funkemunky/packages
1
0
Fork 0
mirror of https://github.com/terrapkg/packages.git synced 2026-05-31 09:01:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Apply various fixes per OpenSSF recommendations (#10780)

Browse Source
This commit is contained in:
Kyle Gospodnetich
2026-03-23 22:34:59 -07:00
committed by GitHub
parent b641d275d1
commit 6d4f9e5311
11 changed files with 31 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/autobuild.yml
+2 -2
View File
@@ -30,7 +30,7 @@ jobs:
- name: Set workspace as safe
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- name: Generate build matrix
@@ -51,7 +51,7 @@ jobs:
image: ghcr.io/terrapkg/appstream-generator:main
steps:
- name: Download artifacts
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
merge-multiple: true
path: ./artifacts
.github/workflows/bootstrap.yml
+1 -1
View File
@@ -21,7 +21,7 @@ jobs:
dnf5 swap -y --setopt=install_weak_deps=False systemd-standalone-sysusers systemd
dnf5 install -y --setopt=install_weak_deps=False curl wget git-core openssl-devel cargo podman fuse-overlayfs dnf5-plugins rpmbuild script
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: f${{ matrix.version }}
fetch-depth: 1
.github/workflows/build.yml
+1 -1
View File
@@ -29,7 +29,7 @@ jobs:
options: --cap-add=SYS_ADMIN --privileged
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- name: Setup Git
.github/workflows/json-build.yml
+4 -4
View File
@@ -48,7 +48,7 @@ jobs:
options: --cap-add=SYS_ADMIN --privileged
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
@@ -58,7 +58,7 @@ jobs:
- name: Configure sccache
id: sccache
if: ${{ !contains(matrix.pkg.labels.sccache, '0') }}
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
SCCACHE_GHA_VERSION: ${{ matrix.version }}-${{ matrix.pkg.arch }}-${{ matrix.pkg.pkg }}
SCCACHE_GHA_CACHE_FROM: ${{ matrix.version }}-${{ matrix.pkg.arch }}-${{ matrix.pkg.pkg }}
@@ -86,7 +86,7 @@ jobs:
- name: Report Cache Summary
if: steps.sccache.outcome == 'success'
uses: actions/github-script@v8
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const script = require('./.github/scripts/sccache-stats.js')
@@ -99,7 +99,7 @@ jobs:
x=${NAME//\//@}
echo "name=$x" >> $GITHUB_OUTPUT
- uses: actions/upload-artifact@v7
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: ${{ steps.art.outputs.name }}
compression-level: 0 # The RPMs are already compressed :p
.github/workflows/sync.yml
+4 -2
View File
@@ -1,13 +1,15 @@
name: Automatic backport/sync action
permissions:
contents: write
pull-requests: write
contents: read
on:
pull_request_target:
types: ["labeled", "closed"]
jobs:
backport:
permissions:
contents: write
pull-requests: write
name: Backport/sync PR
runs-on: ubuntu-22.04
if: github.event.pull_request.merged
.github/workflows/update-branch.yml
+4 -2
View File
@@ -1,6 +1,6 @@
name: Update per branch
permissions:
contents: write
contents: read
on:
schedule:
- cron: "*/30 * * * *"
@@ -8,6 +8,8 @@ on:
jobs:
autoupdate:
permissions:
contents: write
runs-on: ubuntu-24.04-arm
strategy:
matrix:
@@ -22,7 +24,7 @@ jobs:
options: --cap-add=SYS_ADMIN --privileged
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: ${{ matrix.branch }}
fetch-depth: 0
.github/workflows/update-comps.yml
+1 -1
View File
@@ -20,7 +20,7 @@ jobs:
container:
image: ghcr.io/terrapkg/builder:frawhide
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Push to subatomic
run: |
branch=${{ github.ref_name }}
.github/workflows/update-nightly.yml
+4 -2
View File
@@ -1,6 +1,6 @@
name: Nightly Update
permissions:
contents: write
contents: read
on:
schedule:
- cron: "0 0 * * *"
@@ -8,13 +8,15 @@ on:
jobs:
autoupdate:
permissions:
contents: write
runs-on: ubuntu-24.04-arm
container:
image: ghcr.io/terrapkg/builder:frawhide
options: --cap-add=SYS_ADMIN --privileged
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
ssh-key: ${{ secrets.SSH_AUTHENTICATION_KEY }}
.github/workflows/update-weekly.yml
+4 -2
View File
@@ -1,6 +1,6 @@
name: Weekly Update
permissions:
contents: write
contents: read
on:
schedule:
- cron: "0 0 * * *"
@@ -8,13 +8,15 @@ on:
jobs:
autoupdate:
permissions:
contents: write
runs-on: ubuntu-24.04-arm
container:
image: ghcr.io/terrapkg/builder:frawhide
options: --cap-add=SYS_ADMIN --privileged
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
ssh-key: ${{ secrets.SSH_AUTHENTICATION_KEY }}
.github/workflows/update.yml
+4 -2
View File
@@ -1,6 +1,6 @@
name: Update
permissions:
contents: write
contents: read
on:
schedule:
- cron: "*/10 * * * *"
@@ -8,13 +8,15 @@ on:
jobs:
autoupdate:
permissions:
contents: write
runs-on: ubuntu-24.04-arm
container:
image: ghcr.io/terrapkg/builder:frawhide
options: --cap-add=SYS_ADMIN --privileged
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
ssh-key: ${{ secrets.SSH_AUTHENTICATION_KEY }}