Pin the toolchain in mise.toml, pin actions by SHA, add workflow linting - #202
Merged
Conversation
trivy arrived three different ways here: an apt repo in the dev container, `curl … | sudo sh` in the scan workflow, and whatever was on PATH locally. mise.toml is now the only place a tool version is written down — python, pre-commit, trivy, jq, actionlint, shellcheck — and the dev container, the hooks and CI all install from it. The scan workflow no longer pipes an installer into sudo sh. Alongside that: - Every action reference is pinned to a commit SHA with the tag in a trailing comment, so a repointed tag cannot change what CI runs. helpers:pinGitHubActionDigests keeps the digests from rotting. - actionlint and zizmor run over .github/workflows/ as pre-commit hooks. actionlint uses the pinned shellcheck for `run:` blocks; zizmor covers the CI/CD security patterns — unpinned actions, credential persistence, template injection. - checkout sets persist-credentials: false. Nothing here pushes. - CODEOWNERS. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F9MnUHayBCrncnczqMhSVy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Makes
mise.tomlthe single source of truth for tool versions, pins every GitHub Actions reference to a commit SHA, and addsactionlint+zizmoras pre-commit hooks. Adds CODEOWNERS and the digest-pin preset torenovate.json.Why
trivy arrived three different ways. An apt repo in
.devcontainer/post-create.sh,curl -sfL … | sudo shpinned toTRIVY_VERSION: v0.74.0inscan.yml, and whatever was on PATH formake scanlocally. Nothing kept those in step, and the CI path executed whatever the fetched installer contained at that moment. Nowmise.tomlpins trivy (plus python, pre-commit, jq, actionlint, shellcheck); the dev container, the hooks and CI all install from it, and the scan workflow no longer pipes an installer intosudo sh.Actions floated on moving tags.
@v7can be repointed at new code without the pin changing. All references are now commit SHAs with the tag in a trailing comment;helpers:pinGitHubActionDigestskeeps them current so they do not rot into stale pins.Nothing linted the workflows.
actionlintchecks schema, expressions and the shell insiderun:blocks (using the pinned shellcheck, so workflow shell gets the same treatment asscripts/).zizmoraudits for CI/CD security patterns.checkoutnow setspersist-credentials: false— nothing here pushes.Checklist
make checkpasses — this PR's run is the first execution of the new setup; the sandbox this was written in has no Docker or pre-commit.env,backup.envor credential in the diff — the diff is tooling, CI and repo configuration onlyNote for review
scripts/scan-images.shis unchanged apart from its "trivy not on PATH" hint, which now points atmake tools. The 52 digest-pinned images and every compose file are untouched.🤖 Generated with Claude Code
https://claude.ai/code/session_01F9MnUHayBCrncnczqMhSVy
Generated by Claude Code