mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-22 13:42:50 -04:00
d2b64b6689
* ci(pacquet): fix all zizmor code-scanning findings Resolves the 90 alerts opened by zizmor against the imported pacquet-* workflows and shared composite actions: - unpinned-uses: pin every third-party action to a SHA + version comment (matching SHAs already used elsewhere in the repo where applicable; taiki-e/install-action collapsed onto v2.78.0 with explicit `tool:` input). - artipacked: add `persist-credentials: false` to every actions/checkout. - template-injection: pass `inputs.*` and `steps.*.outputs.*` through `env:` in binstall/rustup composite actions and pacquet-release-to-npm.yml. - excessive-permissions: add top-level `permissions: contents: read` to pacquet-release-to-npm.yml; move issues/pull-requests writes from the workflow level to the benchmark-compare job in pacquet-micro-benchmark.yml. - dangerous-triggers: keep workflow_run in pacquet-integrated-benchmark- comment.yml but suppress with a documented zizmor: ignore — the trigger is the recommended pattern for posting comments back to fork PRs. - superfluous-actions: keep softprops/action-gh-release with a zizmor: ignore (matches release.yml). Verified by running `zizmor .github` locally with no remaining findings. * ci(pacquet): point SHA pins at the patch-version tag Swatinem/rust-cache and montudor/action-zip were pinned to the SHA the major-version alias (`v2`, `v1`) resolves to, but the version comments claimed `v2.9.1` / `v1.0.0`. zizmor's online `ref-version-mismatch` audit flagged the inconsistency. Repoint at the SHAs the patch-version tags actually annotate so the pin and the comment agree.
26 lines
722 B
YAML
26 lines
722 B
YAML
name: Cargo B(inary)Install
|
|
|
|
description: Install binaries with cargo-binstall
|
|
|
|
inputs:
|
|
packages:
|
|
description: List of arguments to pass to `cargo binstall`
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
|
|
steps:
|
|
- name: Install cargo-binstall
|
|
uses: taiki-e/install-action@e1c4cd42111751368541a7cb5db3522bd1f846a4 # v2.78.0
|
|
with:
|
|
tool: cargo-binstall
|
|
|
|
- name: Running cargo-binstall with provided arguments
|
|
shell: bash
|
|
env:
|
|
PACKAGES: ${{ inputs.packages }}
|
|
# `$PACKAGES` is intentionally unquoted so each space-separated
|
|
# entry becomes its own positional argument to `cargo binstall`.
|
|
run: cargo binstall --no-confirm $PACKAGES
|