID $GIT_REF $GIT_SHA;
5051
51-
.gitlab/patch_gem_version.sh gha $gha_run_id $git_ref $git_sha;
5252
- name: Patch gem host
5353
if: ${{ matrix.type != 'final' }}
5454
run: |

‎.github/workflows/check.yml

+36
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,18 @@ concurrency:
1111
group: ${{ github.workflow }}-${{ github.ref }}
1212
cancel-in-progress: true
1313

14+
# Default permissions for all jobs
15+
permissions: {}
16+
1417
jobs:
1518
build:
1619
name: build
1720
runs-on: ubuntu-24.04
1821
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
1922
steps:
2023
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
24+
with:
25+
persist-credentials: false
2126
- run: bundle lock
2227
- uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
2328
id: lockfile
@@ -33,6 +38,8 @@ jobs:
3338
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
3439
steps:
3540
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
with:
42+
persist-credentials: false
3643
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
3744
- run: bundle install
3845
- run: bundle exec rake rubocop
@@ -44,6 +51,8 @@ jobs:
4451
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
4552
steps:
4653
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
54+
with:
55+
persist-credentials: false
4756
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
4857
- name: Install dependencies
4958
run: bundle install
@@ -56,6 +65,8 @@ jobs:
5665
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
5766
steps:
5867
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
68+
with:
69+
persist-credentials: false
5970
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
6071
- name: Install dependencies
6172
run: bundle install
@@ -77,6 +88,8 @@ jobs:
7788
steps:
7889
- name: Checkout
7990
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
91+
with:
92+
persist-credentials: false
8093
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 # requires the lockfile
8194
- uses: DataDog/datadog-sca-github-action@main
8295
with:
@@ -90,6 +103,8 @@ jobs:
90103
runs-on: ubuntu-24.04
91104
steps:
92105
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
106+
with:
107+
persist-credentials: false
93108
- uses: DataDog/datadog-static-analyzer-github-action@v1
94109
with:
95110
dd_api_key: ${{ secrets.DD_API_KEY }}
@@ -103,6 +118,8 @@ jobs:
103118
container: semgrep/semgrep # PENDING: Possible to be rate limited.
104119
steps:
105120
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
121+
with:
122+
persist-credentials: false
106123
- run: |
107124
semgrep ci \
108125
--include=bin/* \
@@ -112,6 +129,24 @@ jobs:
112129
env:
113130
SEMGREP_RULES: p/default
114131
132+
# https://woodruffw.github.io/zizmor/
133+
zizmor:
134+
name: zizmor
135+
runs-on: ubuntu-24.04
136+
permissions:
137+
security-events: write
138+
steps:
139+
- name: Checkout repository
140+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
141+
with:
142+
persist-credentials: false
143+
- name: Run zizmor 🌈
144+
uses: docker://ghcr.io/woodruffw/zizmor:1.4.1
145+
with:
146+
args: --min-severity low .
147+
env:
148+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
149+
115150
complete:
116151
name: Static Analysis (complete)
117152
needs:
@@ -121,6 +156,7 @@ jobs:
121156
- 'semgrep'
122157
- 'dd-software-composition-analysis'
123158
- 'dd-static-analysis'
159+
- 'zizmor'
124160
runs-on: ubuntu-24.04
125161
steps:
126162
- run: echo "Done"

‎.github/workflows/codeql-analysis.yml

+5
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
# The branches below must be a subset of the branches above
88
branches: [ master ]
99

10+
# Default permissions for all jobs
11+
permissions: {}
12+
1013
jobs:
1114
analyze:
1215
name: Analyze
@@ -26,6 +29,8 @@ jobs:
2629
steps:
2730
- name: Checkout repository
2831
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
32+
with:
33+
persist-credentials: false
2934

3035
# Initializes the CodeQL tools for scanning.
3136
- name: Initialize CodeQL

‎.github/workflows/generate-supported-versions.yml

+2
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ jobs:
1515
steps:
1616
- name: Checkout code
1717
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
18+
with:
19+
persist-credentials: false
1820

1921
- name: Set up Ruby
2022
uses: ruby/setup-ruby@8388f20e6a9c43cd241131b678469a9f89579f37 # v1.216.0

‎.github/workflows/lock-dependency.yml

+8
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ concurrency:
1212
group: ${{ github.workflow }}-${{ github.ref }}
1313
cancel-in-progress: true
1414

15+
# Default permissions for all jobs
16+
permissions: {}
17+
1518
jobs:
1619
dependency:
1720
name: Dependency changes
@@ -20,6 +23,8 @@ jobs:
2023
changes: ${{ steps.changes.outputs.dependencies }}
2124
steps:
2225
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
with:
27+
persist-credentials: false
2328
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2429
id: changes
2530
with:
@@ -62,6 +67,8 @@ jobs:
6267
BUNDLE_WITHOUT: check
6368
steps:
6469
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
70+
with:
71+
persist-credentials: false
6572
- run: |
6673
ruby -v
6774
gem -v
@@ -84,6 +91,7 @@ jobs:
8491
steps:
8592
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8693
with:
94+
persist-credentials: false
8795
token: ${{ secrets.GHA_PAT }}
8896
- uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
8997
with:

‎.github/workflows/nix.yml

+5
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
branches:
99
- master
1010

11+
# Default permissions for all jobs
12+
permissions: {}
13+
1114
jobs:
1215
test:
1316
strategy:
@@ -46,6 +49,8 @@ jobs:
4649
run: |
4750
test "$(uname -m)" = "${{ matrix.platform.cpu }}"
4851
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
52+
with:
53+
persist-credentials: false
4954
- uses: DeterminateSystems/nix-installer-action@dea7810afd9d4c98556c8ec68cf361bd5b648eaa # main
5055
- name: Print ruby version
5156
run: |

‎.github/workflows/parametric-tests.yml

+7-1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ on:
1111
schedule:
1212
- cron: "00 04 * * 2-6"
1313

14+
# Default permissions for all jobs
15+
permissions: {}
16+
1417
jobs:
1518
changes:
1619
name: Changes
@@ -20,6 +23,8 @@ jobs:
2023
steps:
2124
- name: Checkout
2225
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
with:
27+
persist-credentials: false
2328
- name: Changes
2429
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2530
id: changes
@@ -46,6 +51,7 @@ jobs:
4651
- run: mkdir binaries/
4752
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4853
with:
54+
persist-credentials: false
4955
path: binaries/dd-trace-rb/
5056
- name: Upload artifact
5157
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
@@ -59,7 +65,7 @@ jobs:
5965
- changes
6066
if: ${{ needs.changes.outputs.changes == 'true' }}
6167
uses: DataDog/system-tests/.github/workflows/run-parametric.yml@main
62-
secrets: inherit
68+
secrets: inherit # zizmor: ignore[secrets-inherit]
6369
with:
6470
library: ruby
6571
binaries_artifact: system_tests_binaries

‎.github/workflows/publish.yml

+9
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on: workflow_dispatch
55

66
concurrency: "rubygems" # Only one publish job at a time
77

8+
# Default permissions for all jobs
9+
permissions: {}
10+
811
jobs:
912
verify-checks:
1013
name: Verify commit status checks
@@ -15,6 +18,8 @@ jobs:
1518
version: ${{ steps.version.outputs.version }}
1619
steps:
1720
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
with:
22+
persist-credentials: false
1823
- uses: ruby/setup-ruby@8388f20e6a9c43cd241131b678469a9f89579f37 # v1.216.0
1924
with:
2025
ruby-version: '3.3.7'
@@ -109,6 +114,8 @@ jobs:
109114
SKIP_SIMPLECOV: 1
110115
steps:
111116
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
117+
with:
118+
persist-credentials: false
112119
- name: Set up Ruby
113120
uses: ruby/setup-ruby@8388f20e6a9c43cd241131b678469a9f89579f37 # v1.216.0
114121
with:
@@ -151,6 +158,7 @@ jobs:
151158
steps:
152159
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
153160
with:
161+
persist-credentials: false
154162
fetch-depth: 0
155163
- name: Set up Ruby
156164
uses: ruby/setup-ruby@8388f20e6a9c43cd241131b678469a9f89579f37 # v1.216.0
@@ -265,6 +273,7 @@ jobs:
265273
steps:
266274
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
267275
with:
276+
persist-credentials: false
268277
token: ${{ secrets.GHA_PAT }}
269278
fetch-depth: 0
270279
- run: |

‎.github/workflows/pull-request-labeler.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: "Pull Request Labeler"
22
on:
3-
- pull_request_target
3+
- pull_request_target # zizmor: ignore[dangerous-triggers]
44

55
jobs:
66
triage:

0 commit comments

Comments
 (0)