Tatsh / dbeaver-creds / 30969910578
100%

DEFAULT BRANCH: master
Ran
Jobs 5
Files 6
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0%. Remained the same
30969910578

push

github

Tatsh 
workflows/*: pin actions to SHAs and harden token handling

Tags and branches are mutable, so an upstream force-push or a push to a
tracked branch silently changes the code these workflows execute. That
matters most in publish-winget, which ran vedantmgoyal9/winget-releaser
from @main with WINGET_TOKEN in scope, and in the packaging workflows
that attest and upload release artefacts.

Every uses: ref is now a full 40-character commit SHA, matching the
existing style: bare SHA, no trailing version comment, per-file quoting
preserved. The workflows Wiswa generates were already pinned; the ten
changed here are the hand-maintained ones that still used tags.
Seventeen distinct mutable refs were replaced, each resolved with gh api
repos/OWNER/REPO/commits/TAG and verified to exist upstream. Dependabot
already tracks the github-actions ecosystem weekly, so the pins still
get bumped.

Pinning pulled these files under the zizmor pre-commit hook for the
first time, since it only audits staged files and earlier commits
touched only Wiswa-managed workflows. It reported 40 high-severity
findings against them, and fixing those exposed the rest:

- Every actions/checkout now sets persist-credentials: false. No job
  here pushes with git or reads the ambient token, and publish-winget
  passes secrets.WINGET_TOKEN to the action explicitly, so nothing
  depended on the persisted credentials.
- tests.yml declares workflow-level permissions of contents: read, as
  qa.yml and spelling.yml already do.
- Step outputs interpolated into run blocks are hoisted into env and
  referenced as shell variables instead.
- softprops/action-gh-release gives way to the preinstalled gh CLI.
  Draft creation tolerates the race between concurrent matrix jobs, and
  failglob preserves the fail_on_unmatched_files behaviour.

These land together because no smaller split passes the hook: the pins
alone still trip artipacked, and the hardening alone still trips
unpinned-uses. zizmor now passes ... (continued)

235 of 235 relevant lines covered (100.0%)

12.22 hits per line

Jobs
ID Job ID Ran Files Coverage
1 native-Windows-CLANGARM64 - 30969910578.1 4
98.21
 GitHub Action Run
2 native-macOS - 30969910578.2 2
96.77
 GitHub Action Run
3 native-Windows-MINGW64 - 30969910578.3 4
98.03
 GitHub Action Run
4 pwsh - 30969910578.4 1
100.0
 GitHub Action Run
5 native-Linux - 30969910578.5 2
100.0
 GitHub Action Run
Source Files on build 30969910578