diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 050cf691740..e9248aaaf3e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,8 @@ updates: day: sunday time: '22:00' timezone: Etc/UTC + cooldown: + default-days: 7 open-pull-requests-limit: 5 groups: minor-and-patch: @@ -26,6 +28,8 @@ updates: day: sunday time: '22:00' timezone: Etc/UTC + cooldown: + default-days: 7 open-pull-requests-limit: 5 groups: minor-and-patch: @@ -40,6 +44,8 @@ updates: day: sunday time: '22:00' timezone: Etc/UTC + cooldown: + default-days: 7 open-pull-requests-limit: 5 groups: minor-and-patch: @@ -57,6 +63,8 @@ updates: day: sunday time: '22:00' timezone: Etc/UTC + cooldown: + default-days: 7 open-pull-requests-limit: 5 ignore: - dependency-name: "*" diff --git a/.github/workflows/acceptance.yml b/.github/workflows/acceptance.yml index 5c0d23c9dd7..258b907bd04 100644 --- a/.github/workflows/acceptance.yml +++ b/.github/workflows/acceptance.yml @@ -90,7 +90,7 @@ jobs: services: mysql: - image: >- + image: >- # zizmor: ignore[unpinned-images] tags come from the caller's databases input, or the fixed mariadb:10.6 fallback ${{ case(startsWith(matrix.database,'mysql:') || startsWith(matrix.database,'mariadb:'), matrix.database, inputs.federated-folder != '', 'mariadb:10.6', '') }} env: MYSQL_ROOT_PASSWORD: password @@ -105,7 +105,7 @@ jobs: ports: - 3306:3306 postgres: - image: ${{ case(startsWith(matrix.database,'postgres:'), matrix.database, '') }} + image: ${{ case(startsWith(matrix.database,'postgres:'), matrix.database, '') }} # zizmor: ignore[unpinned-images] the tag comes from the caller's databases input env: POSTGRES_DB: owncloud POSTGRES_USER: owncloud @@ -135,12 +135,14 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: owncloud/core + persist-credentials: false - name: Checkout testing app uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: apps/testing repository: owncloud/testing + persist-credentials: false - name: Setup testing app run: | @@ -154,6 +156,7 @@ jobs: path: apps/${{ inputs.additional-app }} repository: owncloud/${{ inputs.additional-app }} token: ${{ inputs.additional-app-github-token || github.token }} + persist-credentials: false - name: Setup additional app if: ${{ inputs.additional-app != '' }} @@ -175,7 +178,7 @@ jobs: sudo apt-get install -y -o Acquire::Retries=3 "$ADDITIONAL_PACKAGES" - name: Setup PHP - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} extensions: apcu, ctype, curl, exif, fileinfo, gd, iconv, imagick, intl, json, mbstring, memcached, pdo, posix, simplexml, xml, zip, smbclient, ldap, krb5 @@ -190,6 +193,7 @@ jobs: with: path: apps/files_primary_s3 repository: owncloud/files_primary_s3 + persist-credentials: false - name: Setup files_primary_s3 app if: ${{ inputs.use-scality-s3 }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 06292d4c324..0dcb9aae6b0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,11 +24,11 @@ jobs: js-unit: name: JavaScript Unit - uses: ./.github/workflows/js-unit.yml + uses: $/.github/workflows/js-unit.yml php-unit: name: PHP Unit - uses: ./.github/workflows/php-unit.yml + uses: $/.github/workflows/php-unit.yml with: php-versions: '["8.3"]' @@ -36,7 +36,7 @@ jobs: # Same display name as php-unit so both appear in one group of checks. It # stays a separate job because the acceptance jobs must not need Oracle. name: PHP Unit - uses: ./.github/workflows/php-unit.yml + uses: $/.github/workflows/php-unit.yml with: php-versions: '["8.3"]' databases: '["oracle:23"]' @@ -47,6 +47,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Validate changelog entries uses: actionhippie/calens@2008d3a7a90cf05a2a001a3d47cac06cb1b74617 # v1.14.2 @@ -55,7 +57,7 @@ jobs: if: ${{ !contains(github.event.pull_request.title, 'full-ci') }} name: API Smoke Tests needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-api-tests: true server-folder: 'server' @@ -74,7 +76,7 @@ jobs: # There is no full-ci variant on S3, so this runs on every PR. name: API Smoke Tests on S3 needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-api-tests: true server-folder: 'server' @@ -94,7 +96,7 @@ jobs: if: contains(github.event.pull_request.title, 'full-ci') name: API Tests needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-api-tests: true server-folder: 'server' @@ -127,7 +129,7 @@ jobs: if: contains(github.event.pull_request.title, 'full-ci') name: API Tests Notifications needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-api-tests: true server-folder: 'server' @@ -138,7 +140,7 @@ jobs: if: contains(github.event.pull_request.title, 'full-ci') name: API Tests Previews needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-api-tests: true additional-packages: 'imagemagick' @@ -149,7 +151,7 @@ jobs: if: contains(github.event.pull_request.title, 'full-ci') name: API Tests Federation needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-api-tests: true server-folder: 'server' @@ -160,7 +162,7 @@ jobs: if: ${{ !contains(github.event.pull_request.title, 'full-ci') }} name: CLI Smoke Tests needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-cli-tests: true use-email-server: true @@ -171,7 +173,7 @@ jobs: if: contains(github.event.pull_request.title, 'full-ci') name: CLI Tests needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-cli-tests: true server-folder: 'server' @@ -181,7 +183,7 @@ jobs: if: contains(github.event.pull_request.title, 'full-ci') name: CLI Tests with Email needs: [semantic-git-messages, php-unit, calens] - uses: ./.github/workflows/acceptance.yml + uses: $/.github/workflows/acceptance.yml with: do-cli-tests: true use-email-server: true diff --git a/.github/workflows/js-unit.yml b/.github/workflows/js-unit.yml index 29a163d47b2..3087075d41d 100644 --- a/.github/workflows/js-unit.yml +++ b/.github/workflows/js-unit.yml @@ -12,6 +12,8 @@ jobs: steps: - name: Clone owncloud/core uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 diff --git a/.github/workflows/lint-and-codestyle.yml b/.github/workflows/lint-and-codestyle.yml index ce05c1af1bf..1019907af92 100644 --- a/.github/workflows/lint-and-codestyle.yml +++ b/.github/workflows/lint-and-codestyle.yml @@ -28,9 +28,11 @@ jobs: steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php-version }} extensions: curl, gd, json, xml, zip diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 6cc39ecd4ce..bdeabd10d00 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -16,7 +16,7 @@ concurrency: jobs: php-unit-oracle: name: PHP Unit Oracle - uses: ./.github/workflows/php-unit.yml + uses: $/.github/workflows/php-unit.yml with: php-versions: '["8.3"]' databases: '["oracle:23"]' diff --git a/.github/workflows/php-unit.yml b/.github/workflows/php-unit.yml index f25d8395986..290f5755134 100644 --- a/.github/workflows/php-unit.yml +++ b/.github/workflows/php-unit.yml @@ -26,7 +26,7 @@ jobs: services: mysql: - image: >- + image: >- # zizmor: ignore[unpinned-images] the tag comes from the caller's databases input ${{ case(startsWith(matrix.database,'mysql:') || startsWith(matrix.database,'mariadb:'), matrix.database, '') }} env: MYSQL_ROOT_PASSWORD: password @@ -41,7 +41,7 @@ jobs: ports: - 3306:3306 postgres: - image: ${{ case(startsWith(matrix.database,'postgres:'), matrix.database, '') }} + image: ${{ case(startsWith(matrix.database,'postgres:'), matrix.database, '') }} # zizmor: ignore[unpinned-images] the tag comes from the caller's databases input env: POSTGRES_DB: owncloud POSTGRES_USER: owncloud @@ -52,7 +52,7 @@ jobs: # Oracle Database Free 23ai. The APP_USER schema is created inside the # FREEPDB1 pluggable database, so a connect string using SERVICE_NAME is # required - a plain host plus database name would target the CDB root. - image: >- + image: >- # zizmor: ignore[unpinned-images] tag-pinned; a digest would also freeze Oracle's security patches ${{ case(startsWith(matrix.database,'oracle:'), 'gvenzl/oracle-free:23-slim-faststart', '') }} env: ORACLE_PASSWORD: owncloud @@ -71,9 +71,10 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: owncloud/core + persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} extensions: curl, gd, json, xml, zip, imagick${{ case(startsWith(matrix.database,'oracle:'), ', oci8', '') }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000000..7829c845742 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,30 @@ +name: Zizmor + +on: + push: + branches: + - master + pull_request: + types: + - opened + - synchronize + - reopened + schedule: + # Weekly: online audits (known-vulnerable actions, impostor commits) can + # start failing without a code change. + - cron: '0 4 * * 1' + workflow_dispatch: + +permissions: + contents: read + +# Only pull request runs cancel each other: a push to the default branch and +# the weekly run share a ref, and neither should cancel the other. +concurrency: + group: zizmor-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + zizmor: + name: Zizmor + uses: owncloud/reusable-workflows/.github/workflows/zizmor.yml@main