Compare commits

..
Author SHA1 Message Date
dependabot[bot]andGitHub 22c92ffeec Bump @octokit/plugin-rest-endpoint-methods from 16.0.0 to 17.0.0
Bumps [@octokit/plugin-rest-endpoint-methods](https://github.com/octokit/plugin-rest-endpoint-methods.js) from 16.0.0 to 17.0.0.
- [Release notes](https://github.com/octokit/plugin-rest-endpoint-methods.js/releases)
- [Commits](https://github.com/octokit/plugin-rest-endpoint-methods.js/compare/v16.0.0...v17.0.0)

---
updated-dependencies:
- dependency-name: "@octokit/plugin-rest-endpoint-methods"
  dependency-version: 17.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-02-02 04:46:42 +00:00
eifinger-botandGitHub 4919ec5cf1 fix: persist credentials for git push in update-major-minor-tags workflow (#312)
## Problem

After upgrading to `actions/checkout@v6`, the `update-major-minor-tags`
workflow fails with:

```
fatal: could not read Username for 'https://github.com': No such device or address
```

Example:
https://github.com/astral-sh/ruff-action/actions/runs/21509988231/job/61974754475

## Root Cause

`actions/checkout@v6` changed the behavior of `persist-credentials:
false`. In v6, credentials are immediately cleaned up after checkout,
whereas in v5 they remained available during the job.

The workflow sets `persist-credentials: false` and then tries to `git
push` — but the auth credentials are already gone.

## Fix

Explicitly set `persist-credentials: true` (removing the `false` value).
The workflow already has minimal permissions (`contents: write`) scoped
only to this job, so this is safe.

Added a `zizmor: ignore[artipacked]` comment in case the security linter
flags this pattern.
2026-01-30 19:43:42 +01:00
eifinger-botandGitHub 1977806bc6 ci: add zizmor security linting (#313)
## Summary

Adds [zizmor](https://github.com/woodruffw/zizmor) security linting to
the CI workflow to scan GitHub Actions workflows for security issues.

## Changes

- Added `permissions: security-events: write` to the `lint` job
(required for zizmor)
- Added `zizmorcore/zizmor-action@v0.4.1` step after actionlint

Mirrors the setup in
[astral-sh/setup-uv](https://github.com/astral-sh/setup-uv/blob/803947b9bd8e9f986429fa0c5a41c367cd732b41/.github/workflows/test.yml#L29-L30).
2026-01-30 18:37:28 +00:00
4 changed files with 26 additions and 7 deletions
+4
View File
@@ -15,12 +15,16 @@ permissions: {}
jobs:
lint:
runs-on: ubuntu-latest
permissions:
security-events: write # for zizmor
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Actionlint
uses: eifinger/actionlint-action@447fbfe7533062b7a9ea55f790f2396fba6d052a # v1.10.0
- name: Run zizmor
uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95 # v0.4.1
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
with:
node-version: "20"
@@ -18,7 +18,7 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
persist-credentials: true
- name: Update Major Minor Tags
run: |
set -x
+20 -5
View File
@@ -14,7 +14,7 @@
"@actions/tool-cache": "^2.0.2",
"@octokit/core": "^7.0.3",
"@octokit/plugin-paginate-rest": "^13.1.1",
"@octokit/plugin-rest-endpoint-methods": "^16.0.0",
"@octokit/plugin-rest-endpoint-methods": "^17.0.0",
"@renovatebot/pep440": "^4.2.1",
"smol-toml": "^1.6.0"
},
@@ -1210,12 +1210,12 @@
}
},
"node_modules/@octokit/plugin-rest-endpoint-methods": {
"version": "16.0.0",
"resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-16.0.0.tgz",
"integrity": "sha512-kJVUQk6/dx/gRNLWUnAWKFs1kVPn5O5CYZyssyEoNYaFedqZxsfYs7DwI3d67hGz4qOwaJ1dpm07hOAD1BXx6g==",
"version": "17.0.0",
"resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
"integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
"license": "MIT",
"dependencies": {
"@octokit/types": "^14.1.0"
"@octokit/types": "^16.0.0"
},
"engines": {
"node": ">= 20"
@@ -1224,6 +1224,21 @@
"@octokit/core": ">=6"
}
},
"node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
"version": "27.0.0",
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
"integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
"license": "MIT"
},
"node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
"version": "16.0.0",
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
"integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
"license": "MIT",
"dependencies": {
"@octokit/openapi-types": "^27.0.0"
}
},
"node_modules/@octokit/request": {
"version": "10.0.3",
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.3.tgz",
+1 -1
View File
@@ -31,7 +31,7 @@
"@actions/tool-cache": "^2.0.2",
"@octokit/core": "^7.0.3",
"@octokit/plugin-paginate-rest": "^13.1.1",
"@octokit/plugin-rest-endpoint-methods": "^16.0.0",
"@octokit/plugin-rest-endpoint-methods": "^17.0.0",
"@renovatebot/pep440": "^4.2.1",
"smol-toml": "^1.6.0"
},