This is an automated email from the ASF dual-hosted git repository.
Fokko pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/parquet-format.git
The following commit(s) were added to refs/heads/master by this push:
new 9cc7154 MINOR: Add Zizmor for workflow checks (#615)
9cc7154 is described below
commit 9cc715481273dd684915db01214629f6674102cd
Author: Fokko Driesprong <[email protected]>
AuthorDate: Thu Sep 3 15:13:15 2026 +0200
MINOR: Add Zizmor for workflow checks (#615)
* MINOR: Add Zizmor for workflow checks
Zizmor checks if the best practices are being used inside of the GitHub
workflows
* Add cooldown to dependabot
---
.github/dependabot.yml | 4 +++
.github/workflows/test.yml | 10 ++++--
.github/{dependabot.yml => workflows/zizmor.yml} | 44 ++++++++++++++++--------
3 files changed, 41 insertions(+), 17 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 06586440..14ecfed 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,9 +24,13 @@ updates:
schedule:
interval: "weekly"
day: "sunday"
+ cooldown:
+ default-days: 7
- package-ecosystem: "maven"
directory: "/"
schedule:
interval: "weekly"
day: "sunday"
open-pull-requests-limit: 5
+ cooldown:
+ default-days: 7
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4ebbb66..5385891 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,10 +31,14 @@ on:
- 'doc/images/**'
- 'logo/**'
+permissions: {}
+
jobs:
build:
runs-on: ubuntu-latest
+ permissions:
+ contents: read
strategy:
fail-fast: false
matrix:
@@ -42,9 +46,11 @@ jobs:
name: Build Parquet with JDK ${{ matrix.java }}
steps:
- - uses: actions/checkout@master
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
- name: Set up JDK ${{ matrix.java }}
- uses: actions/setup-java@v5
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 #
v5.7.0
with:
java-version: ${{ matrix.java }}
distribution: temurin
diff --git a/.github/dependabot.yml b/.github/workflows/zizmor.yml
similarity index 53%
copy from .github/dependabot.yml
copy to .github/workflows/zizmor.yml
index 06586440..ed17df0 100644
--- a/.github/dependabot.yml
+++ b/.github/workflows/zizmor.yml
@@ -1,4 +1,3 @@
-#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
@@ -15,18 +14,33 @@
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
-#
-version: 2
-updates:
- - package-ecosystem: "github-actions"
- directory: "/"
- schedule:
- interval: "weekly"
- day: "sunday"
- - package-ecosystem: "maven"
- directory: "/"
- schedule:
- interval: "weekly"
- day: "sunday"
- open-pull-requests-limit: 5
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+ push:
+ branches:
+ - master
+ - parquet-*
+ pull_request:
+ branches: ["**"]
+
+permissions: {}
+
+jobs:
+ zizmor:
+ name: Run zizmor 🌈
+ runs-on: ubuntu-latest
+ permissions: {}
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Run zizmor 🌈
+ uses:
zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+ with:
+ advanced-security: false
+ min-severity: medium
+ min-confidence: medium
