Skip to content

Address zizmor findings: #5241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
copybara-service merged 1 commit into from
Jul 31, 2026
+74 −31
Merged

Address zizmor findings: #5241

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 40 additions & 16 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,14 +30,18 @@ jobs:
name: 'Validate Dagger version'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/prechecks
bazel-build:
name: 'Bazel build'
needs: validate-latest-dagger-version
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/bazel-build
bazel-test:
name: 'Bazel tests'
Expand All @@ -46,22 +50,28 @@ jobs:
group: large-runner-group
labels: ubuntu-22.04-16core
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/bazel-test
gradle-build:
name: 'Gradle build'
runs-on:
group: large-runner-group
labels: ubuntu-22.04-16core
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/gradle-build
artifact-verification-tests:
name: 'Artifact verification tests'
needs: bazel-build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/artifact-verification-tests
run-artifact-java-local-tests:
name: 'Artifact Java local tests (Java ${{ matrix.java }}, Kotlin ${{ matrix.kotlin }})'
Expand All @@ -82,7 +92,9 @@ jobs:
USE_KOTLIN_VERSION: ${{ matrix.kotlin }}
USE_KSP_VERSION: ${{ matrix.ksp }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/artifact-java-local-tests
artifact-java-local-tests:
name: 'Artifact Java local tests'
Expand All @@ -95,7 +107,9 @@ jobs:
needs: bazel-build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/test-gradle-plugin
run-artifact-android-local-tests:
name: 'Artifact Android local tests (AGP ${{ matrix.agp }}, Java ${{ matrix.java }}, Kotlin ${{ matrix.kotlin }})'
Expand All @@ -119,7 +133,9 @@ jobs:
USE_KOTLIN_VERSION: ${{ matrix.kotlin }}
USE_KSP_VERSION: ${{ matrix.ksp }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/artifact-android-local-tests
artifact-android-local-tests:
name: 'Artifact Android local tests'
Expand All @@ -138,7 +154,9 @@ jobs:
matrix:
api-level: [23, 26, 30]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/artifact-android-emulator-tests
timeout-minutes: 35
with:
Expand All @@ -160,17 +178,19 @@ jobs:
contents: write
steps:
- name: 'Install Java ${{ env.USE_JAVA_VERSION_FOR_BAZEL }}'
uses: actions/setup-java@v4
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
with:
distribution: '${{ env.USE_JAVA_DISTRIBUTION }}'
java-version: '${{ env.USE_JAVA_VERSION_FOR_BAZEL }}'
server-id: sonatype-central-snapshots
server-username: CI_DEPLOY_USERNAME
server-password: CI_DEPLOY_PASSWORD
- name: 'Check out repository'
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- name: 'Cache local Maven repository'
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: |
~/.m2/repository
Expand All @@ -179,14 +199,14 @@ jobs:
restore-keys: |
${{ runner.os }}-maven-
- name: 'Cache Bazel files'
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: ~/.cache/bazel_github # The bazel cache path set in .bazelrc.
key: ${{ runner.os }}-bazel-build-${{ github.sha }}
restore-keys: |
${{ runner.os }}-bazel-build-
- name: 'Cache Gradle files'
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: |
~/.gradle/caches
Expand Down Expand Up @@ -221,7 +241,9 @@ jobs:
needs: bazel-build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/build-gradle-plugin
with:
agp: '+'
Expand All @@ -238,5 +260,7 @@ jobs:
]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/cleanup-caches
49 changes: 34 additions & 15 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

permissions:
contents: read

env:
USE_AGP_VERSION: '9.0.0'
USE_JAVA_DISTRIBUTION: 'zulu'
Expand All @@ -29,14 +32,18 @@ jobs:
name: 'Validate Dagger version'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/prechecks
bazel-build:
name: 'Bazel build'
needs: validate-latest-dagger-version
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/bazel-build
bazel-test:
name: 'Bazel tests'
Expand All @@ -45,35 +52,45 @@ jobs:
group: large-runner-group
labels: ubuntu-22.04-16core
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/bazel-test
artifact-verification-tests:
name: 'Artifact verification tests'
needs: bazel-build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/artifact-verification-tests
artifact-java-local-tests:
name: 'Artifact Java local tests'
needs: bazel-build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/artifact-java-local-tests
test-gradle-plugin:
name: 'Test Hilt Gradle plugin'
needs: bazel-build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/test-gradle-plugin
artifact-android-local-tests:
name: 'Artifact Android local tests'
needs: bazel-build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- uses: ./.github/actions/artifact-android-local-tests
publish-artifacts:
name: 'Publish Artifact'
Expand All @@ -89,7 +106,7 @@ jobs:
contents: write
steps:
- name: 'Install Java ${{ env.USE_JAVA_VERSION_FOR_BAZEL }}'
uses: actions/setup-java@v4
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
with:
distribution: '${{ env.USE_JAVA_DISTRIBUTION }}'
java-version: '${{ env.USE_JAVA_VERSION_FOR_BAZEL }}'
Expand All @@ -99,9 +116,11 @@ jobs:
gpg-private-key: ${{ secrets.CI_GPG_PRIVATE_KEY }}
gpg-passphrase: CI_GPG_PASSPHRASE
- name: 'Check out repository'
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
persist-credentials: false
- name: 'Cache local Maven repository'
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: |
~/.m2/repository
Expand All @@ -110,14 +129,14 @@ jobs:
restore-keys: |
${{ runner.os }}-maven-
- name: 'Cache Bazel files'
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: ~/.cache/bazel_github # The bazel cache path set in .bazelrc.
key: ${{ runner.os }}-bazel-build-${{ github.sha }}
restore-keys: |
${{ runner.os }}-bazel-build-
- name: 'Cache Gradle files'
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: |
~/.gradle/caches
Expand All @@ -129,7 +148,7 @@ jobs:
run: |
util/deploy-all.sh \
"gpg:sign-and-deploy-file" \
"${{ env.DAGGER_RELEASE_VERSION }}" \
"${DAGGER_RELEASE_VERSION}" \
"-DrepositoryId=sonatype-central-staging" \
"-Durl=https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/"
shell: bash
Expand All @@ -148,10 +167,10 @@ jobs:
git config --global user.name "Dagger Team"
shell: bash
- name: 'Publish tagged release'
run: util/publish-tagged-release.sh ${{ env.DAGGER_RELEASE_VERSION }}
run: util/publish-tagged-release.sh ${DAGGER_RELEASE_VERSION}
shell: bash
- name: 'Publish tagged docs'
run: util/publish-tagged-docs.sh ${{ env.DAGGER_RELEASE_VERSION }}
run: util/publish-tagged-docs.sh ${DAGGER_RELEASE_VERSION}
shell: bash
env:
GH_TOKEN: ${{ github.token }}
Expand Down
Loading