chore: harden GitHub Actions workflows against Zizmor findings (#1971)
- Pin dart-lang/ecosystem workflows to full commit SHA
- Add top-level permissions: contents: read where missing
- Set persist-credentials: false on actions/checkout steps
- Add cooldown to dependabot configuration
- Ignore dangerous-triggers for post_summaries workflow_run
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7c3a9d9..d9f0e46 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,3 +13,5 @@
github-actions:
patterns:
- "*"
+ cooldown:
+ default-days: 7
diff --git a/.github/workflows/cronet.yml b/.github/workflows/cronet.yml
index 77483b1..fd081c1 100644
--- a/.github/workflows/cronet.yml
+++ b/.github/workflows/cronet.yml
@@ -1,4 +1,6 @@
name: package:cronet_http CI
+permissions:
+ contents: read
on:
push:
@@ -29,6 +31,8 @@
working-directory: pkgs/cronet_http
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
with:
distribution: 'zulu'
@@ -71,6 +75,8 @@
working-directory: pkgs/cronet_http
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
with:
distribution: 'zulu'
diff --git a/.github/workflows/cupertino.yml b/.github/workflows/cupertino.yml
index aa4dafa..54265b3 100644
--- a/.github/workflows/cupertino.yml
+++ b/.github/workflows/cupertino.yml
@@ -1,4 +1,6 @@
name: package:cupertino_http CI
+permissions:
+ contents: read
on:
push:
@@ -31,6 +33,8 @@
working-directory: pkgs/cupertino_http
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
with:
channel: 'stable'
@@ -58,6 +62,8 @@
os: [macos-13, macos-latest]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
@@ -80,6 +86,8 @@
flutter-version: ["3.38.1", "any"]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
with:
flutter-version: ${{ matrix.flutter-version }}
diff --git a/.github/workflows/dart.yml b/.github/workflows/dart.yml
index 5dd7e3f..fe39160 100644
--- a/.github/workflows/dart.yml
+++ b/.github/workflows/dart.yml
@@ -1,4 +1,4 @@
-# Created with package:mono_repo v6.6.3
+# Created with package:mono_repo v6.7.2
name: Dart CI
on:
push:
@@ -13,7 +13,8 @@
shell: bash
env:
PUB_ENVIRONMENT: bot.github
-permissions: read-all
+permissions:
+ contents: read
jobs:
job_001:
@@ -35,8 +36,10 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- name: mono_repo self validate
- run: dart pub global activate mono_repo 6.6.3
+ run: dart pub global activate mono_repo 6.7.2
- name: mono_repo self validate
run: dart pub global run mono_repo generate --validate
job_002:
@@ -60,6 +63,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -126,6 +131,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -192,6 +199,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -258,6 +267,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_flutter_http_example_pub_upgrade
name: pkgs/flutter_http_example; flutter pub upgrade
run: flutter pub upgrade
@@ -288,6 +299,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_flutter_http_example_pub_upgrade
name: pkgs/flutter_http_example; flutter pub upgrade
run: flutter pub upgrade
@@ -318,6 +331,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -355,6 +370,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -392,6 +409,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -429,6 +448,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -466,6 +487,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_profile_pub_upgrade
name: pkgs/http_profile; dart pub upgrade
run: dart pub upgrade
@@ -503,6 +526,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_web_socket_pub_upgrade
name: pkgs/web_socket; dart pub upgrade
run: dart pub upgrade
@@ -540,6 +565,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_web_socket_pub_upgrade
name: pkgs/web_socket; dart pub upgrade
run: dart pub upgrade
@@ -577,6 +604,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -614,6 +643,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -651,6 +682,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -688,6 +721,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -725,6 +760,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_pub_upgrade
name: pkgs/http; dart pub upgrade
run: dart pub upgrade
@@ -762,6 +799,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_http_profile_pub_upgrade
name: pkgs/http_profile; dart pub upgrade
run: dart pub upgrade
@@ -799,6 +838,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_web_socket_pub_upgrade
name: pkgs/web_socket; dart pub upgrade
run: dart pub upgrade
@@ -836,6 +877,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_web_socket_pub_upgrade
name: pkgs/web_socket; dart pub upgrade
run: dart pub upgrade
@@ -873,6 +916,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_flutter_http_example_pub_upgrade
name: pkgs/flutter_http_example; flutter pub upgrade
run: flutter pub upgrade
@@ -910,6 +955,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_flutter_http_example_pub_upgrade
name: pkgs/flutter_http_example; flutter pub upgrade
run: flutter pub upgrade
@@ -947,6 +994,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_flutter_http_example_pub_upgrade
name: pkgs/flutter_http_example; flutter pub upgrade
run: flutter pub upgrade
@@ -974,6 +1023,8 @@
- id: checkout
name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- id: pkgs_flutter_http_example_pub_upgrade
name: pkgs/flutter_http_example; flutter pub upgrade
run: flutter pub upgrade
diff --git a/.github/workflows/health.yaml b/.github/workflows/health.yaml
index 43d572e..9a036b3 100644
--- a/.github/workflows/health.yaml
+++ b/.github/workflows/health.yaml
@@ -1,4 +1,7 @@
name: Health
+permissions:
+ contents: read
+
on:
pull_request:
branches: [ master ]
@@ -6,7 +9,7 @@
jobs:
health:
- uses: dart-lang/ecosystem/.github/workflows/health.yaml@main
+ uses: dart-lang/ecosystem/.github/workflows/health.yaml@ed9c592c1d35106c0a8a52044426515017a60646
with:
sdk: dev
channel: dev
diff --git a/.github/workflows/http2.yaml b/.github/workflows/http2.yaml
index 106df91..8c30d10 100644
--- a/.github/workflows/http2.yaml
+++ b/.github/workflows/http2.yaml
@@ -1,4 +1,6 @@
name: package:http2
+permissions:
+ contents: read
on:
push:
@@ -32,6 +34,8 @@
sdk: [dev]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
@@ -55,6 +59,8 @@
sdk: [3.7, stable, dev]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
diff --git a/.github/workflows/http_multi_server.yaml b/.github/workflows/http_multi_server.yaml
index 8af6911..ed2750c 100644
--- a/.github/workflows/http_multi_server.yaml
+++ b/.github/workflows/http_multi_server.yaml
@@ -1,4 +1,6 @@
name: package:http_multi_server
+permissions:
+ contents: read
on:
push:
@@ -32,6 +34,8 @@
sdk: [dev]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
@@ -59,6 +63,8 @@
sdk: [3.2, dev]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
diff --git a/.github/workflows/http_parser.yaml b/.github/workflows/http_parser.yaml
index ccc7216..9602bdb 100644
--- a/.github/workflows/http_parser.yaml
+++ b/.github/workflows/http_parser.yaml
@@ -21,7 +21,8 @@
run:
working-directory: pkgs/http_parser/
-permissions: read-all
+permissions:
+ contents: read
jobs:
# Check code formatting and static analysis on a single OS (linux)
@@ -34,6 +35,8 @@
sdk: [dev]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
@@ -57,6 +60,8 @@
sdk: [3.4, dev]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
diff --git a/.github/workflows/okhttp.yaml b/.github/workflows/okhttp.yaml
index b3a918e..8f17836 100644
--- a/.github/workflows/okhttp.yaml
+++ b/.github/workflows/okhttp.yaml
@@ -1,4 +1,6 @@
name: package:ok_http CI
+permissions:
+ contents: read
on:
push:
@@ -29,6 +31,8 @@
working-directory: pkgs/ok_http
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
with:
distribution: 'zulu'
diff --git a/.github/workflows/post_summaries.yaml b/.github/workflows/post_summaries.yaml
index e082efe..a6d35bb 100644
--- a/.github/workflows/post_summaries.yaml
+++ b/.github/workflows/post_summaries.yaml
@@ -1,9 +1,11 @@
name: Comment on the pull request
+permissions:
+ contents: read
on:
# Trigger this workflow after the Health workflow completes. This workflow will have permissions to
# do things like create comments on the PR, even if the original workflow couldn't.
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
workflows:
- Health
- Publish
@@ -12,6 +14,6 @@
jobs:
upload:
- uses: dart-lang/ecosystem/.github/workflows/post_summaries.yaml@main
+ uses: dart-lang/ecosystem/.github/workflows/post_summaries.yaml@ed9c592c1d35106c0a8a52044426515017a60646
permissions:
pull-requests: write
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 8bd1955..6644026 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -1,6 +1,8 @@
# A CI configuration to auto-publish pub packages.
name: Publish
+permissions:
+ contents: read
on:
pull_request:
@@ -13,7 +15,7 @@
jobs:
publish:
if: ${{ github.repository_owner == 'dart-lang' }}
- uses: dart-lang/ecosystem/.github/workflows/publish.yaml@main
+ uses: dart-lang/ecosystem/.github/workflows/publish.yaml@ed9c592c1d35106c0a8a52044426515017a60646
with:
write-comments: false
permissions:
diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml
index 016e282..d4e68bf 100644
--- a/.github/workflows/pull_request_label.yml
+++ b/.github/workflows/pull_request_label.yml
@@ -5,7 +5,8 @@
# https://github.com/actions/labeler.
name: Pull Request Labeler
-permissions: read-all
+permissions:
+ contents: read
on:
pull_request_target
diff --git a/.github/workflows/web_socket_channel.yaml b/.github/workflows/web_socket_channel.yaml
index 2c4222c..968ec5d 100644
--- a/.github/workflows/web_socket_channel.yaml
+++ b/.github/workflows/web_socket_channel.yaml
@@ -1,4 +1,6 @@
name: package:web_socket_channel
+permissions:
+ contents: read
on:
push:
@@ -31,6 +33,8 @@
sdk: [dev]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
@@ -54,6 +58,8 @@
sdk: [3.3, dev]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
with:
sdk: ${{ matrix.sdk }}
@@ -75,6 +81,8 @@
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+ with:
+ persist-credentials: false
- uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260
- run: dart pub downgrade
- run: dart analyze
diff --git a/mono_repo.yaml b/mono_repo.yaml
index fea61aa..d2bf448 100644
--- a/mono_repo.yaml
+++ b/mono_repo.yaml
@@ -2,6 +2,8 @@
self_validate: analyze_and_format
github:
+ permissions:
+ contents: read
cron: "0 0 * * 0"
merge_stages:
diff --git a/tool/ci.sh b/tool/ci.sh
index a200e66..d74d54b 100755
--- a/tool/ci.sh
+++ b/tool/ci.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Created with package:mono_repo v6.6.3
+# Created with package:mono_repo v6.7.2
# Support built in commands on windows out of the box.
