dilim/containerd
1
0
Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-08-09 09:33:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

gha: apply zizmor fixes

Browse Source 
Results of automated fixes using;

    zizmor --fix=all --min-severity medium .

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn
2026-06-04 10:54:49 +02:00
parent 8722c46313
commit 9f0bb640ce
14 changed files with 51 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.github/dependabot.yml vendored
View File

@@ -18,8 +18,12 @@ updates:
otel:
patterns:
- "go.opentelemetry.io/*"
cooldown:
default-days: 7
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 10
cooldown:
default-days: 7

9
.github/workflows/api-release.yml vendored
View File

@@ -26,12 +26,11 @@ jobs:
with:
ref: ${{ github.ref }}
path: src/github.com/containerd/containerd
persist-credentials: false
- name: Check signature
env:
REF: ${{ github.ref }}
run: |
releasever="$REF"
releasever=${GITHUB_REF}
releasever="${releasever#refs/tags/}"
TAGCHECK=$(git tag -v ${releasever} 2>&1 >/dev/null) ||
echo "${TAGCHECK}" | grep -q "error" && {
@@ -45,10 +44,8 @@ jobs:
- name: Release content
id: contentrel
env:
REF: ${{ github.ref }}
run: |
RELEASEVER="$REF"
RELEASEVER=${GITHUB_REF}
echo "stringver=${RELEASEVER#refs/tags/api/v}" >> $GITHUB_OUTPUT
git tag -l ${RELEASEVER#refs/tags/} -n20000 | tail -n +3 | cut -c 5- >release-notes.md
working-directory: src/github.com/containerd/containerd

2
.github/workflows/buf-breaking.yml vendored
View File

@@ -24,6 +24,8 @@ jobs:
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: bufbuild/buf-action@fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
with:
version: 1.63.0

1
.github/workflows/build-test-images.yml vendored
View File

@@ -44,6 +44,7 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
path: src/github.com/containerd/containerd
persist-credentials: false
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go

20
.github/workflows/ci.yml vendored
View File

@@ -33,6 +33,8 @@ jobs:
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: ./.github/actions/install-go
- uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
with:
@@ -53,6 +55,7 @@ jobs:
with:
path: src/github.com/containerd/containerd
fetch-depth: 100
persist-credentials: false
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go
@@ -88,6 +91,7 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
path: src/github.com/containerd/containerd
persist-credentials: false
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go
@@ -107,6 +111,8 @@ jobs:
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: ./.github/actions/install-go
- run: go install github.com/cpuguy83/go-md2man/v2@v2.0.7
- run: make man
@@ -137,6 +143,8 @@ jobs:
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: ./.github/actions/install-go
- run: |
set -e -x
@@ -193,6 +201,8 @@ jobs:
- os: ${{ github.event.repository.private && 'ubuntu-24.04-arm' || '' }}
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: ./.github/actions/install-go
with:
go-version: ${{ matrix.go-version }}
@@ -228,6 +238,7 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
path: src/github.com/containerd/containerd
persist-credentials: false
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go
@@ -236,6 +247,7 @@ jobs:
repository: kubernetes-sigs/cri-tools
path: src/github.com/kubernetes-sigs/cri-tools
fetch-depth: 0
persist-credentials: false
- name: Set env
run: |
@@ -388,6 +400,8 @@ jobs:
GOTEST: gotestsum --
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: ./.github/actions/install-go
- name: Install containerd dependencies
@@ -628,6 +642,8 @@ jobs:
cat /proc/cpuinfo
free -mt
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: /root/.vagrant.d
@@ -684,6 +700,8 @@ jobs:
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Set up cgroup v2 delegation
run: |
sudo mkdir -p /etc/systemd/system/user@.service.d
@@ -733,6 +751,8 @@ jobs:
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: ./.github/actions/install-go
- run: script/setup/install-gotestsum
- run: script/setup/install-teststat

2
.github/workflows/codeql.yml vendored
View File

@@ -31,6 +31,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: ./.github/actions/install-go

2
.github/workflows/fuzz.yml vendored
View File

@@ -41,6 +41,8 @@ jobs:
timeout-minutes: 30
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: ./.github/actions/install-go
- run: script/go-test-fuzz.sh
- name: Upload Crash

3
.github/workflows/images.yml vendored
View File

@@ -29,6 +29,7 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
path: src/github.com/containerd/containerd
persist-credentials: false
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go
@@ -74,6 +75,6 @@ jobs:
sudo ctr content fetch --all-platforms ${upstream}
sudo ctr images ls
sudo ctr --debug images push -u ${{ github.actor }}:${{ secrets.GITHUB_TOKEN }} ${mirror} ${upstream}
sudo ctr --debug images push -u ${GITHUB_ACTOR}:${{ secrets.GITHUB_TOKEN }} ${mirror} ${upstream}
sudo kill $containerd_pid

2
.github/workflows/links.yml vendored
View File

@@ -19,6 +19,8 @@ jobs:
timeout-minutes: 15
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0
with:

2
.github/workflows/nightly.yml vendored
View File

@@ -23,6 +23,7 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
path: src/github.com/containerd/containerd
persist-credentials: false
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go
@@ -141,6 +142,7 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
path: src/github.com/containerd/containerd
persist-credentials: false
- uses: ./src/github.com/containerd/containerd/.github/actions/install-go

2
.github/workflows/node-e2e.yml vendored
View File

@@ -40,6 +40,7 @@ jobs:
with:
path: src/github.com/containerd/containerd
fetch-depth: 0
persist-credentials: false
- name: Checkout Kubernetes
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -48,6 +49,7 @@ jobs:
path: src/k8s.io/kubernetes
ref: ${{ inputs.k8s_version }}
fetch-depth: 0
persist-credentials: false
- name: Install Go
uses: ./src/github.com/containerd/containerd/.github/actions/install-go

8
.github/workflows/release.yml vendored
View File

@@ -30,13 +30,14 @@ jobs:
with:
ref: ${{ github.ref }}
path: src/github.com/containerd/containerd
persist-credentials: false
- name: Check signature
run: |
# git tag -v requires an allowedSignersFile to be configured and exist for ssh signature verification
touch ${{ runner.temp }}/empty-allowedSignersFile
git config --global gpg.ssh.allowedSignersFile ${{ runner.temp }}/empty-allowedSignersFile
releasever=${{ github.ref }}
releasever=${GITHUB_REF}
releasever="${releasever#refs/tags/}"
TAGCHECK=$(git tag -v ${releasever} 2>&1 >/dev/null) ||
echo "${TAGCHECK}" | grep -q "error" && {
@@ -51,7 +52,7 @@ jobs:
- name: Release content
id: contentrel
run: |
RELEASEVER=${{ github.ref }}
RELEASEVER=${GITHUB_REF}
echo "stringver=${RELEASEVER#refs/tags/v}" >> $GITHUB_OUTPUT
git tag -l ${RELEASEVER#refs/tags/} -n20000 | tail -n +3 | cut -c 5- >release-notes.md
working-directory: src/github.com/containerd/containerd
@@ -86,7 +87,7 @@ jobs:
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
shell: bash
run: |
releasever=${{ github.ref }}
releasever=${GITHUB_REF}
releasever="${releasever#refs/tags/}"
echo "RELEASE_VER=${releasever}" >> $GITHUB_ENV
- name: Checkout containerd
@@ -98,6 +99,7 @@ jobs:
repository: ${{ github.repository }}
ref: ${{ github.ref }}
path: src/github.com/containerd/containerd
persist-credentials: false
- name: Setup buildx instance
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

2
.github/workflows/windows-hyperv-periodic.yml vendored
View File

@@ -45,6 +45,8 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Install required packages
run: |

2
.github/workflows/windows-periodic.yml vendored
View File

@@ -45,6 +45,8 @@ jobs:
timeout-minutes: 90
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Install required packages
run: |