ci: add zizmor for github action security

oxc-project · Dec 16, 2024 · dc6db04 · dc6db04
1 parent 5714be4
commit dc6db04
Show file tree

Hide file tree

Showing 6 changed files with 24 additions and 6 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -12,7 +12,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/pnpm
 

diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
@@ -12,7 +12,10 @@ jobs:
   format:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Run Format (prettier)
         run: npx prettier . --check
diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
@@ -21,7 +21,10 @@ jobs:
   generate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/pnpm
 

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -12,7 +12,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/pnpm
 

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -12,7 +12,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/pnpm
 

diff --git a/.github/workflows/type-check.yml b/.github/workflows/type-check.yml
@@ -12,7 +12,10 @@ jobs:
   type-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/pnpm