From 122866016a55209f1f26660b3af81715895a2c3a Mon Sep 17 00:00:00 2001 From: Marco Pasqualetti <24919330+marcalexiei@users.noreply.github.com> Date: Sun, 11 Oct 2026 01:26:59 +0200 Subject: [PATCH 1/2] ci: resolve the jactionlint pedantic findings --- .github/workflows/changesets-pr-status.yml | 6 +++-- .github/workflows/ci.yml | 21 +++++++++++----- .github/workflows/deploy-docs.yml | 7 +++++- .github/workflows/publish-image.yml | 9 ++++++- .github/workflows/release.yml | 26 +++++++++++++------- .github/workflows/renovate.yml | 4 +-- .github/workflows/update-emoji-map.yml | 11 +++++++-- .github/workflows/update-language-colors.yml | 11 +++++++-- 8 files changed, 70 insertions(+), 25 deletions(-) diff --git a/.github/workflows/changesets-pr-status.yml b/.github/workflows/changesets-pr-status.yml index 0226dfb..c5e2b77 100644 --- a/.github/workflows/changesets-pr-status.yml +++ b/.github/workflows/changesets-pr-status.yml @@ -15,7 +15,8 @@ jobs: name: Generate PR status # skip the release PR opened by `changesets/action`: it never has changesets if: ${{ !startsWith(github.head_ref, 'changeset-release/') }} - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 5 permissions: contents: read # to check out repo (actions/checkout) @@ -35,7 +36,8 @@ jobs: pr-comment: name: Comment on PR needs: pr-status - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 5 permissions: pull-requests: write # to create and update comments on PRs (changesets/action/pr-comment) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3b6e7af..673384a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,6 +15,10 @@ concurrency: permissions: {} +defaults: + run: + shell: bash + jobs: build-and-test: name: Build and test ${{ matrix.node }} on ${{ matrix.os }} @@ -23,8 +27,9 @@ jobs: fail-fast: false matrix: node: [24, 26] - os: [ubuntu-latest, macos-latest] + os: [ubuntu-24.04, macos-15] runs-on: ${{ matrix.os }} + timeout-minutes: 10 permissions: contents: read @@ -49,7 +54,8 @@ jobs: code-checks: name: Code checks - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 5 permissions: contents: read @@ -92,7 +98,8 @@ jobs: docs: name: Docs site - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 10 permissions: contents: read @@ -136,7 +143,8 @@ jobs: image: name: Server image - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 10 permissions: contents: read @@ -175,8 +183,9 @@ jobs: ci-ok: name: CI OK - runs-on: ubuntu-latest - if: always() + runs-on: ubuntu-24.04 + timeout-minutes: 1 + if: ${{ always() }} needs: - build-and-test - code-checks diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml index 985a241..3fd2c0a 100644 --- a/.github/workflows/deploy-docs.yml +++ b/.github/workflows/deploy-docs.yml @@ -17,11 +17,16 @@ concurrency: permissions: {} +defaults: + run: + shell: bash + jobs: deploy: name: Build and deploy to Pages - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 10 environment: name: docs diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml index 1911d51..ef940bc 100644 --- a/.github/workflows/publish-image.yml +++ b/.github/workflows/publish-image.yml @@ -21,11 +21,16 @@ concurrency: permissions: {} +defaults: + run: + shell: bash + jobs: publish: name: Build and push to GHCR - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 15 permissions: contents: read # to check out the repository @@ -50,6 +55,8 @@ jobs: - name: Set up Buildx uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + with: + cache-binary: false # a poisoned cache entry must not reach the published image - name: Log in to GHCR uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 27a53d9..6f048a4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,10 @@ concurrency: permissions: {} # Skips the pre-commit hook — see ../CONTRIBUTING.md, "Workflows That Commit". +defaults: + run: + shell: bash + env: LEFTHOOK: 0 @@ -29,7 +33,8 @@ jobs: environment: release-npm if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository }} - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 10 permissions: contents: write # required to push release commits and tags @@ -86,8 +91,8 @@ jobs: if: ${{ contains(fromJSON(needs.release.outputs.publishedPackages).*.name, '@stats-forge/github-stats-server') }} uses: $/.github/workflows/publish-image.yml permissions: - contents: read - packages: write + contents: read # to check out the repository + packages: write # to push the image to GHCR with: ref: ${{ github.event.workflow_run.head_sha }} @@ -96,7 +101,8 @@ jobs: annotate: name: Annotate needs: [release, image] - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 5 permissions: contents: write # required to edit the release body @@ -148,9 +154,9 @@ jobs: if: ${{ needs.release.outputs.published == 'true' }} uses: $/.github/workflows/deploy-docs.yml permissions: - contents: read - pages: write - id-token: write + contents: read # to check out repo (actions/checkout) + pages: write # to publish to GitHub Pages (actions/deploy-pages) + id-token: write # to verify the deployment originates from this workflow with: ref: ${{ github.event.workflow_run.head_sha }} @@ -160,7 +166,8 @@ jobs: name: Comment needs: release if: ${{ needs.release.outputs.published == 'true' }} - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 5 environment: release-npm # where the release helper's credentials live @@ -192,7 +199,8 @@ jobs: on-ci-fail: name: 'Failure' - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 1 if: ${{ github.event.workflow_run.conclusion == 'failure' }} steps: - run: echo "CI failed. Release will not run" diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 6f0b5f4..2fb2b0f 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -42,9 +42,9 @@ permissions: {} jobs: renovate: - if: github.repository == 'stats-forge/github-stats-forge' + if: ${{ github.repository == 'stats-forge/github-stats-forge' }} name: Renovate - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 30 diff --git a/.github/workflows/update-emoji-map.yml b/.github/workflows/update-emoji-map.yml index 11019ce..be01883 100644 --- a/.github/workflows/update-emoji-map.yml +++ b/.github/workflows/update-emoji-map.yml @@ -17,14 +17,19 @@ on: permissions: {} # Skips the pre-commit hook — see ../CONTRIBUTING.md, "Workflows That Commit". +defaults: + run: + shell: bash + env: LEFTHOOK: 0 jobs: update-emoji-map: - if: github.repository == 'stats-forge/github-stats-forge' + if: ${{ github.repository == 'stats-forge/github-stats-forge' }} name: Generate Emoji Map - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 5 environment: update-meta-files # where HELPER_APP_ID and HELPER_PRIVATE_KEY live @@ -64,6 +69,8 @@ jobs: Regenerated from the [GitHub shortcode preset in emojibase](https://github.com/milesj/emojibase/blob/master/packages/data/en/shortcodes/github.raw.json).' + # The action also commits and pushes the branch, not only opens the PR. + # jactionlint ignore=superfluous-actions - name: Create Pull Request if the upstream shortcodes changed id: create_pr uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 diff --git a/.github/workflows/update-language-colors.yml b/.github/workflows/update-language-colors.yml index 09312b3..ec006fe 100644 --- a/.github/workflows/update-language-colors.yml +++ b/.github/workflows/update-language-colors.yml @@ -16,14 +16,19 @@ on: permissions: {} # Skips the pre-commit hook — see ../CONTRIBUTING.md, "Workflows That Commit". +defaults: + run: + shell: bash + env: LEFTHOOK: 0 jobs: update-languages: - if: github.repository == 'stats-forge/github-stats-forge' + if: ${{ github.repository == 'stats-forge/github-stats-forge' }} name: Generate Language Colors - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 5 environment: update-meta-files # where HELPER_APP_ID and HELPER_PRIVATE_KEY live @@ -63,6 +68,8 @@ jobs: Regenerated from the [upstream linguist languages file](https://github.com/github/linguist/blob/master/lib/linguist/languages.yml).' + # The action also commits and pushes the branch, not only opens the PR. + # jactionlint ignore=superfluous-actions - name: Create Pull Request if upstream language file is changed id: create_pr uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 From e9941a5f215f28228fa47b4f918926365b105166 Mon Sep 17 00:00:00 2001 From: Marco Pasqualetti <24919330+marcalexiei@users.noreply.github.com> Date: Sun, 11 Oct 2026 01:26:59 +0200 Subject: [PATCH 2/2] ci: add jactionlint to the GitHub Actions audit workflow --- .github/jactionlint.yaml | 1 + .github/workflows/github-actions-audit.yml | 23 ++++++++++++++++++++-- 2 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 .github/jactionlint.yaml diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml new file mode 100644 index 0000000..07d42f9 --- /dev/null +++ b/.github/jactionlint.yaml @@ -0,0 +1 @@ +profile: pedantic diff --git a/.github/workflows/github-actions-audit.yml b/.github/workflows/github-actions-audit.yml index 061b675..c8404b4 100644 --- a/.github/workflows/github-actions-audit.yml +++ b/.github/workflows/github-actions-audit.yml @@ -19,10 +19,9 @@ concurrency: jobs: zizmor: name: zizmor - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 timeout-minutes: 5 permissions: - security-events: write # required to upload SARIF results to GitHub Code Scanning contents: read # required to check out the repository actions: read # required by zizmor to read workflow runs @@ -34,3 +33,23 @@ jobs: - name: Run zizmor uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + with: + advanced-security: false + + jactionlint: + name: jactionlint + runs-on: ubuntu-24.04 + timeout-minutes: 5 + permissions: + contents: read # required to check out the repository + + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run jactionlint + uses: jdx/jactionlint@a0bb9f012b6b5760c17c9ccd040001d08002a10e # v2.1.0 + with: + online: false # keeps the token out of the downloaded binary's environment