Skip to content

ci: fix zizmor policy failures #657

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Bowei Du (bowei) merged 2 commits into from
Jul 31, 2026
+9 −5
Merged

ci: fix zizmor policy failures #657

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b58da81
ci: pin the workflow's actions to commit hashes
BenTheElder Jul 31, 2026
e1b456f
ci: grant the workflow least-privilege token permissions
BenTheElder Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions .github/workflows/pr-workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,18 @@ on:
# evicts caches idle for 7 days). The push-to-main run populates the cache that
# PRs inherit; this refreshes it so PRs keep hitting it (no asset re-download).
- cron: '37 4 * * 1'
# Nothing here writes to the repository: the jobs check the tree out, build it,
# and run it in a throwaway cluster.
permissions:
contents: read
jobs:
run-tests:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
- name: Setup Go
uses: actions/setup-go@v5
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: 'go.mod'
- run: go test -v ./...
Expand All @@ -52,9 +56,9 @@ jobs:
name: e2e-test (${{ matrix.ateapi-client-auth }})
steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
- name: Setup Go
uses: actions/setup-go@v5
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: 'go.mod'
- name: Free disk space
Expand All @@ -65,7 +69,7 @@ jobs:
df -h /
- name: Cache micro-VM assets
id: microvm-assets
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
# Assembling the assets (download kata-static + cloud-hypervisor + the
# prebuilt virtiofsd — all downloads on amd64) is fully pinned by assemble.sh,
Expand Down
Loading