diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml index eeeecf0c3..e642a6d5d 100644 --- a/.github/workflows/core.yml +++ b/.github/workflows/core.yml @@ -18,6 +18,12 @@ jobs: lit: runs-on: ubuntu-24.04 + permissions: + checks: write + contents: read + issues: read + pull-requests: write + env: ARM_UBL_ACTIVATION_CODE: ${{ secrets.ARM_UBL_ACTIVATION_CODE }} CLANG_TI_VERSION: "5.1.0.LTS" @@ -27,6 +33,8 @@ jobs: steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: actions/setup-python@v7 with: @@ -51,16 +59,16 @@ jobs: sudo ln -s /usr/bin/FileCheck-18 /usr/bin/FileCheck - name: Activate vcpkg environment - uses: ARM-software/cmsis-actions/vcpkg@v1 + uses: ARM-software/cmsis-actions/vcpkg@8a50b77681a484568e08f31fb7c2285c4735f682 # v1 with: config: ./CMSIS/Core/Test/vcpkg-configuration.json - name: Activate Arm tool license - uses: ARM-software/cmsis-actions/armlm@v1 + uses: ARM-software/cmsis-actions/armlm@8a50b77681a484568e08f31fb7c2285c4735f682 # v1 with: code: "${{ env.ARM_UBL_ACTIVATION_CODE }}" - - uses: ammaraskar/gcc-problem-matcher@master + - uses: ammaraskar/gcc-problem-matcher@cb2e3f949c41b7818628f35f8484a9b0acf90cf9 # master - name: Set TI ARM CLANG Environment Variables and Path run: | @@ -93,7 +101,7 @@ jobs: - name: Publish Test Results if: ${{ !cancelled() }} - uses: EnricoMi/publish-unit-test-result-action@v2 + uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2 with: report_individual_runs: true files: ./CMSIS/Core/Test/*.xunit diff --git a/.github/workflows/corevalidation-report.yml b/.github/workflows/corevalidation-report.yml index 5bdb619e3..56595b871 100644 --- a/.github/workflows/corevalidation-report.yml +++ b/.github/workflows/corevalidation-report.yml @@ -1,41 +1,42 @@ name: Publish CoreValidation Results on: - workflow_run: + workflow_run: # zizmor: ignore[dangerous-triggers] workflows: ["CoreValidation"] # avoid running once merged on main branch, this should be run only on PRs branches-ignore: ["main"] types: - completed +permissions: {} + jobs: publish-test-results: name: Publish Test Results runs-on: ubuntu-24.04 - if: github.event.workflow_run.conclusion != 'skipped' + if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'skipped' + + permissions: + actions: read + checks: write + contents: read + issues: read + pull-requests: write steps: - name: Download and Extract Artifacts env: - GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} + GH_REPO: ${{ github.repository }} + GH_TOKEN: ${{ github.token }} + RUN_ID: ${{ github.event.workflow_run.id }} run: | - mkdir -p artifacts && cd artifacts - - artifacts_url=${{ github.event.workflow_run.artifacts_url }} - - gh api "$artifacts_url" -q '.artifacts[] | [.name, .archive_download_url] | @tsv' | while read artifact - do - IFS=$'\t' read name url <<< "$artifact" - gh api $url > "$name.zip" - unzip -d "$name" "$name.zip" - done + gh run download "$RUN_ID" --repo "$GH_REPO" --dir artifacts - name: Publish Test Results - uses: EnricoMi/publish-unit-test-result-action@v2 + uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2 with: commit: ${{ github.event.workflow_run.head_sha }} event_file: artifacts/EventFile/event.json report_individual_runs: true event_name: ${{ github.event.workflow_run.event }} files: "artifacts/**/*.junit" - \ No newline at end of file diff --git a/.github/workflows/corevalidation.yml b/.github/workflows/corevalidation.yml index f62dab31b..50cbb18df 100644 --- a/.github/workflows/corevalidation.yml +++ b/.github/workflows/corevalidation.yml @@ -15,8 +15,16 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: build-and-run: + + permissions: + actions: read + contents: read + packages: read + security-events: write strategy: fail-fast: true @@ -35,6 +43,8 @@ jobs: steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - working-directory: /home/runner env: @@ -71,12 +81,12 @@ jobs: sudo apt-get install libtinfo6 - name: Activate vcpkg environment - uses: ARM-software/cmsis-actions/vcpkg@v1 + uses: ARM-software/cmsis-actions/vcpkg@8a50b77681a484568e08f31fb7c2285c4735f682 # v1 with: config: ./CMSIS/CoreValidation/Project/vcpkg-configuration.json - name: Activate Arm tool license - uses: ARM-software/cmsis-actions/armlm@v1 + uses: ARM-software/cmsis-actions/armlm@8a50b77681a484568e08f31fb7c2285c4735f682 # v1 with: code: "${{ env.ARM_UBL_ACTIVATION_CODE }}" @@ -87,7 +97,7 @@ jobs: languages: cpp queries: security-and-quality - - uses: ammaraskar/gcc-problem-matcher@master + - uses: ammaraskar/gcc-problem-matcher@cb2e3f949c41b7818628f35f8484a9b0acf90cf9 # master if: matrix.compiler == 'Clang' || matrix.compiler == 'Clang_TI' || matrix.compiler == 'GCC' - name: Set TI Arm Clang Environment Variables and Path @@ -145,6 +155,7 @@ jobs: event-file: needs: [build-and-run] runs-on: ubuntu-latest + permissions: {} steps: - name: Archive event file if: ${{ !cancelled() }} diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml index 0c030cbae..489c6e850 100644 --- a/.github/workflows/gh-pages.yml +++ b/.github/workflows/gh-pages.yml @@ -31,6 +31,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup Pages uses: actions/configure-pages@v6 diff --git a/.github/workflows/pack.yml b/.github/workflows/pack.yml index d5752940c..569e269a5 100644 --- a/.github/workflows/pack.yml +++ b/.github/workflows/pack.yml @@ -15,8 +15,12 @@ jobs: pack: name: Generate pack runs-on: ubuntu-24.04 + permissions: + actions: write + contents: write steps: - - uses: actions/checkout@v7 + # The pack action needs the checkout credential to update release tags. + - uses: actions/checkout@v7 # zizmor: ignore[artipacked] with: fetch-depth: 0 @@ -25,7 +29,7 @@ jobs: run: | git fetch --tags --force - - uses: Open-CMSIS-Pack/gen-pack-action@main + - uses: Open-CMSIS-Pack/gen-pack-action@9cab2ab138e909e93a3f051ab9a4675b52843a25 # main with: doxygen-version: 1.9.6 packchk-version: 1.4.1