Skip to content

Commit 2a76c84

Browse files
mandreko-bitwardenvgrassia
mandreko-bitwarden
and
vgrassia
authored
Add Zizmor to bwwl (#167)
Co-authored-by: Vince Grassia <[email protected]>
1 parent 93fa3c6 commit 2a76c84

File tree

13 files changed

+795
-287
lines changed

13 files changed

+795
-287
lines changed

‎.github/workflows/examples/ci.yaml‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,32 +5,35 @@
55
name: CI
66

77
on:
8-
workflow_dispatch: # Allows you to run this workflow manually from the Actions tab
8+
workflow_dispatch: # Allows you to run this workflow manually from the Actions tab
99
workflow_call: # Allows this workflow to be called from another workflow
10-
pull_request: # When a pull request event occurs
10+
pull_request: # When a pull request event occurs
1111

12-
permissions: # Sets permissions of the GITHUB_TOKEN
13-
checks: write # Permits an action to create a check run
14-
contents: read # For actions to fetch code and list commits
15-
packages: read # For actions to fetch packages
16-
id-token: write # Required to fetch an OpenID Connect (OIDC) token
17-
pull-requests: write # Permits an action to add a label to a pull request
12+
permissions: {} # Sets default permissions of the GITHUB_TOKEN
1813

1914
jobs:
2015
version:
2116
name: Calculate version
22-
uses: ./.github/workflows/examples/example-references/_version.yml # Path to an existing github action
17+
permissions:
18+
contents: read # For actions/checkout to fetch code
19+
uses: ./.github/workflows/examples/example-references/_version.yml # Path to an existing github action
2320

2421
test:
2522
name: Run test
23+
permissions:
24+
checks: write
25+
contents: read
26+
pull-requests: write
2627
uses: ./.github/workflows/examples/example-references/_test.yml
27-
with: # Parameters specific to this action that need to be defined in order for the step to be completed
28+
with: # Parameters specific to this action that need to be defined in order for the step to be completed
2829
project-name: Billing.Test
2930
project-path: ./test/Billing.Test
3031

3132
build:
3233
name: Run build
33-
needs: # This job will not run until test and version jobs are complete
34+
permissions:
35+
contents: read
36+
needs: # This job will not run until test and version jobs are complete
3437
- test
3538
- version
3639
uses: ./.github/workflows/examples/example-references/_build.yml
@@ -41,6 +44,9 @@ jobs:
4144

4245
build-push-docker:
4346
name: Build Docker image
47+
permissions:
48+
contents: read
49+
id-token: write
4450
needs:
4551
- test
4652
- version

‎.github/workflows/examples/example.yaml‎

Lines changed: 103 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -7,129 +7,120 @@
77
name: Build
88

99
permissions: # Sets permissions of the GITHUB_TOKEN (Can be set at the workflow level or job level)
10-
contents: read
11-
# More info: https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions
10+
contents: read
11+
# More info: https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions
1212

1313
on: # Describes when to run the workflow
14-
# https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows
14+
# https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows
1515

16-
workflow_dispatch: # When triggered manually
16+
workflow_dispatch: # When triggered manually
1717

18-
push: # On push to the following branches. Temporarily add a development branch to prompt workflow runs for troubleshooting
19-
branches: ["main", "rc", "hotfix-rc"]
20-
paths-ignore: # Updates to these directories or files will not trigger a workflow run
21-
- ".github/workflows/**"
18+
push: # On push to the following branches. Temporarily add a development branch to prompt workflow runs for troubleshooting
19+
branches: ["main", "rc", "hotfix-rc"]
20+
paths-ignore: # Updates to these directories or files will not trigger a workflow run
21+
- ".github/workflows/**"
2222

23-
# Pull_request_target: #We strongly discourage using this unless absolutely necessary as it requires access to certain Github secrets.
24-
# If using this, include the .github/workflows/check-run.yml job and target only the main branch
25-
# More info at https://github.blog/news-insights/product-news/github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks
23+
# Pull_request_target: #We strongly discourage using this unless absolutely necessary as it requires access to certain Github secrets.
24+
# If using this, include the .github/workflows/check-run.yml job and target only the main branch
25+
# More info at https://github.blog/news-insights/product-news/github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks
2626

27-
pull_request: # When a pull request event occurs
28-
types:
29-
[
30-
opened,
31-
synchronize,
32-
unlabeled,
33-
labeled,
34-
unlabeled,
35-
reopened,
36-
edited,
37-
]
38-
branches: ["main"] # Branches where a pull request will trigger the workflow
27+
pull_request: # When a pull request event occurs
28+
types:
29+
[opened, synchronize, unlabeled, labeled, unlabeled, reopened, edited]
30+
branches: ["main"] # Branches where a pull request will trigger the workflow
3931

40-
release: # Runs your workflow when release activity in your repository occurs
41-
types: [published, created]
32+
release: # Runs your workflow when release activity in your repository occurs
33+
types: [published, created]
4234

43-
merge_group: # Runs required status checks on merge groups created by merge queue
44-
types: [checks_requested]
35+
merge_group: # Runs required status checks on merge groups created by merge queue
36+
types: [checks_requested]
4537

46-
repository_dispatch: # Runs when a webook event triggers a workflow from outside of github
47-
types: [contentful-publish] # Optional, limit repository dispatch events to those in a specified list
38+
repository_dispatch: # Runs when a webook event triggers a workflow from outside of github
39+
types: [contentful-publish] # Optional, limit repository dispatch events to those in a specified list
4840

49-
workflow_call: # Workflow can be called by another workflow
41+
workflow_call: # Workflow can be called by another workflow
5042

5143
env: # Environment variables set for this step but not accessible by all workflows, steps or jobs.
52-
_AZ_REGISTRY: "ACMEprod.azurecr.io"
53-
INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
44+
_AZ_REGISTRY: "ACMEprod.azurecr.io"
45+
INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
5446

5547
jobs: # A workflow run is made up of one or more jobs that can run sequentially or in parallel
56-
first-job:
57-
name: First Job Name
58-
uses: ./.github/workflows/examples/example-references/_version.yml # Path to an existing github action
59-
if: github.event.pull_request.draft == false # prevent part of a job from running on a draft PR
60-
secrets: inherit # When called by another workflow, pass all the calling workflow's secrets to the called workflow
61-
# "secrets" is only available for a reusable workflow call with "uses"
62-
strategy: # Create multiple job runs for each of a set of variables
63-
fail-fast: false # If true, cancel entire run if any job in the matrix fails
64-
matrix: # Matrix of variables used to define multiple job runs
65-
include:
66-
- project_name: Admin
67-
base_path: ./src
68-
node: true # Enables steps with if: ${{ matrix.node }}
69-
70-
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
71-
permissions: # Sets permissions of the GITHUB_TOKEN
72-
security-events: write # Allow actions to upload results to Github
73-
id-token: write # Required to fetch an OpenID Connect (OIDC) token
74-
contents: read # For actions/checkout to fetch code
75-
deployments: write # Permits an action to create a new deployment
76-
issues: write # Permits an action to create a new issue
77-
checks: write # Permits an action to create a check run
78-
actions: write # Permits an action to cancel a workflow run
79-
packages: read # Permits an action to access packages on GitHub Packages
80-
pull-requests: write # Permits an action to add a label to a pull request
81-
82-
# steps: when a reusable workflow is called with "uses", "steps" is not available
83-
second-job:
84-
name: Second Job Name
85-
runs-on: ubuntu-22.04 # The type of runner that the job will run on, not available if "uses" is used
86-
permissions:
87-
contents: read
88-
id-token: write # Required to fetch an OpenID Connect (OIDC) token
89-
defaults:
90-
run: # Set the default shell and working directory
91-
shell: bash
92-
working-directory: "home/WorkingDirectory"
93-
94-
needs:
95-
- first-job # This job will wait until first-job completes
96-
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/setting-a-default-shell-and-working-directory
97-
steps:
98-
# Using Azure go obtain secrets from Azure Key Vault
99-
- name: Log in to Azure
100-
uses: bitwarden/gh-actions/azure-login@main
101-
with:
102-
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
103-
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
104-
client_id: ${{ secrets.AZURE_CLIENT_ID }}
105-
106-
# Obtain the Key Vault secrets and use them later via GitHub outputs
107-
- name: Get Azure Key Vault secrets
108-
id: get-kv-secrets
109-
uses: bitwarden/gh-actions/get-keyvault-secrets@main
110-
with:
111-
keyvault: gh-REPOSITORY_NAME_EXAMPLE # The name of the Azure Key Vault created for this repossitory
112-
secrets: "SECRETS-OR-CREDENTIALS,ANOTHER-SECRET" # Comma-separated list of secrets to retrieve from Azure Key Vault
113-
114-
# Logout to remove access to Azure Key Vault secrets
115-
- name: Log out from Azure
116-
uses: bitwarden/gh-actions/azure-logout@main
117-
118-
- name: Descriptive step name
119-
# NOT RECOMMENDED if: always() # run even if previous steps failed or the workflow is canceled, this can cause a workflow run to hang indefinitely
120-
if: failure() # run when any previous step of a job fails
121-
# if: '!cancelled()' # run even if previous steps failed
122-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 Always pin a public action version to a full git SHA, followed by the version number in a comment. Version pins are insecure and can introduce vulnerabilities into workflows.
123-
with: # Parameters specific to this action that need to be defined in order for the step to be completed
124-
fetch-depth: 0 # Full git history for actions that rely on whether a change has occurred
125-
ref: ${{ github.event.pull_request.head.sha }}
126-
creds: ${{ steps.get-kv-secrets.outputs.SECRETS-OR-CREDENTIALS }} # Use the secrets retrieved from Azure Key Vault in the previous step
127-
- name: Another descriptive step name
128-
# Run a script instead of an existing github action
129-
run: |
130-
whoami
131-
dotnet --info
132-
node --version
133-
npm --version
134-
echo "GitHub ref: $GITHUB_REF"
135-
echo "GitHub event: $GITHUB_EVENT"
48+
first-job:
49+
name: First Job Name
50+
uses: ./.github/workflows/examples/example-references/_version.yml # Path to an existing github action
51+
if: github.event.pull_request.draft == false # prevent part of a job from running on a draft PR
52+
strategy: # Create multiple job runs for each of a set of variables
53+
fail-fast: false # If true, cancel entire run if any job in the matrix fails
54+
matrix: # Matrix of variables used to define multiple job runs
55+
include:
56+
- project_name: Admin
57+
base_path: ./src
58+
node: true # Enables steps with if: ${{ matrix.node }}
59+
60+
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
61+
permissions: # Sets permissions of the GITHUB_TOKEN
62+
security-events: write # Allow actions to upload results to Github
63+
id-token: write # Required to fetch an OpenID Connect (OIDC) token
64+
contents: read # For actions/checkout to fetch code
65+
deployments: write # Permits an action to create a new deployment
66+
issues: write # Permits an action to create a new issue
67+
checks: write # Permits an action to create a check run
68+
actions: write # Permits an action to cancel a workflow run
69+
packages: read # Permits an action to access packages on GitHub Packages
70+
pull-requests: write # Permits an action to add a label to a pull request
71+
72+
# steps: when a reusable workflow is called with "uses", "steps" is not available
73+
second-job:
74+
name: Second Job Name
75+
runs-on: ubuntu-22.04 # The type of runner that the job will run on, not available if "uses" is used
76+
permissions:
77+
contents: read
78+
id-token: write # Required to fetch an OpenID Connect (OIDC) token
79+
defaults:
80+
run: # Set the default shell and working directory
81+
shell: bash
82+
working-directory: "home/WorkingDirectory"
83+
84+
needs:
85+
- first-job # This job will wait until first-job completes
86+
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/setting-a-default-shell-and-working-directory
87+
steps:
88+
# Using Azure go obtain secrets from Azure Key Vault
89+
- name: Log in to Azure
90+
uses: bitwarden/gh-actions/azure-login@main
91+
with:
92+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
93+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
94+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
95+
96+
# Obtain the Key Vault secrets and use them later via GitHub outputs
97+
- name: Get Azure Key Vault secrets
98+
id: get-kv-secrets
99+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
100+
with:
101+
keyvault: gh-REPOSITORY_NAME_EXAMPLE # The name of the Azure Key Vault created for this repossitory
102+
secrets: "SECRETS-OR-CREDENTIALS,ANOTHER-SECRET" # Comma-separated list of secrets to retrieve from Azure Key Vault
103+
104+
# Logout to remove access to Azure Key Vault secrets
105+
- name: Log out from Azure
106+
uses: bitwarden/gh-actions/azure-logout@main
107+
108+
- name: Descriptive step name
109+
# NOT RECOMMENDED if: always() # run even if previous steps failed or the workflow is canceled, this can cause a workflow run to hang indefinitely
110+
if: failure() # run when any previous step of a job fails
111+
# if: '!cancelled()' # run even if previous steps failed
112+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 Always pin a public action version to a full git SHA, followed by the version number in a comment. Version pins are insecure and can introduce vulnerabilities into workflows.
113+
with: # Parameters specific to this action that need to be defined in order for the step to be completed
114+
persist-credentials: false # Do not persist the token used to fetch the repository, more secure
115+
fetch-depth: 0 # Full git history for actions that rely on whether a change has occurred
116+
ref: ${{ github.event.pull_request.head.sha }}
117+
creds: ${{ steps.get-kv-secrets.outputs.SECRETS-OR-CREDENTIALS }} # Use the secrets retrieved from Azure Key Vault in the previous step
118+
- name: Another descriptive step name
119+
# Run a script instead of an existing github action
120+
run: |
121+
whoami
122+
dotnet --info
123+
node --version
124+
npm --version
125+
echo "GitHub ref: $GITHUB_REF"
126+
echo "GitHub event: $GITHUB_EVENT"

‎.github/workflows/examples/pull_request_target.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@
77
name: Build Thing on PR Target
88

99
permissions:
10-
checks: read
10+
checks: read
1111
contents: read
1212

1313
on:
14-
pull_request_target:
14+
pull_request_target: # zizmor: ignore[dangerous-triggers]
1515
types: [opened, synchronize, reopened]
1616
branches:
1717
- main
@@ -30,4 +30,3 @@ jobs:
3030
needs: check-run
3131
if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
3232
uses: ./.github/workflows/examples/ci.yaml
33-
secrets: inherit

0 commit comments

Comments
 (0)