mise-action/.github/workflows/test.yml
jdx 46bb674500
chore(ci): add zizmor workflow for github actions security analysis (#471)
Adds [zizmor](https://github.com/zizmorcore/zizmor) to audit GitHub
Actions workflows for security issues. Runs on push to main and on PRs
that change `.github/workflows/**`. Fails CI on any finding.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Mostly CI/workflow hardening, but it also changes release automation
(`postversion.sh`) and workflow permissions/credentials behavior, which
could break tagging/publishing if misconfigured.
> 
> **Overview**
> Adds a new `zizmor` workflow that runs on PRs/pushes touching
`.github/workflows/**` to security-audit workflows.
> 
> Hardens existing workflows by defaulting to least-privilege
`permissions`, setting `actions/checkout` to `persist-credentials:
false`, and adjusting related behavior (e.g., `scripts/postversion.sh`
now runs `gh auth setup-git` so `git push` still works; `ci.yml`
disables `mise-action` caching; `test.yml` avoids interpolating
`steps.bad.outcome` inside a shell string by passing it via env).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
d878aee510. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-12 15:00:12 -05:00

182 lines
5.2 KiB
YAML

name: "build-test"
on: # rebuild any PRs and main branch changes
pull_request:
branches:
- main
push:
branches:
- main
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref_name }}
cancel-in-progress: true
jobs:
build: # make sure build/ci work properly
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
- run: aube install
- run: aubr all
test: # make sure the action works on a clean machine without building
strategy:
fail-fast: false
matrix:
include:
- name: ubuntu
runs-on: ubuntu-latest
- name: macos
runs-on: macos-latest
- name: windows
runs-on: windows-latest
- name: alpine
runs-on: ubuntu-latest
container: alpine:latest
requirements: apk add --no-cache curl bash
name: ${{ matrix.name }}
runs-on: ${{ matrix.runs-on }}
container: ${{ matrix.container }}
steps:
- name: Install requirements
if: ${{ matrix.requirements }}
run: ${{ matrix.requirements }}
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Setup mise
uses: ./
with:
mise_toml: |
[tools]
jq = "1.7.1"
[env]
MY_ENV_VAR = "abc"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: mise --version
- run: mise x jq -- jq --version
- run: which jq
- run: jq --version
- run: . scripts/test.sh
shell: bash
specific_version:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Setup mise
uses: ./
with:
cache_save: ${{ github.ref_name == 'main' }}
cache_key_prefix: mise-v1
version: 2025.7.3
sha256: d38d4993c5379a680b50661f86287731dc1d1264777880a79b786403af337948
install_args: bun
mise_toml: |
[tools]
bun = "1"
- run: which bun
- run: bun -v
- name: Update mise
uses: ./
with:
cache_save: ${{ github.ref_name == 'main' }}
cache_key_prefix: mise-v1
version: v2025.7.3 # should trim the `v`
sha256: d38d4993c5379a680b50661f86287731dc1d1264777880a79b786403af337948
checksum_failure:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Setup mise
id: bad
uses: ./
with:
version: 2024.9.6
sha256: 1f0b8c3d2e4f5a6b7c8d9e0f1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t
continue-on-error: true
- name: Dump steps context
if: ${{ always() }}
env:
STEPS_CONTEXT: ${{ toJson(steps) }}
run: echo "$STEPS_CONTEXT"
- name: expect failure
run: echo "Failed as expected"
if: ${{ steps.bad.outcome == 'failure' }}
- name: not failed as expected
run: |
echo "Expected failure but the job was ${STEPS_BAD_OUTCOME}"
exit 1
if: ${{ steps.bad.outcome != 'failure' }}
env:
STEPS_BAD_OUTCOME: ${{ steps.bad.outcome }}
custom_cache_key:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Setup mise with custom cache key
uses: ./
with:
cache_key: "custom-{{platform}}-{{install_args_hash}}-${{ github.run_id }}"
install_args: "jq@1.7.1"
mise_toml: |
[tools]
jq = "1.7.1"
- run: mise --version
- run: mise x jq -- jq --version
- run: which jq
- run: jq --version
fetch_from_github:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Setup mise from mise.jdx.dev
uses: ./
with:
fetch_from_github: true
cache: false
cache_save: false
mise_toml: |
[tools]
jq = "1.7.1"
- run: mise --version
- run: mise x jq -- jq --version
- run: which jq
- run: jq --version
final:
needs:
- build
- test
- specific_version
- checksum_failure
- custom_cache_key
- fetch_from_github
runs-on: ubuntu-latest
timeout-minutes: 1
# Run on success or upstream failure but skip when the workflow is cancelled
# — `always()` would override `cancel-in-progress` and waste a runner.
if: ${{ !cancelled() }}
steps:
- name: Check CI job results
if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
run: exit 1