Skip to content

Prepare workflows for the zizmor bump in #360 #365

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robzolkos merged 2 commits into from
Jul 10, 2026
Merged

Prepare workflows for the zizmor bump in #360 #365

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8fb0564
Prepare workflows for the zizmor bump in #360
robzolkos Jul 10, 2026
11709a5
Get npm from the Node tarball instead of the registry
robzolkos Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/release-typescript.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,17 +76,17 @@ jobs:
git fetch origin main
git merge-base --is-ancestor "$GITHUB_SHA" origin/main

# Node 24 bundles npm 11.16, past the 11.5.1 that OIDC trusted publishing
# requires. Publishing therefore uses the npm shipped in the verified Node
# tarball rather than installing one from the registry at release time.
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache
with:
node-version: '22'
node-version: '24'
registry-url: 'https://registry.npmjs.org'
cache: 'npm'
cache-dependency-path: typescript/package-lock.json

- name: Upgrade npm for OIDC trusted publishing
run: npm install -g npm@latest

- name: Install dependencies
run: npm ci

Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
persist-credentials: false

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
with:
scan-type: 'fs'
scan-ref: './go'
Expand Down Expand Up @@ -56,7 +56,7 @@ jobs:
persist-credentials: false

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
with:
scan-type: 'fs'
scan-ref: './typescript'
Expand Down Expand Up @@ -175,7 +175,7 @@ jobs:
persist-credentials: false

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
with:
scan-type: 'fs'
scan-ref: './ruby'
Expand Down Expand Up @@ -215,7 +215,7 @@ jobs:
working-directory: ruby

- name: Install bundler-audit
run: gem install bundler-audit
run: gem install bundler-audit # zizmor: ignore[adhoc-packages] -- bundler-audit is the auditing tool itself; adding it to the SDK's Gemfile would make the gem under audit depend on its own auditor

- name: Update vulnerability database
run: bundle-audit update
Expand Down
Loading