Skip to content

ci: update actions, pin actions by sha, and apply zizmor fixes, and update to ubuntu 26.04 - #306

Merged
mikebrow merged 11 commits into
containerd:mainfrom
thaJeztah:bump_gha
Aug 20, 2026
Merged

ci: update actions, pin actions by sha, and apply zizmor fixes, and update to ubuntu 26.04#306
mikebrow merged 11 commits into
containerd:mainfrom
thaJeztah:bump_gha

Conversation

@thaJeztah

Copy link
Copy Markdown
Member

Update actions to avoid depending on deprecated node versions, set default permissions, and pin actions;

After this;

zizmor --fix=all --min-severity medium .
 INFO zizmor: 🌈 zizmor v1.29.0
 INFO audit: zizmor: 🌈 completed ./.github/actions/install-go/action.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/ci.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/codeql.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/codespell.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/images.yml
No findings to report. Good job! (1 ignored, 11 suppressed)
No fixes available to apply.

@thaJeztah

Copy link
Copy Markdown
Member Author

Ah, yes, go-setup-action it has this quirk where go.mod having go 1.24 makes it install go1.24.0, not "latest"

Building /home/runner/work/nri/nri/build/bin/logger...
go: downloading sigs.k8s.io/yaml v1.3.0
go: downloading gopkg.in/yaml.v2 v2.4.0
Building /home/runner/work/nri/nri/build/bin/device-injector...
Building /home/runner/work/nri/nri/build/bin/hook-injector...
go: go.mod requires go >= 1.24.2 (running go 1.24.0; GOTOOLCHAIN=local)
make: *** [Makefile:141: /home/runner/work/nri/nri/build/bin/hook-injector] Error 1

@thaJeztah
thaJeztah force-pushed the bump_gha branch 3 times, most recently from d726626 to cff27b4 Compare August 15, 2026 10:45
@thaJeztah thaJeztah changed the title ci: update actions, pin actions by sha, and apply zizmor fixes ci: update actions, pin actions by sha, and apply zizmor fixes, and update to ubuntu 26.04 Aug 15, 2026

@klihub klihub left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I think there will be a conflict between this and #296 (which just does the content-reading permission declaration sub-bits of this), so maybe we'll need to close that one and merge this.

@samuelkarp

Copy link
Copy Markdown
Member

oh I just merged #296 before seeing @klihub's comment

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Set the default permissions to `contents: read`. For public repositories
this is effectively equivalent for workflows that only need to check out
the repository, but unlike `permissions: {}`, it also allows workflows to
access repository contents when running in private forks.

Also set default workflow concurrency and address the remaining zizmor
lint warnings.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah

Copy link
Copy Markdown
Member Author

Rebased 👍

@klihub
klihub requested review from mikebrow and samuelkarp August 20, 2026 07:31

@mikebrow mikebrow left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mikebrow
mikebrow merged commit 1db6070 into containerd:main Aug 20, 2026
16 checks passed
@thaJeztah
thaJeztah deleted the bump_gha branch August 20, 2026 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants