Jefffrey commented on code in PR #12199:
URL: https://github.com/apache/arrow-rs/pull/12199#discussion_r4549426562
##########
.github/workflows/api_change.yml:
##########
@@ -28,15 +28,15 @@ jobs:
name: Detect API changes
runs-on: ubuntu-latest
container:
- image: amd64/rust
+ image:
amd64/rust@sha256:5b5938cbb2951fc2869eaf891a6616f722ef5bf28c90dc6a074c35c141e31537
# v1.99.1
Review Comment:
error[unpinned-images]: unpinned image references
https://docs.zizmor.sh/audits/#unpinned-images
using hash from current latest tag:
https://hub.docker.com/layers/amd64/rust/latest/images/sha256-3ddd9771c00ed2c214d75ba497ad28691ebeaf2279476068dd191cf39b4be033
##########
.github/workflows/api_change.yml:
##########
@@ -28,15 +28,15 @@ jobs:
name: Detect API changes
runs-on: ubuntu-latest
container:
- image: amd64/rust
+ image:
amd64/rust@sha256:5b5938cbb2951fc2869eaf891a6616f722ef5bf28c90dc6a074c35c141e31537
# v1.99.1
timeout-minutes: 60
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- name: Setup Rust toolchain
- uses: ./.github/actions/setup-builder
+ uses: $/.github/actions/setup-builder
Review Comment:
help[self-repository]: use GitHub's dedicated self-repository syntax
- https://docs.zizmor.sh/audits/#self-repository
##########
.github/dependabot.yml:
##########
@@ -43,9 +45,23 @@ updates:
codeql-actions:
patterns:
- "github/codeql-action/*"
+ - package-ecosystem: "docker"
Review Comment:
because we are now pinning the docker image, we use dependabot to update
that hash
##########
.github/dependabot.yml:
##########
@@ -33,6 +33,8 @@ updates:
update-types:
- "minor"
- "patch"
+ cooldown:
+ default-days: 7
Review Comment:
warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
- https://docs.zizmor.sh/audits/#dependabot-cooldown
(default is 3 days, so this is increase)
##########
.github/workflows/integration.yml:
##########
@@ -194,7 +202,9 @@ jobs:
run: |
virtualenv venv
source venv/bin/activate
- pip install maturin toml pytest pytz pyarrow==${{ matrix.pyarrow }}
+ pip install maturin toml pytest pytz pyarrow==${MATRIX_PYARROW}
+ env:
+ MATRIX_PYARROW: ${{ matrix.pyarrow }}
Review Comment:
warning[template-injection]: code injection via template expansion
- https://docs.zizmor.sh/audits/#template-injection
##########
.github/workflows/arrow.yml:
##########
@@ -18,13 +18,14 @@ jobs:
name: Test
runs-on: ubuntu-latest
container:
- image: amd64/rust
+ image:
amd64/rust@sha256:5b5938cbb2951fc2869eaf891a6616f722ef5bf28c90dc6a074c35c141e31537
# v1.99.1
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
submodules: true
+ persist-credentials: false
Review Comment:
warning[artipacked]: credential persistence through GitHub Actions artifacts
- https://docs.zizmor.sh/audits/#artipacked
##########
.github/workflows/dev.yml:
##########
@@ -8,15 +8,28 @@ name: dev
on:
workflow_call:
-permissions:
- contents: read
-
jobs:
+ zizmor:
Review Comment:
see repository: https://github.com/zizmorcore/zizmor-action
##########
.github/ci/scripts/check-ci-config.py:
##########
@@ -149,7 +149,9 @@ def validate_config(root=ROOT):
assert job["needs"] == "changes", f"{suite}: missing suite selection
dependency"
condition = f"contains(fromJSON(needs.changes.outputs.suites),
'{suite}')"
assert job["if"] == condition, f"{suite}: unexpected routing condition"
- path = root / job["uses"]
+ # strip self-repository syntax ($/)
+ #
https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/
+ path = root / job["uses"].removeprefix("$/")
Review Comment:
because of the self-repository syntax fix we need to fix this test
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
