From dd20fc776e426a2b8f24042930da9e44256af7cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 28 Sep 2026 11:49:38 +0300 Subject: [PATCH 1/5] Enable zizmor checks as git hook --- .github/workflows/git-hooks.yml | 28 ++++++++++++++++++++++++++++ .pre-commit-config.yaml | 6 ++++++ 2 files changed, 34 insertions(+) create mode 100644 .github/workflows/git-hooks.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/workflows/git-hooks.yml b/.github/workflows/git-hooks.yml new file mode 100644 index 0000000..91d8d0e --- /dev/null +++ b/.github/workflows/git-hooks.yml @@ -0,0 +1,28 @@ +name: "Git Hooks" + +on: + push: + branches: + - main + pull_request: ~ + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + run-prek: + name: prek run --all-files + runs-on: ubuntu-26.04 + timeout-minutes: 1 + + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run prek + uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..8832138 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,6 @@ +repos: + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: v1.30.1 + hooks: + - id: zizmor + args: ["--no-progress", "--persona=auditor"] From 33e0413224b6746a382111b870d378ded0871211 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 28 Sep 2026 12:04:41 +0300 Subject: [PATCH 2/5] Fix artipacked https://docs.zizmor.sh/audits/#artipacked --- .github/workflows/ci.yml | 4 ++++ .github/workflows/docs.yml | 1 + .github/workflows/release.yml | 16 ++++++++++++++++ 3 files changed, 21 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8c9180c..0a9101b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,6 +21,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false - uses: ./.github/actions/setup @@ -46,6 +47,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false - uses: ./.github/actions/setup with: @@ -61,6 +63,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false - uses: ./.github/actions/setup with: @@ -88,6 +91,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false - uses: ./.github/actions/setup diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 930c767..cecbc03 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -21,6 +21,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false - uses: ./.github/actions/setup diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 466d830..0e57033 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,8 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false + - uses: ./.github/actions/setup - name: Generate type stubs run: | @@ -36,6 +38,8 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.x' @@ -85,6 +89,8 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.x' @@ -110,6 +116,8 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.x' @@ -135,6 +143,8 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: type-stubs @@ -157,6 +167,8 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false + - uses: ./.github/actions/setup - name: Build FFI shared library run: cargo build --release -p processing_ffi --features wayland,x11,webcam @@ -180,6 +192,8 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false + - uses: dtolnay/rust-toolchain@stable - name: Build FFI shared library run: cargo build --release -p processing_ffi --features webcam @@ -203,6 +217,8 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true + persist-credentials: false + - uses: dtolnay/rust-toolchain@stable - name: Build FFI shared library run: cargo build --release -p processing_ffi --features webcam From 25037c35ed13377e250d11ae15d41ddc1eee3edc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 28 Sep 2026 12:10:03 +0300 Subject: [PATCH 3/5] Fix unpinned-uses https://docs.zizmor.sh/audits/#unpinned-uses --- .github/actions/setup/action.yml | 2 +- .github/workflows/release.yml | 6 +++--- .github/workflows/visual-comment.yml | 6 +++--- .github/workflows/visual.yml | 12 ++++++------ 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index ae33a94..ea3ba3f 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -23,6 +23,6 @@ runs: shell: bash - name: Install Rust - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@271ea64dfe6a2ce0953f640d4ac3de19c5f75523 # 1.82.0 with: components: ${{ inputs.components }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0e57033..39b793d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -194,7 +194,7 @@ jobs: submodules: true persist-credentials: false - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@271ea64dfe6a2ce0953f640d4ac3de19c5f75523 # 1.82.0 - name: Build FFI shared library run: cargo build --release -p processing_ffi --features webcam - name: Stage release files @@ -219,7 +219,7 @@ jobs: submodules: true persist-credentials: false - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@271ea64dfe6a2ce0953f640d4ac3de19c5f75523 # 1.82.0 - name: Build FFI shared library run: cargo build --release -p processing_ffi --features webcam - name: Stage release files @@ -252,7 +252,7 @@ jobs: merge-multiple: true path: dist - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 github-release: name: Create GitHub Release diff --git a/.github/workflows/visual-comment.yml b/.github/workflows/visual-comment.yml index b850346..f293f07 100644 --- a/.github/workflows/visual-comment.yml +++ b/.github/workflows/visual-comment.yml @@ -21,7 +21,7 @@ jobs: actions: read pull-requests: write steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 id: download continue-on-error: true with: @@ -48,7 +48,7 @@ jobs: - name: Post comment if: steps.pr.outputs.notable == 'true' - uses: marocchino/sticky-pull-request-comment@v3.0.5 + uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 with: header: visual-regression number_force: ${{ steps.pr.outputs.number }} @@ -57,7 +57,7 @@ jobs: # A clean run only refreshes an earlier comment, so passing PRs stay quiet. - name: Update comment if: steps.pr.outputs.notable == 'false' - uses: marocchino/sticky-pull-request-comment@v3.0.5 + uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 with: header: visual-regression number_force: ${{ steps.pr.outputs.number }} diff --git a/.github/workflows/visual.yml b/.github/workflows/visual.yml index 2a2f817..4c32f89 100644 --- a/.github/workflows/visual.yml +++ b/.github/workflows/visual.yml @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 90 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: true # PR checkouts are merge commits; HEAD^1 is the main commit they're compared against. @@ -51,14 +51,14 @@ jobs: - uses: ./.github/actions/install-mesa - - uses: astral-sh/setup-uv@v6 + - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 - name: Install xvfb and odiff run: | sudo apt-get install -y --no-install-recommends xvfb npm install -g "odiff-bin@$ODIFF_VERSION" - - uses: actions/cache@v4 + - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/bin/ @@ -74,7 +74,7 @@ jobs: - name: Render run: xvfb-run -a -s "-screen 0 1920x1080x24" python3 tests/visual/visual.py render --out out/actual - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: visual-screenshots path: out/actual @@ -113,7 +113,7 @@ jobs: mkdir -p out/baseline python3 tests/visual/visual.py compare --baseline out/baseline --actual out/actual --out out/report $ALLOW_CHANGES - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 id: report if: always() && hashFiles('out/report/report.html') != '' with: @@ -137,7 +137,7 @@ jobs: echo "$PR_NUMBER" > out/comment/pr jq '[.results[] | select(.status != "pass")] | length > 0' out/report/results.json > out/comment/notable - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() && hashFiles('out/comment/comment.md') != '' with: name: visual-comment From 8eba85b3e813fe5175cda0469410ba5d977e4f88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 28 Sep 2026 12:12:41 +0300 Subject: [PATCH 4/5] Fix self-repository https://docs.zizmor.sh/audits/#self-repository --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/docs.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/visual.yml | 4 ++-- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0a9101b..53ed591 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: submodules: true persist-credentials: false - - uses: ./.github/actions/setup + - uses: $/.github/actions/setup - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: @@ -49,7 +49,7 @@ jobs: submodules: true persist-credentials: false - - uses: ./.github/actions/setup + - uses: $/.github/actions/setup with: components: rustfmt @@ -65,7 +65,7 @@ jobs: submodules: true persist-credentials: false - - uses: ./.github/actions/setup + - uses: $/.github/actions/setup with: components: clippy @@ -93,7 +93,7 @@ jobs: submodules: true persist-credentials: false - - uses: ./.github/actions/setup + - uses: $/.github/actions/setup - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index cecbc03..3c84148 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -23,7 +23,7 @@ jobs: submodules: true persist-credentials: false - - uses: ./.github/actions/setup + - uses: $/.github/actions/setup - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 39b793d..393c580 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: submodules: true persist-credentials: false - - uses: ./.github/actions/setup + - uses: $/.github/actions/setup - name: Generate type stubs run: | cargo build --release -p processing_pyo3 @@ -169,7 +169,7 @@ jobs: submodules: true persist-credentials: false - - uses: ./.github/actions/setup + - uses: $/.github/actions/setup - name: Build FFI shared library run: cargo build --release -p processing_ffi --features wayland,x11,webcam - name: Stage release files diff --git a/.github/workflows/visual.yml b/.github/workflows/visual.yml index 4c32f89..f7cf03d 100644 --- a/.github/workflows/visual.yml +++ b/.github/workflows/visual.yml @@ -47,9 +47,9 @@ jobs: fetch-depth: 2 persist-credentials: false - - uses: ./.github/actions/setup + - uses: $/.github/actions/setup - - uses: ./.github/actions/install-mesa + - uses: $/.github/actions/install-mesa - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 From b4d3bc6685cc28d23b590eecfe0acfa448a906d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 28 Sep 2026 15:07:21 +0300 Subject: [PATCH 5/5] Fix superfluous-actions https://docs.zizmor.sh/audits/#superfluous-actions --- .github/actions/setup/action.yml | 10 ++++++---- .github/workflows/release.yml | 10 ++++------ 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index ea3ba3f..a5e6737 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -22,7 +22,9 @@ runs: sudo ldconfig shell: bash - - name: Install Rust - uses: dtolnay/rust-toolchain@271ea64dfe6a2ce0953f640d4ac3de19c5f75523 # 1.82.0 - with: - components: ${{ inputs.components }} + - name: Install Rust components + if: inputs.components != '' + env: + COMPONENTS: ${{ inputs.components }} + run: rustup component add ${COMPONENTS//,/ } + shell: bash diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 393c580..25ab643 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -194,7 +194,6 @@ jobs: submodules: true persist-credentials: false - - uses: dtolnay/rust-toolchain@271ea64dfe6a2ce0953f640d4ac3de19c5f75523 # 1.82.0 - name: Build FFI shared library run: cargo build --release -p processing_ffi --features webcam - name: Stage release files @@ -219,7 +218,6 @@ jobs: submodules: true persist-credentials: false - - uses: dtolnay/rust-toolchain@271ea64dfe6a2ce0953f640d4ac3de19c5f75523 # 1.82.0 - name: Build FFI shared library run: cargo build --release -p processing_ffi --features webcam - name: Stage release files @@ -272,7 +270,7 @@ jobs: pattern: wheels-* merge-multiple: true path: release-assets - - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 - with: - files: release-assets/* - generate_release_notes: true + - name: Create GitHub Release + env: + GH_TOKEN: ${{ github.token }} + run: gh release create "${GITHUB_REF_NAME}" release-assets/* --generate-notes