Tatsh / winpbcopy / 33136505379
100%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 2
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0%. Remained the same
33136505379

push

github

Tatsh 
workflows/*: pin actions to full SHAs and harden permissions

Wiswa only pins and hardens the workflows it generates, so the hand
maintained ones still resolved actions through mutable tags and failed the
zizmor hook that the generator now installs.

Pin every action to the commit SHA its tag currently resolves to, so a
retargeted tag can no longer change what runs, and let Dependabot move the
pins on its weekly schedule.

Clear the resulting zizmor findings rather than suppressing them:

- Set persist-credentials to false on every checkout, so the job token is not
  left in .git/config for later steps to read.
- Move the write permissions in cmake.yml from the workflow down to the jobs
  that need them. Only build-msys publishes a release, so build-cross keeps
  contents read-only, and publish-msys2.yml drops to no permissions at all
  because it authenticates with MSYS2_TOKEN.
- Pass step outputs through the environment instead of expanding them into
  run blocks.
- Carry the release tag in release.yml through GITHUB_OUTPUT rather than
  GITHUB_ENV, which is not a code execution vector.
- Replace softprops/action-gh-release with a gh release step. Matrix jobs
  race to create the same draft release, so a failed create is tolerated only
  when the release turns out to already exist, and an empty file glob is
  still an error.

Signed-off-by: Andrew Udvare <audvare@gmail.com>

49 of 49 relevant lines covered (100.0%)

2.53 hits per line

Jobs
ID Job ID Ran Files Coverage
1 33136505379.1 2
100.0
 GitHub Action Run
Source Files on build 33136505379