Tatsh / browserchooser / 33332927444
100%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 12
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0%. Remained the same
33332927444

push

github

Tatsh 
cruft: update

Re-ran Wiswa (cee029b) with `wiswa -d`, then finished the supply-chain
hardening the regen started so the new `zizmor` pre-commit hook passes.

The regen added the `zizmor` hook and pinned the action references it
manages, but left the rest of the workflows on mutable tags, so the hook
failed with 174 findings. Every workflow is now clean:

- Pin all 38 action references to full-length commit SHAs.
- Use `Tatsh/install-qt-action` rather than `jurplel/install-qt-action`.
  The upstream action invokes its inner action by relative path, which
  GitHub only resolves when the outer action is referenced by tag; under
  a SHA pin it resolves against the caller's workspace and the step dies
  with "Can't find 'action.yml' ... under .../browserchooser/action".
  The fork references the inner action by SHA, so the pin works.
- Set `persist-credentials: false` on every checkout, so the token is
  not written into `.git/config` where an artefact upload could carry
  it out of the runner.
- Move `${{ }}` expansions out of `run:` bodies into `env:` blocks.
  `github.ref_name` is attacker-controllable through a crafted tag name
  and was expanding directly into a shell command.
- Narrow `cmake.yml` permissions from workflow-wide write to per-job.
- Drive `publish-gentoo-ebuild.yml` from `release: published` instead of
  `workflow_run`, matching `publish-msys2.yml`. It fires at the same
  moment because the Release workflow is what undrafts the release.

Release reliability:

- Set `CPACK_SYSTEM_NAME` explicitly for the macOS jobs. Both runners
  were falling back to `CMAKE_APPLE_SILICON_PROCESSOR` to pick the
  suffix, and that variable is unset on the hosted arm64 runner, so both
  produced `Darwin-x86_64` and clobbered each other on upload. v0.0.2
  has no arm64 macOS asset at all as a result.
- Replace `softprops/action-gh-release` with inline `gh release create`
  and `gh release upload` calls. An unmatched glob now fails the step,
  preserving th... (continued)

463 of 463 relevant lines covered (100.0%)

23.94 hits per line

Jobs
ID Job ID Ran Files Coverage
1 33332927444.1 12
100.0
 GitHub Action Run
Source Files on build 33332927444