summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStepSecurity Bot <[email protected]>2022-11-25 10:26:10 +0000
committerHiroshi SHIBATA <[email protected]>2022-11-25 20:12:23 +0900
commite15cd01149afe4924460f81cb6e27dd96de06657 ()
treed95d0bc97f0ec1300a85892b5a01d29a66b2673f
parent8a50db7dfa9383326854ddfa47c7003722567d61 (diff)
[StepSecurity] ci: Harden Actions
Signed-off-by: StepSecurity Bot <[email protected]>
Notes: Merged: https://.com/ruby/ruby/pull/6810
-rw-r--r--./workflows/baseruby.yml8
-rw-r--r--./workflows/bundled_gems.yml4
-rw-r--r--./workflows/check_dependencies.yml6
-rw-r--r--./workflows/check_misc.yml6
-rw-r--r--./workflows/cirrus-notify.yml4
-rw-r--r--./workflows/codeql-analysis.yml10
-rw-r--r--./workflows/compilers.yml6
-rw-r--r--./workflows/macos.yml6
-rw-r--r--./workflows/mingw.yml8
-rw-r--r--./workflows/mjit-bindgen.yml8
-rw-r--r--./workflows/mjit.yml6
-rw-r--r--./workflows/spec_guards.yml6
-rw-r--r--./workflows/ubuntu.yml6
-rw-r--r--./workflows/wasm.yml2
-rw-r--r--./workflows/windows.yml14
-rw-r--r--./workflows/yjit-ubuntu.yml8
16 files changed, 54 insertions, 54 deletions
@@ -40,12 +40,12 @@ jobs:
- ruby-3.1
steps:
- - uses: actions/checkout@v3
- - uses: actions/cache@v3
with:
path: .downloaded-cache
key: downloaded-cache
- - uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
bundler: none
@@ -57,7 +57,7 @@ jobs:
- run: make incs
- run: make all
- run: make test
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -29,9 +29,9 @@ jobs:
echo "GNUMAKEFLAGS=-j$((1 + $(nproc --all)))" >> $_ENV
echo "TODAY=$(date +%F)" >> $_ENV
- - uses: actions/checkout@v3
- - uses: actions/cache@v3
with:
path: .downloaded-cache
key: downloaded-cache-${{ .sha }}
@@ -45,8 +45,8 @@ jobs:
run: |
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
- - uses: actions/cache@v3
with:
path: .downloaded-cache
key: downloaded-cache
@@ -56,7 +56,7 @@ jobs:
- run: make all golf
- run: ruby tool/update-deps --fix
- run: git diff --no-ext-diff --ignore-submodules --exit-code
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -9,7 +9,7 @@ jobs:
checks:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v3
- name: Check if C-sources are US-ASCII
run: |
! grep -r -n '[^ -~]' *.[chy] include internal win32/*.[ch]
@@ -23,7 +23,7 @@ jobs:
done | grep -F .
working-directory: include
- - uses: actions/cache@v3
with:
path: .downloaded-cache
key: downloaded-cache-${{ .sha }}
@@ -98,7 +98,7 @@ jobs:
GIT_COMMITTER_NAME: git
if: ${{ .repository == 'ruby/ruby' && !startsWith(.event_name, 'pull') && steps.diff.outcome == 'failure' }}
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -13,7 +13,7 @@ jobs:
&& .event.check_suite.head_branch == 'master'
runs-on: ubuntu-latest
steps:
- - uses: octokit/[email protected]
id: get_failed_check_run
with:
route: GET /repos/${{ .repository }}/check-suites/${{ .event.check_suite.id }}/check-runs?status=completed
@@ -28,7 +28,7 @@ jobs:
env:
CHECK_RUNS: ${{ steps.get_failed_check_run.outputs.data }}
run: echo "$CHECK_RUNS"
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -43,9 +43,9 @@ jobs:
sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev libreadline6-dev zlib1g-dev libncurses5-dev libffi-dev bison autoconf ruby
- name: Checkout repository
- uses: actions/checkout@v3
- - uses: actions/cache@v3
with:
path: .downloaded-cache
key: downloaded-cache
@@ -54,7 +54,7 @@ jobs:
run: sudo rm /usr/lib/ruby/vendor_ruby/rubygems/defaults/operating_system.rb
- name: Initialize CodeQL
- uses: /codeql-action/init@v2
with:
config-file: ././codeql/codeql-config.yml
@@ -62,7 +62,7 @@ jobs:
run: echo "GNUMAKEFLAGS=-j$((1 + $(nproc --all)))" >> $_ENV
- name: Autobuild
- uses: /codeql-action/autobuild@v2
- name: Perform CodeQL Analysis
- uses: /codeql-action/analyze@v2
@@ -231,10 +231,10 @@ jobs:
- name: setenv
run: |
echo "GNUMAKEFLAGS=-sj$((1 + $(nproc --all)))" >> $_ENV
- - uses: actions/checkout@v3
with:
path: src
- - uses: actions/cache@v3
with:
path: src/.downloaded-cache
key: downloaded-cache
@@ -268,7 +268,7 @@ jobs:
- run: make test-annocheck
if: ${{ matrix.entry.check && endsWith(matrix.entry.name, 'annocheck') }}
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -41,10 +41,10 @@ jobs:
run: |
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
with:
path: src
- - uses: actions/cache@v3
with:
path: src/.downloaded-cache
key: downloaded-cache
@@ -86,7 +86,7 @@ jobs:
PRECHECK_BUNDLED_GEMS: "no"
if: ${{ matrix.test_task == 'check' && matrix.skipped_tests != '' }}
continue-on-error: ${{ matrix.continue-on-skipped_tests || false }}
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -57,15 +57,15 @@ jobs:
git config --global core.eol lf
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
with:
path: src
- - uses: actions/cache@v3
with:
path: src/.downloaded-cache
key: downloaded-cache
- name: Set up Ruby & MSYS2
- uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.base_ruby }}
- name: set env
@@ -151,7 +151,7 @@ jobs:
make ${{ StartsWith(matrix.test_task, 'spec/') && matrix.test_task || 'test-spec' }}
if: ${{matrix.test_task == 'check' || matrix.test_task == 'test-spec' || StartsWith(matrix.test_task, 'spec/')}}
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -48,17 +48,17 @@ jobs:
bison autoconf
sudo apt-get install -q -y pkg-config || :
- name: Set up Ruby
- uses: ruby/setup-ruby@v1
with:
ruby-version: '3.1'
- name: git config
run: |
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
with:
path: src
- - uses: actions/cache@v3
with:
path: src/.downloaded-cache
key: downloaded-cache
@@ -77,7 +77,7 @@ jobs:
- run: make ${{ matrix.task }}
- run: git diff --exit-code
working-directory: src
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -46,10 +46,10 @@ jobs:
run: |
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
with:
path: src
- - uses: actions/cache@v3
with:
path: src/.downloaded-cache
key: downloaded-cache
@@ -84,7 +84,7 @@ jobs:
ulimit -c unlimited
make -s test-spec RUN_OPTS="$RUN_OPTS"
timeout-minutes: 60
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -28,8 +28,8 @@ jobs:
- ruby-3.1
steps:
- - uses: actions/checkout@v3
- - uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
bundler: none
@@ -38,7 +38,7 @@ jobs:
working-directory: spec/ruby
env:
CHECK_S: true
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -72,10 +72,10 @@ jobs:
run: |
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
with:
path: src
- - uses: actions/cache@v3
with:
path: src/.downloaded-cache
key: downloaded-cache
@@ -120,7 +120,7 @@ jobs:
TESTS: ${{ matrix.skipped_tests }}
if: ${{ matrix.test_task == 'check' && matrix.skipped_tests != '' }}
continue-on-error: ${{ matrix.continue-on-skipped_tests || false }}
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -51,7 +51,7 @@ jobs:
run: |
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
with:
path: src
- name: Install libraries
@@ -39,7 +39,7 @@ jobs:
steps:
- run: md build
working-directory:
- - uses: msys2/setup-msys2@v2
id: setup-msys2
with:
update: true
@@ -50,14 +50,14 @@ jobs:
shell: msys2 {0}
run: echo =$(cygpath -wa $(command -v )) >> $_ENV
if: ${{ steps.setup-msys2.outcome == 'success' }}
- - uses: actions/cache@v3
with:
path: C:\vcpkg\downloads
key: ${{ runner.os }}-vcpkg-download-${{ env.OS_VER }}-${{ .sha }}
restore-keys: |
${{ runner.os }}-vcpkg-download-${{ env.OS_VER }}-
${{ runner.os }}-vcpkg-download-
- - uses: actions/cache@v3
with:
path: C:\vcpkg\installed
key: ${{ runner.os }}-vcpkg-installed-${{ matrix.os }}-${{ .sha }}
@@ -67,7 +67,7 @@ jobs:
- name: Install libraries with vcpkg
run: |
vcpkg --triplet x64-windows install libffi libyaml openssl readline zlib
- - uses: actions/cache@v3
with:
path: C:\Users\runneradmin\AppData\Local\Temp\chocolatey
key: ${{ runner.os }}-chocolatey-${{ env.OS_VER }}-${{ .sha }}
@@ -86,10 +86,10 @@ jobs:
git config --global core.eol lf
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
with:
path: src
- - uses: actions/cache@v3
with:
path: src/.downloaded-cache
key: downloaded-cache
@@ -138,7 +138,7 @@ jobs:
env:
RUBY_TESTOPTS: -j${{env.TEST_JOBS}} --job-status=normal
timeout-minutes: 60
- - uses: ruby/[email protected]
with:
payload: |
{
@@ -27,7 +27,7 @@ jobs:
# Action's image seems to already contain a Rust 1.58.0.
runs-on: ubuntu-20.04
steps:
- - uses: actions/checkout@v3
# For now we can't run cargo test --offline because it complains about the
# capstone dependency, even though the dependency is optional
#- run: cargo test --offline
@@ -90,10 +90,10 @@ jobs:
run: |
git config --global advice.detachedHead 0
git config --global init.defaultBranch garbage
- - uses: actions/checkout@v3
with:
path: src
- - uses: actions/cache@v3
with:
path: src/.downloaded-cache
key: downloaded-cache
@@ -135,7 +135,7 @@ jobs:
BASE_REPO: ${{ .event.pull_request.base.repo.full_name }}
BASE_SHA: ${{ .event.pull_request.base.sha }}
if: ${{ matrix.test_task == 'yjit-bench' && startsWith(.event_name, 'pull') }}
- - uses: ruby/[email protected]
with:
payload: |
{