Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-07 09:42:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: pin containers to digest, enable more zizmor rules (#38779)

Browse Source 
Enable more strict "pedantic" zizmor rules and fix issues. Service
containers are pinned to hash and renovate will update them. Enabled
rules:

- https://docs.zizmor.sh/audits/#excessive-permissions
- https://docs.zizmor.sh/audits/#unpinned-images
- https://docs.zizmor.sh/audits/#template-injection

---------

Signed-off-by: silverwind <me@silverwind.io>
This commit is contained in:
silverwind
2026-08-06 07:16:07 +02:00
committed by GitHub
parent d94f714efa
commit d8c3a1afda
14 changed files with 47 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+1 -1
View File
@@ -348,7 +348,7 @@ lint-editorconfig:
.PHONY: lint-actions
lint-actions: .venv ## lint action workflow files
@$(GO) run $(ACTIONLINT_PACKAGE)
@uv run --frozen zizmor --quiet --min-confidence=medium .github
@uv run --frozen zizmor --quiet --persona=pedantic --min-confidence=medium .github
.PHONY: lint-shell
lint-shell: ## lint shell scripts