ci: zizmor fixes

.github/actions/spelling/expect.txt

@@ -26,6 +26,7 @@ codelines
 codeql
 colorsets
 Consolas
+cooldown
 datapoints
 dded
 Dexcom
@@ -290,3 +291,4 @@ ytmusic
 Zabcdefghijklmnopqrstuvwxyz
 zenhei
 zenorocha
+zizmor

.github/dependabot.yml

@@ -20,3 +20,6 @@ updates:
       - dependency-name: vue-prism-component
         versions:
           - 2.0.0
+
+    cooldown:
+      default-days: 7

.github/scripts/build.mjs

@@ -114,7 +114,7 @@ async function update({source, output, context = {}, options = {}}) {
   const {plugins, templates, packaged, descriptor} = await metadata({log: false})
   const content = await ejs.renderFile(source, {plugins, templates, packaged, descriptor, ...context}, {async: true, ...options})
   const file = paths.join(__metrics, output)
-  await fs.writeFile(file, content.replace(/^[ ]+$/gm, ""))
+  await fs.writeFile(file, content.replace(/^[ ]+$/gm, "").replaceAll('uses: gh-metrics/metrics@master', 'uses: gh-metrics/metrics@master # zizmor: ignore[unpinned-uses] First-party.'))
   staged.add(file)
 }
 

.github/scripts/files/examples.yml

@@ -32,6 +32,9 @@ on:
         required: true
       WAKATIME_TOKEN:
         required: true
+
+permissions: {}
+
 jobs:
   # ======================================================================================
   # Examples renders
@@ -48,8 +51,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: examples
 
@@ -85,8 +89,9 @@ jobs:
     if: ${{ github.repository == 'gh-metrics/metrics' && false }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: examples
 

.github/workflows/branches.yml

@@ -1,19 +1,26 @@
 name: Check automated branches
 
 on:
+  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     branches:
       - main
       - latest
       - examples
 
+permissions: {}
+
 jobs:
   notice:
     name: Notice for automated branches
     runs-on: ubuntu-latest
+
+    permissions:
+      pull-requests: write
+
     steps:
       - name: Comment on pull request
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const {issue:{number:issue_number}, repo:{owner, repo}} = context
@@ -28,5 +35,5 @@ jobs:
               "",
               "Thanks for your cooperation 🦾!"
             ].join("\n")})
-      - name: Change base branch
+      - name: Fail workflow
         run: exit 1

.github/workflows/ci.yml

@@ -5,6 +5,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
 
   # Build, test and analyze
@@ -25,8 +27,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: master
       - name: Format code
@@ -52,18 +55,20 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: master
       - name: Setup NodeJS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 20
           cache: "npm"
       - name: Setup metrics
         run: npm ci
       - name: Publish rebuild metrics indexes
+        # zizmor: ignore[use-trusted-publishing] False-positive.
         run: npm run build -- publish
 
   # Rebase main branch on master
@@ -75,8 +80,9 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: main
       - name: Configure Git Identity
@@ -97,9 +103,11 @@ jobs:
       packages: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: Login to GitHub registry
-        run: echo ${{ github.token }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+        run: echo $GITHUB_TOKEN | docker login ghcr.io -u $GITHUB_ACTOR --password-stdin
       - name: Build docker image
         run: docker build -t ghcr.io/gh-metrics/metrics:master .
       - name: Publish to GitHub registry
@@ -141,7 +149,7 @@ jobs:
     needs: [docker-master]
     steps:
       - name: Run tests
-        uses: gh-metrics/metrics@master
+        uses: gh-metrics/metrics@master # zizmor: ignore[unpinned-uses] First-party.
         with:
           token: MOCKED_TOKEN
           plugins_errors_fatal: yes
@@ -188,9 +196,11 @@ jobs:
     if: contains(github.event.head_commit.message, '[release]')
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: Login to GitHub registry
-        run: echo ${{ github.token }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+        run: echo $GITHUB_TOKEN | docker login ghcr.io -u $GITHUB_ACTOR --password-stdin
       - name: Pull docker image (master)
         run: docker pull ghcr.io/gh-metrics/metrics:master
       - name: Tag docker image (release)
@@ -213,8 +223,9 @@ jobs:
     needs: [docker-release]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: latest
       - name: Configure Git Identity
@@ -233,7 +244,7 @@ jobs:
     needs: [update-latest]
     steps:
       - name: Run tests
-        uses: gh-metrics/metrics@latest
+        uses: gh-metrics/metrics@latest # zizmor: ignore[unpinned-uses] First-party.
         with:
           token: MOCKED_TOKEN
           plugins_errors_fatal: yes
@@ -262,9 +273,11 @@ jobs:
     needs: [action-latest-test, deploy-latest]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: Setup NodeJS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 20
           cache: "npm"

.github/workflows/clean.yml

@@ -6,14 +6,22 @@ on:
       - published
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   clean:
     name: Clean untagged docker images
     runs-on: ubuntu-latest
     continue-on-error: true
+
+    permissions:
+      packages: write
+
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: Run script
         run: ./delete_ghcr_dangling_images.sh gh-metrics metrics
         working-directory: .github/actions/ghcr-clean

.github/workflows/examples.presets.yml

@@ -4,7 +4,9 @@ on:
     - cron: "0 16 1/2 * *"
   workflow_dispatch:
   workflow_call:
+
 permissions: {}
+
 jobs:
   examples:
     runs-on: ubuntu-latest
@@ -13,16 +15,18 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup NodeJS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 20
       - name: Setup metrics
         run: npm ci
       - name: Publish presets examples
+        # zizmor: ignore[use-trusted-publishing] False-positive.
         run: npm run presets -- publish
         env:
           GITHUB_TOKEN: ${{ github.token }}