From ab00a14af0f3cf5cfdd1b445a49b0ca4a683536a Mon Sep 17 00:00:00 2001 From: Sheraff Date: Tue, 12 May 2026 21:07:34 +0200 Subject: [PATCH 1/3] ci: add zizmor workflow --- .github/workflows/autofix.yml | 9 +++++++-- .github/workflows/pr.yml | 31 ++++++++++++++++++++----------- .github/workflows/release.yml | 17 ++++++++++------- .github/workflows/zizmor.yml | 24 ++++++++++++++++++++++++ 4 files changed, 61 insertions(+), 20 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml index f737ef8c..84081cfd 100644 --- a/.github/workflows/autofix.yml +++ b/.github/workflows/autofix.yml @@ -15,12 +15,17 @@ permissions: jobs: autofix: name: autofix + permissions: + contents: write + pull-requests: write runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Setup Tools - uses: TanStack/config/.github/setup@main + uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main - name: Fix formatting run: pnpm format - name: Generate Docs diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 3d9c21b9..ab588a83 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -12,23 +12,26 @@ env: permissions: contents: read - pull-requests: write jobs: test: name: Test + permissions: + contents: read + pull-requests: write runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Start Nx Agents run: npx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yaml" - name: Setup Tools - uses: TanStack/config/.github/setup@main + uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main - name: Get base and head commits for `nx affected` - uses: nrwl/nx-set-shas@v4.4.0 + uses: nrwl/nx-set-shas@15514ee4353489ef5a1644bcdae44f0ae2ea45f3 # v4.4.0 with: main-branch-name: main - name: Run Checks @@ -41,9 +44,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Setup Tools - uses: TanStack/config/.github/setup@main + uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main - name: Build Packages run: pnpm run build:all - name: Publish Previews @@ -53,9 +58,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Check Provenance - uses: danielroe/provenance-action@v0.1.1 + uses: danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1 with: fail-on-downgrade: true version-preview: @@ -63,8 +70,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Setup Tools - uses: TanStack/config/.github/setup@main + uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main - name: Changeset Preview - uses: TanStack/config/.github/changeset-preview@main + uses: TanStack/config/.github/changeset-preview@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7551c0d6..4af9ce0f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,27 +12,30 @@ env: NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }} permissions: - contents: write - id-token: write - pull-requests: write + contents: read jobs: release: name: Release if: github.repository_owner == 'TanStack' + permissions: + contents: write + id-token: write + pull-requests: write runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Setup Tools - uses: TanStack/config/.github/setup@main + uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main - name: Run Tests run: pnpm run test:ci - name: Run Changesets (version or publish) id: changesets - uses: changesets/action@v1.7.0 + uses: changesets/action@e87c8ed249971350e47fab7515075f44eb134e5b # v1.7.0 with: version: pnpm run changeset:version publish: pnpm run changeset:publish @@ -40,6 +43,6 @@ jobs: title: 'ci: Version Packages' - name: Comment on PRs about release if: steps.changesets.outputs.published == 'true' - uses: TanStack/config/.github/comment-on-release@main + uses: TanStack/config/.github/comment-on-release@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main with: published-packages: ${{ steps.changesets.outputs.publishedPackages }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..3b69d659 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,24 @@ +name: GitHub Actions Security Analysis + +on: + push: + branches: [main] + pull_request: + branches: ['**'] + +permissions: {} + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Run zizmor + uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 + with: + advanced-security: false + annotations: true From aed2d7c59e8c6016ece1def5eb3e0570265fe0b1 Mon Sep 17 00:00:00 2001 From: Sheraff Date: Wed, 13 May 2026 00:51:31 +0200 Subject: [PATCH 2/3] ci: fix action release pins --- .github/workflows/pr.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index ab588a83..25105197 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -31,7 +31,7 @@ jobs: - name: Setup Tools uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main - name: Get base and head commits for `nx affected` - uses: nrwl/nx-set-shas@15514ee4353489ef5a1644bcdae44f0ae2ea45f3 # v4.4.0 + uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0 with: main-branch-name: main - name: Run Checks diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4af9ce0f..2d4fcca3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,7 +35,7 @@ jobs: run: pnpm run test:ci - name: Run Changesets (version or publish) id: changesets - uses: changesets/action@e87c8ed249971350e47fab7515075f44eb134e5b # v1.7.0 + uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0 with: version: pnpm run changeset:version publish: pnpm run changeset:publish From 982df54bebea3bac0caecbcbbd6746c81b11f001 Mon Sep 17 00:00:00 2001 From: Flo Date: Wed, 13 May 2026 11:46:26 +0200 Subject: [PATCH 3/3] Update .github/workflows/autofix.yml --- .github/workflows/autofix.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml index 84081cfd..50b3c569 100644 --- a/.github/workflows/autofix.yml +++ b/.github/workflows/autofix.yml @@ -15,9 +15,6 @@ permissions: jobs: autofix: name: autofix - permissions: - contents: write - pull-requests: write runs-on: ubuntu-latest steps: - name: Checkout