Merge branch 'master' into stepsecurity_remediation_1733737294

ashishb · Dec 29, 2024 · 27da181 · 27da181
2 parents 96be7ab + d7fc146
commit 27da181
Show file tree

Hide file tree

Showing 31 changed files with 99 additions and 4 deletions.
diff --git a/.github/workflows/check-goreleaser-config.yaml b/.github/workflows/check-goreleaser-config.yaml
@@ -17,6 +17,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions:
   contents: read
 

diff --git a/.github/workflows/format-go.yaml b/.github/workflows/format-go.yaml
@@ -18,6 +18,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions:
   contents: read
 

diff --git a/.github/workflows/lint-github-actions.yaml b/.github/workflows/lint-github-actions.yaml
@@ -23,6 +23,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   lintGitHubActionsWithActionLint:
     runs-on: ubuntu-latest
@@ -84,7 +88,8 @@ jobs:
         uses: actions-rust-lang/setup-rust-toolchain@11df97af8e8102fd60b60a77dfbf58d40cd843b8 # v1.10.1
 
       - name: Install zizmor
-        run: cargo install zizmor
+        # Install zizmor if it's not already installed via the Rust cache
+        run: zizmor --help || cargo install zizmor
 
       - name: Run zizmor on GitHub Actions
         run: zizmor .github/workflows/*

diff --git a/.github/workflows/lint-go.yaml b/.github/workflows/lint-go.yaml
@@ -18,6 +18,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions:
   contents: read
 

diff --git a/.github/workflows/lint-markdown.yaml b/.github/workflows/lint-markdown.yaml
@@ -19,6 +19,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions:
   contents: read
 

diff --git a/.github/workflows/lint-yaml.yaml b/.github/workflows/lint-yaml.yaml
@@ -23,6 +23,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions:
   contents: read
 

diff --git a/.github/workflows/test-go.yaml b/.github/workflows/test-go.yaml
@@ -18,6 +18,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
 permissions:
   contents: read
 

diff --git a/src/gabo/cmd/gabo/version.txt b/src/gabo/cmd/gabo/version.txt
@@ -1 +1 @@
-v1.3.0
+v1.3.1
diff --git a/src/gabo/go.mod b/src/gabo/go.mod
@@ -3,12 +3,12 @@ module github.com/ashishb/gabo/src/gabo
 go 1.20
 
 require (
+	github.com/bmatcuk/doublestar/v4 v4.7.1
 	github.com/rs/zerolog v1.33.0
 	github.com/stretchr/testify v1.10.0
 )
 
 require (
-	github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect

diff --git a/src/gabo/internal/generator/all_options.go b/src/gabo/internal/generator/all_options.go
@@ -129,7 +129,7 @@ func GetOptions() []Option {
 		},
 		_Option{
 			"Shell Script Linter", "lint-shell-script", newFileMatcher("**/*.sh", "**/*.bash"),
-			newPatternMatcher("shellcheck "),
+			newPatternMatcher("shellcheck ", "action-shellcheck"),
 			newGenerator(_lintShellScriptYaml), "lint-shell-script.yaml",
 		},
 		_Option{

diff --git a/src/gabo/internal/generator/data/build-android-incomplete.yaml b/src/gabo/internal/generator/data/build-android-incomplete.yaml
@@ -27,6 +27,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   # Run locally with "act -j buildAndroid"

diff --git a/src/gabo/internal/generator/data/build-docker-incomplete.yaml b/src/gabo/internal/generator/data/build-docker-incomplete.yaml
@@ -27,6 +27,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   buildDocker:
     runs-on: ubuntu-latest

diff --git a/src/gabo/internal/generator/data/build-npm-incomplete.yaml b/src/gabo/internal/generator/data/build-npm-incomplete.yaml
@@ -17,6 +17,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   buildNpm:
     runs-on: ubuntu-latest

diff --git a/src/gabo/internal/generator/data/build-yarn-incomplete.yaml b/src/gabo/internal/generator/data/build-yarn-incomplete.yaml
@@ -17,6 +17,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   buildYarn:
     runs-on: ubuntu-latest

diff --git a/src/gabo/internal/generator/data/check-goreleaser-config.yaml b/src/gabo/internal/generator/data/check-goreleaser-config.yaml
@@ -23,6 +23,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   checkGoReleaserConfig:

diff --git a/src/gabo/internal/generator/data/compress-images.yaml b/src/gabo/internal/generator/data/compress-images.yaml
@@ -23,6 +23,9 @@ jobs:
 
     name: Compress Images using Calibre
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     timeout-minutes: 15
 
     steps:

diff --git a/src/gabo/internal/generator/data/format-go.yaml b/src/gabo/internal/generator/data/format-go.yaml
@@ -18,6 +18,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   validateCodeFormatGo:

diff --git a/src/gabo/internal/generator/data/format-python.yaml b/src/gabo/internal/generator/data/format-python.yaml
@@ -18,6 +18,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   formatPython:
     runs-on: ubuntu-latest

diff --git a/src/gabo/internal/generator/data/lint-android.yaml b/src/gabo/internal/generator/data/lint-android.yaml
@@ -31,6 +31,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   lintAndroid:

diff --git a/src/gabo/internal/generator/data/lint-docker.yaml b/src/gabo/internal/generator/data/lint-docker.yaml
@@ -17,6 +17,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   # Run this locally with act - https://github.com/nektos/act
   # act -j lintDocker

diff --git a/src/gabo/internal/generator/data/lint-github-actions.yaml b/src/gabo/internal/generator/data/lint-github-actions.yaml
@@ -19,6 +19,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   lintGitHubActionsWithActionLint:
     runs-on: ubuntu-latest

diff --git a/src/gabo/internal/generator/data/lint-go-incomplete.yaml b/src/gabo/internal/generator/data/lint-go-incomplete.yaml
@@ -18,6 +18,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   # Run it locally with https://github.com/nektos/act

diff --git a/src/gabo/internal/generator/data/lint-html.yaml b/src/gabo/internal/generator/data/lint-html.yaml
@@ -19,6 +19,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   # Run this locally with act - https://github.com/nektos/act

diff --git a/src/gabo/internal/generator/data/lint-markdown.yaml b/src/gabo/internal/generator/data/lint-markdown.yaml
@@ -19,6 +19,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   lintMarkdown:
     runs-on: ubuntu-latest

diff --git a/src/gabo/internal/generator/data/lint-python.yaml b/src/gabo/internal/generator/data/lint-python.yaml
@@ -22,6 +22,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   lintPython:
     runs-on: ubuntu-latest

diff --git a/src/gabo/internal/generator/data/lint-shell-script.yaml b/src/gabo/internal/generator/data/lint-shell-script.yaml
@@ -21,6 +21,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   lintShellScript:

diff --git a/src/gabo/internal/generator/data/lint-solidity.yaml b/src/gabo/internal/generator/data/lint-solidity.yaml
@@ -16,6 +16,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   # Run it locally with https://github.com/nektos/act

diff --git a/src/gabo/internal/generator/data/lint-yaml.yaml b/src/gabo/internal/generator/data/lint-yaml.yaml
@@ -23,6 +23,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   lintYaml:
     runs-on: ubuntu-latest

diff --git a/src/gabo/internal/generator/data/translate-android.yaml b/src/gabo/internal/generator/data/translate-android.yaml
@@ -19,6 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
+    # Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+    permissions:
+      contents: read
+      pull-requests: write
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

diff --git a/src/gabo/internal/generator/data/validate-openapi-schema.incomplete.yaml b/src/gabo/internal/generator/data/validate-openapi-schema.incomplete.yaml
@@ -21,6 +21,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
 
   # Run locally with "act -j validateOpenAPISchema"

diff --git a/src/gabo/internal/generator/data/validate-render-blueprint.yaml b/src/gabo/internal/generator/data/validate-render-blueprint.yaml
@@ -21,6 +21,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions:
+  contents: read
+
 jobs:
   validateRenderBlueprint:
     runs-on: ubuntu-latest