This is an automated email from the ASF dual-hosted git repository.
Fokko pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/parquet-java.git
The following commit(s) were added to refs/heads/master by this push:
new aaabb5d93 GH-3758: Add Zizmor to the CI (#3759)
aaabb5d93 is described below
commit aaabb5d93bcb47bb8adb265c9c86456f7ce77376
Author: Fokko Driesprong <[email protected]>
AuthorDate: Tue Sep 1 22:33:09 2026 +0200
GH-3758: Add Zizmor to the CI (#3759)
---
.github/dependabot.yml | 4 ++
.github/workflows/ci-hadoop3.yml | 8 +++-
.github/workflows/ci-release-scripts.yml | 2 +
.github/workflows/stale-prs.yml | 2 +-
.github/workflows/vector-plugins.yml | 8 +++-
.../{ci-release-scripts.yml => zizmor.yml} | 47 +++++++---------------
6 files changed, 34 insertions(+), 37 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index dee7d3472..09b54e603 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,9 +24,13 @@ updates:
schedule:
interval: "weekly"
day: "sunday"
+ cooldown:
+ default-days: 7
- package-ecosystem: "maven"
directory: "/"
schedule:
interval: "weekly"
day: "sunday"
+ cooldown:
+ default-days: 7
open-pull-requests-limit: 50
diff --git a/.github/workflows/ci-hadoop3.yml b/.github/workflows/ci-hadoop3.yml
index 15c341336..a2ba24403 100644
--- a/.github/workflows/ci-hadoop3.yml
+++ b/.github/workflows/ci-hadoop3.yml
@@ -28,6 +28,8 @@ jobs:
build:
runs-on: ubuntu-latest
+ permissions:
+ contents: read
strategy:
fail-fast: false
matrix:
@@ -35,9 +37,11 @@ jobs:
name: Build Parquet with JDK ${{ matrix.java.setup }}
steps:
- - uses: actions/checkout@master
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
- name: Set up JDK ${{ matrix.java.setup }}
- uses: actions/[email protected]
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 #
v5.7.0
with:
distribution: temurin
java-version: ${{ matrix.java.setup }}
diff --git a/.github/workflows/ci-release-scripts.yml
b/.github/workflows/ci-release-scripts.yml
index bfd5cd624..3be2909d9 100644
--- a/.github/workflows/ci-release-scripts.yml
+++ b/.github/workflows/ci-release-scripts.yml
@@ -33,6 +33,8 @@ jobs:
bats:
name: Release Script Unit Tests
runs-on: ubuntu-latest
+ permissions:
+ contents: read
steps:
- name: Checkout repository
diff --git a/.github/workflows/stale-prs.yml b/.github/workflows/stale-prs.yml
index ddb9a426e..54c2bd7ef 100644
--- a/.github/workflows/stale-prs.yml
+++ b/.github/workflows/stale-prs.yml
@@ -31,7 +31,7 @@ jobs:
runs-on: ubuntu-slim
steps:
- name: Mark and close stale pull requests
- uses: actions/stale@v11
+ uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
# Don't touch issues.
diff --git a/.github/workflows/vector-plugins.yml
b/.github/workflows/vector-plugins.yml
index 05a649713..9722027a8 100644
--- a/.github/workflows/vector-plugins.yml
+++ b/.github/workflows/vector-plugins.yml
@@ -28,6 +28,8 @@ jobs:
build:
runs-on: ubuntu-latest
+ permissions:
+ contents: read
strategy:
fail-fast: false
matrix:
@@ -36,9 +38,11 @@ jobs:
name: Build Parquet with JDK ${{ matrix.java }} and ${{ matrix.codes }}
steps:
- - uses: actions/checkout@master
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
- name: Set up JDK ${{ matrix.java }}
- uses: actions/[email protected]
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 #
v5.7.0
with:
distribution: temurin
java-version: ${{ matrix.java }}
diff --git a/.github/workflows/ci-release-scripts.yml
b/.github/workflows/zizmor.yml
similarity index 57%
copy from .github/workflows/ci-release-scripts.yml
copy to .github/workflows/zizmor.yml
index bfd5cd624..ed17df02e 100644
--- a/.github/workflows/ci-release-scripts.yml
+++ b/.github/workflows/zizmor.yml
@@ -1,4 +1,3 @@
-#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
@@ -15,49 +14,33 @@
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
-#
-name: Test Release Scripts
+name: GitHub Actions Security Analysis with zizmor 🌈
on:
- pull_request:
- paths:
- - 'release/**'
push:
branches:
- master
- paths:
- - 'release/**'
+ - parquet-*
+ pull_request:
+ branches: ["**"]
+
+permissions: {}
jobs:
- bats:
- name: Release Script Unit Tests
+ zizmor:
+ name: Run zizmor 🌈
runs-on: ubuntu-latest
-
+ permissions: {}
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
- fetch-depth: 0
persist-credentials: false
- - name: Install bats-core
- run: sudo apt-get update -q && sudo apt-get install -q -y bats
-
- - name: Configure Git identity for tests
- run: |
- git config --global user.name "CI"
- git config --global user.email "ci@test"
-
- - name: Run bats tests
- run: bats release/tests/*.bats
-
- - name: Verify scripts are executable
- run: |
- for script in release/bin/*.sh; do
- if [[ ! -x "$script" ]]; then
- echo "ERROR: $script is not executable"
- exit 1
- fi
- done
- echo "All scripts are executable"
+ - name: Run zizmor 🌈
+ uses:
zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+ with:
+ advanced-security: false
+ min-severity: medium
+ min-confidence: medium
