Skip to content

Commit fe35f67

Browse files
felixfonteinfelixfontein
authored
Fix some issues pointed out by zizmor (#96)
* Fix some issues pointed out by zizmor. * Avoid templating in scripts in actions.
1 parent 9159368 commit fe35f67

File tree

10 files changed

+177
-83
lines changed

10 files changed

+177
-83
lines changed

‎.github/workflows/_shared-docs-build-pr.yml‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,11 @@ jobs:
229229
- name: Variable setup
230230
id: vars
231231
uses: actions/github-script@v7
232+
env:
233+
RUNNER_TEMP: ${{ runner.temp }}
234+
EVENT_ACTION: ${{ github.event.action }}
235+
MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
236+
GITHUB_EVENT_NUMBER: ${{ github.event.number }}
232237
with:
233238
script: |
234239
const inputs = ${{ toJSON(inputs) }}
@@ -244,7 +249,7 @@ jobs:
244249
core.setOutput('col-path', colpath)
245250
core.setOutput('checkout-path', checkoutPath)
246251
247-
var initPath = '${{ runner.temp }}/docsbuild'
252+
var initPath = `${RUNNER_TEMP}/docsbuild`
248253
var skipInit = false
249254
250255
if (inputs['init-dest-dir'] != '') {
@@ -268,10 +273,10 @@ jobs:
268273
// See also:
269274
// - https://github.com/ansible-community/github-docs-build/issues/36
270275
271-
if ('${{ github.event.action }}' == 'closed') {
272-
core.setOutput('pr-checkout-ref', '${{ github.event.pull_request.merge_commit_sha }}')
276+
if (`${EVENT_ACTION}` == 'closed') {
277+
core.setOutput('pr-checkout-ref', `${MERGE_COMMIT_SHA}`)
273278
} else {
274-
core.setOutput('pr-checkout-ref', 'refs/pull/${{ github.event.number }}/merge')
279+
core.setOutput('pr-checkout-ref', `refs/pull/${GITHUB_EVENT_NUMBER}/merge`)
275280
}
276281
277282
- name: Set up Python
@@ -280,20 +285,25 @@ jobs:
280285
python-version: ${{ inputs.python }}
281286

282287
- name: Install Ansible
283-
run: pip install https://github.com/ansible/ansible/archive/${{ inputs.ansible-ref }}.tar.gz --disable-pip-version-check
288+
env:
289+
ANSIBLE_REF: ${{ inputs.ansible-ref }}
290+
run: pip install "https://github.com/ansible/ansible/archive/${ANSIBLE_REF}.tar.gz" --disable-pip-version-check
284291

285292
- name: Install extra collections
286293
shell: bash
294+
env:
295+
EXTRA_COLLECTIONS: ${{ inputs.extra-collections }}
287296
run: |
288-
if [[ "${{ inputs.extra-collections }}" != "" ]] ; then
289-
ansible-galaxy collection install ${{ inputs.extra-collections }}
297+
if [[ "${EXTRA_COLLECTIONS}" != "" ]] ; then
298+
ansible-galaxy collection install ${EXTRA_COLLECTIONS}
290299
fi
291300
292301
- name: Checkout BASE
293302
uses: actions/checkout@v4
294303
with:
295304
ref: ${{ github.event.pull_request.base.sha }}
296305
path: ${{ steps.vars.outputs.checkout-path }}
306+
persist-credentials: false
297307

298308
- name: Initialize the build environment (BASE)
299309
id: init-base
@@ -339,6 +349,7 @@ jobs:
339349
# a PR, **but** then we get https://github.com/ansible-community/github-docs-build/issues/3 back...
340350
ref: ${{ steps.vars.outputs.pr-checkout-ref }}
341351
path: ${{ steps.vars.outputs.checkout-path }}
352+
persist-credentials: false
342353

343354
- name: Initialize the build environment (HEAD)
344355
id: init-head

‎.github/workflows/_shared-docs-build-publish-gh-pages.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ jobs:
119119
ref: gh-pages
120120
path: gh-pages-checkout
121121
token: ${{ secrets.GH_TOKEN }}
122+
persist-credentials: false
122123

123124
- name: Setup GitHub Pages
124125
if: inputs.publish-gh-pages-branch

‎.github/workflows/_shared-docs-build-publish-surge.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,15 @@ jobs:
5252
- name: Publish site
5353
if: inputs.action == 'publish'
5454
working-directory: html
55-
run: surge ./ "${{ inputs.surge-site-name }}" --token ${{ secrets.SURGE_TOKEN }}
55+
env:
56+
SURGE_SITE_NAME: ${{ inputs.surge-site-name }}
57+
SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
58+
run: surge ./ "${SURGE_SITE_NAME}" --token "${SURGE_TOKEN}"
5659

5760
- name: Teardown site
5861
if: inputs.action == 'teardown'
59-
run: surge teardown "${{ inputs.surge-site-name }}" --token ${{ secrets.SURGE_TOKEN }}
62+
env:
63+
SURGE_SITE_NAME: ${{ inputs.surge-site-name }}
64+
SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
65+
run: surge teardown "${SURGE_SITE_NAME}" --token "${SURGE_TOKEN}"
6066
continue-on-error: true

‎.github/workflows/_shared-docs-build-push.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,8 @@ jobs:
159159
- name: Variable setup
160160
id: vars
161161
uses: actions/github-script@v7
162+
env:
163+
RUNNER_TEMP: ${{ runner.temp }}
162164
with:
163165
script: |
164166
const inputs = ${{ toJSON(inputs) }}
@@ -181,7 +183,7 @@ jobs:
181183
core.setOutput('col-path', colpath)
182184
core.setOutput('checkout-path', checkoutPath)
183185
184-
var initPath = '${{ runner.temp }}/docsbuild'
186+
var initPath = `${RUNNER_TEMP}/docsbuild`
185187
var skipInit = false
186188
187189
if (inputs['init-dest-dir'] != '') {
@@ -198,20 +200,26 @@ jobs:
198200
python-version: ${{ inputs.python }}
199201

200202
- name: Install Ansible
201-
run: pip install https://github.com/ansible/ansible/archive/${{ inputs.ansible-ref }}.tar.gz --disable-pip-version-check
203+
env:
204+
ANSIBLE_REF: ${{ inputs.ansible-ref }}
205+
run: >
206+
pip install "https://github.com/ansible/ansible/archive/${ANSIBLE_REF}.tar.gz" --disable-pip-version-check
202207
203208
- name: Install extra collections
204209
shell: bash
210+
env:
211+
EXTRA_COLLECTIONS: ${{ inputs.extra-collections }}
205212
run: |
206-
if [[ "${{ inputs.extra-collections }}" != "" ]] ; then
207-
ansible-galaxy collection install ${{ inputs.extra-collections }}
213+
if [[ "${EXTRA_COLLECTIONS}" != "" ]] ; then
214+
ansible-galaxy collection install ${EXTRA_COLLECTIONS}
208215
fi
209216
210217
- name: Checkout
211218
uses: actions/checkout@v4
212219
with:
213220
path: ${{ steps.vars.outputs.checkout-path }}
214221
ref: ${{ inputs.build-ref }}
222+
persist-credentials: false
215223

216224
- name: Initialize the build environment
217225
id: init

‎.github/workflows/generate-wiki-docs.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,16 @@ jobs:
2424
steps:
2525
- if: fromJSON(env.SHOULD_RUN)
2626
uses: actions/checkout@v4
27+
with:
28+
persist-credentials: false
2729

2830
- name: Checkout wiki
2931
if: fromJSON(env.SHOULD_RUN)
3032
uses: actions/checkout@v4
3133
with:
3234
repository: ${{ github.repository }}.wiki
3335
path: ${{ env.WIKI }}
36+
persist-credentials: false
3437

3538
- uses: actions/setup-python@v5
3639
if: fromJSON(env.SHOULD_RUN)

‎.github/workflows/test-action-build-html.yml‎

Lines changed: 78 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ jobs:
2323
steps:
2424
- name: Checkout
2525
uses: actions/checkout@v4
26+
with:
27+
persist-credentials: false
2628

2729
- name: Simple 1 invoke - no copy, no artifact
2830
id: simple1
@@ -40,11 +42,18 @@ jobs:
4042

4143
- name: Simple 1 - assert
4244
shell: python
45+
env:
46+
EXPECTED_HASH: ${{ hashFiles('.test/simple-build/src') }}
47+
OUTPUT_HASH: ${{ steps.simple1.outputs.hash }}
48+
OUTPUT_BUILD_HTML: ${{ steps.simple1.outputs.build-html }}
49+
ARTIFACT_HASH: ${{ hashFiles(steps.simple1-artifact.outputs.download-path) }}
4350
run: |
44-
expected_hash = r'${{ hashFiles('.test/simple-build/src') }}'
45-
output_hash = r'${{ steps.simple1.outputs.hash }}'
46-
output_build_html = r'${{ steps.simple1.outputs.build-html }}'
47-
artifact_hash = r'${{ hashFiles(steps.simple1-artifact.outputs.download-path) }}'
51+
import os
52+
53+
expected_hash = os.environ['ARTIFACT_HASH']
54+
output_hash = os.environ['OUTPUT_HASH']
55+
output_build_html = os.environ['OUTPUT_BUILD_HTML']
56+
artifact_hash = os.environ['ARTIFACT_HASH']
4857
4958
assert output_build_html == '.test/simple-build/build/html'
5059
assert output_hash == expected_hash
@@ -67,12 +76,20 @@ jobs:
6776

6877
- name: Simple 2 - assert
6978
shell: python
79+
env:
80+
expected_hash: ${{ hashFiles('.test/simple-build/src') }}
81+
output_hash: ${{ steps.simple2.outputs.hash }}
82+
output_build_html: ${{ steps.simple2.outputs.build-html }}
83+
artifact_hash: ${{ hashFiles(steps.simple2-artifact.outputs.download-path) }}
84+
original_build_hash: ${{ hashFiles('.test/simple-build/build/html') }}
7085
run: |
71-
expected_hash = r'${{ hashFiles('.test/simple-build/src') }}'
72-
output_hash = r'${{ steps.simple2.outputs.hash }}'
73-
output_build_html = r'${{ steps.simple2.outputs.build-html }}'
74-
artifact_hash = r'${{ hashFiles(steps.simple2-artifact.outputs.download-path) }}'
75-
original_build_hash = r'${{ hashFiles('.test/simple-build/build/html') }}'
86+
import os
87+
88+
expected_hash = os.environ['expected_hash']
89+
output_hash = os.environ['output_hash']
90+
output_build_html = os.environ['output_build_html']
91+
artifact_hash = os.environ['artifact_hash']
92+
original_build_hash = os.environ['original_build_hash']
7693
7794
assert output_build_html == '.copies/simple2/html'
7895
assert output_hash == expected_hash
@@ -97,26 +114,36 @@ jobs:
97114

98115
- name: Simple 3 - assert
99116
shell: python
117+
env:
118+
expected_hash: ${{ hashFiles('.test/simple-build/src') }}
119+
output_hash: ${{ steps.simple3.outputs.hash }}
120+
output_build_html: ${{ steps.simple3.outputs.build-html }}
121+
artifact_hash: ${{ hashFiles(steps.simple3-artifact.outputs.download-path) }}
100122
run: |
101-
expected_hash = r'${{ hashFiles('.test/simple-build/src') }}'
102-
output_hash = r'${{ steps.simple3.outputs.hash }}'
103-
output_build_html = r'${{ steps.simple3.outputs.build-html }}'
104-
artifact_hash = r'${{ hashFiles(steps.simple3-artifact.outputs.download-path) }}'
123+
import os
124+
125+
expected_hash = os.environ['expected_hash']
126+
output_hash = os.environ['output_hash']
127+
output_build_html = os.environ['output_build_html']
128+
artifact_hash = os.environ['artifact_hash']
105129
106130
assert output_build_html == '.test/simple-build/build/html'
107131
assert output_hash == expected_hash
108132
assert artifact_hash == output_hash
109133
110134
- name: Simple 3 - bash asserts
135+
env:
136+
ARTIFACTS_URL: ${{ steps.simple3.outputs.artifact-url }}
137+
DOWNLOAD_PATH: ${{ steps.simple3-artifact.outputs.download-path }}
111138
run: |
112139
set -eu
113140
114141
# this URL only goes to the run page, not to an individual artifact
115142
# so all we're really checking here is that it's a valid URL that's accessible
116-
wget '${{ steps.simple3.outputs.artifact-url }}'
143+
wget "${ARTIFACTS_URL}"
117144
118145
# ensure that the html directory is not present in the downloaded artifact
119-
test ! -d "${{ steps.simple3-artifact.outputs.download-path }}/html"
146+
test ! -d "${DOWNLOAD_PATH}/html"
120147
121148
- name: Simple 4 invoke - with copy, with artifact
122149
id: simple4
@@ -137,28 +164,39 @@ jobs:
137164

138165
- name: Simple 4 - assert
139166
shell: python
167+
env:
168+
expected_hash: ${{ hashFiles('.test/simple-build/src') }}
169+
output_hash: ${{ steps.simple4.outputs.hash }}
170+
output_build_html: ${{ steps.simple4.outputs.build-html }}
171+
artifact_hash: ${{ hashFiles(steps.simple4-artifact.outputs.download-path) }}
172+
original_build_hash: ${{ hashFiles('.test/simple-build/build/html') }}
140173
run: |
141-
expected_hash = r'${{ hashFiles('.test/simple-build/src') }}'
142-
output_hash = r'${{ steps.simple4.outputs.hash }}'
143-
output_build_html = r'${{ steps.simple4.outputs.build-html }}'
144-
artifact_hash = r'${{ hashFiles(steps.simple4-artifact.outputs.download-path) }}'
145-
original_build_hash = r'${{ hashFiles('.test/simple-build/build/html') }}'
174+
import os
175+
176+
expected_hash = os.environ['expected_hash']
177+
output_hash = os.environ['output_hash']
178+
output_build_html = os.environ['output_build_html']
179+
artifact_hash = os.environ['artifact_hash']
180+
original_build_hash = os.environ['original_build_hash']
146181
147182
assert output_build_html == '.copies/simple4/html'
148183
assert output_hash == expected_hash
149184
assert output_hash == original_build_hash
150185
assert artifact_hash == output_hash
151186
152187
- name: Simple 4 - bash asserts
188+
env:
189+
ARTIFACTS_URL: ${{ steps.simple4.outputs.artifact-url }}
190+
DOWNLOAD_PATH: ${{ steps.simple4-artifact.outputs.download-path }}
153191
run: |
154192
set -eu
155193
156194
# this URL only goes to the run page, not to an individual artifact
157195
# so all we're really checking here is that it's a valid URL that's accessible
158-
wget '${{ steps.simple4.outputs.artifact-url }}'
196+
wget "${ARTIFACTS_URL}"
159197
160198
# ensure that the html directory is not present in the downloaded artifact
161-
test ! -d "${{ steps.simple4-artifact.outputs.download-path }}/html"
199+
test ! -d "${DOWNLOAD_PATH}/html"
162200
163201
- name: Simple 5 invoke - with copy, with artifact, trailing slash in input
164202
id: simple5
@@ -179,25 +217,36 @@ jobs:
179217

180218
- name: Simple 5 - assert
181219
shell: python
220+
env:
221+
expected_hash: ${{ hashFiles('.test/simple-build/src') }}
222+
output_hash: ${{ steps.simple5.outputs.hash }}
223+
output_build_html: ${{ steps.simple5.outputs.build-html }}
224+
artifact_hash: ${{ hashFiles(steps.simple5-artifact.outputs.download-path) }}
225+
original_build_hash: ${{ hashFiles('.test/simple-build/build/html/') }}
182226
run: |
183-
expected_hash = r'${{ hashFiles('.test/simple-build/src') }}'
184-
output_hash = r'${{ steps.simple5.outputs.hash }}'
185-
output_build_html = r'${{ steps.simple5.outputs.build-html }}'
186-
artifact_hash = r'${{ hashFiles(steps.simple5-artifact.outputs.download-path) }}'
187-
original_build_hash = r'${{ hashFiles('.test/simple-build/build/html/') }}'
227+
import os
228+
229+
expected_hash = os.environ['expected_hash ']
230+
output_hash = os.environ['output_hash']
231+
output_build_html = os.environ['output_build_html']
232+
artifact_hash = os.environ['artifact_hash']
233+
original_build_hash = os.environ['original_build_hash']
188234
189235
assert output_build_html == '.copies/simple5/html/'
190236
assert output_hash == expected_hash
191237
assert output_hash == original_build_hash
192238
assert artifact_hash == output_hash
193239
194240
- name: Simple 5 - bash asserts
241+
env:
242+
ARTIFACTS_URL: ${{ steps.simple5.outputs.artifact-url }}
243+
DOWNLOAD_PATH: ${{ steps.simple5-artifact.outputs.download-path }}
195244
run: |
196245
set -eu
197246
198247
# this URL only goes to the run page, not to an individual artifact
199248
# so all we're really checking here is that it's a valid URL that's accessible
200-
wget '${{ steps.simple5.outputs.artifact-url }}'
249+
wget "${ARTIFACTS_URL}"
201250
202251
# ensure that the html directory is not present in the downloaded artifact
203-
test ! -d "${{ steps.simple5-artifact.outputs.download-path }}/html"
252+
test ! -d "${DOWNLOAD_PATH}/html"

‎.github/workflows/test-action-build-init.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ jobs:
109109
steps:
110110
- name: Checkout
111111
uses: actions/checkout@v4
112+
with:
113+
persist-credentials: false
112114

113115
- name: Install Python
114116
uses: actions/setup-python@v5

‎actions/ansible-docs-build-diff/action.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -81,12 +81,15 @@ runs:
8181
- name: Delete files that should not be included in the diff
8282
id: delete
8383
shell: bash
84+
env:
85+
BUILD_HTML_A: ${{ inputs.build-html-a }}
86+
BUILD_HTML_B: ${{ inputs.build-html-b }}
8487
run: |
85-
echo "::group::Deleting files from ${{ inputs.build-html-a }}"
86-
find "${{ inputs.build-html-a }}" \( -name '*.js' -or -name '*.inv' \) -delete -print
88+
echo "::group::Deleting files from ${BUILD_HTML_A}"
89+
find "${BUILD_HTML_A}" \( -name '*.js' -or -name '*.inv' \) -delete -print
8790
echo "::endgroup::"
88-
echo "::group::Deleting files from ${{ inputs.build-html-b }}"
89-
find "${{ inputs.build-html-b }}" \( -name '*.js' -or -name '*.inv' \) -delete -print
91+
echo "::group::Deleting files from ${BUILD_HTML_B}"
92+
find "${BUILD_HTML_B}" \( -name '*.js' -or -name '*.inv' \) -delete -print
9093
echo "::endgroup::"
9194
9295
- name: Create diff

0 commit comments

Comments
 (0)