mirrors/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2026-09-25 04:09:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

Harden scheduled/downstream build workflows against zizmor findings (#6544)

Browse Source 
* Harden scheduled/downstream build workflows against zizmor findings

Fix all zizmor static-analysis findings in the scheduled/downstream build
workflows without changing behavior:

- template-injection: move ${{ }} expressions out of run: script bodies
  into step-level env: blocks referenced as shell variables
- artipacked: add persist-credentials: false to actions/checkout steps
  (none of these jobs push to git)
- excessive-permissions: add top-level 'permissions: contents: read' to
  macos-26-matrix.yml (other files already restrict permissions)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Address Copilot review comments on PR #6544

- Drop unnecessary command substitution in daily-schedule.yml's
  FILE_NAME_BASE assignment
- Name the two env-block steps in daily-build.yml that previously ran
  unnamed (easier to scan in logs)
- Quote $GITHUB_OUTPUT in the getinputs step

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Remove extra blank lines.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
This commit is contained in:
Mark Kittisopikul
2026-08-04 16:41:29 -04:00
committed by GitHub
co-authored by Claude Sonnet 5 Larry Knox
parent fe17c9b1cd
commit 00af100181
7 changed files with 52 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/cve.yml
+5 -2
View File
@@ -41,15 +41,18 @@ jobs:
persist-credentials: false # Prevents tokens from being written to Git config files
- name: Install HDF5
env:
RUNNER_WORKSPACE: ${{ runner.workspace }}
run: |
mkdir "${{ runner.workspace }}/build"
cd "${{ runner.workspace }}/build"
mkdir "$RUNNER_WORKSPACE/build"
cd "$RUNNER_WORKSPACE/build"
cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DBUILD_TESTING:BOOL=OFF $GITHUB_WORKSPACE
make
sudo make install
- name: Checkout CVE test repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false # Prevents tokens from being written to Git config files
repository: HDFGroup/cve_hdf5
path: cve_hdf5
- name: Run regression tests
.github/workflows/daily-build.yml
+11 -3
View File
@@ -54,14 +54,22 @@ jobs:
id: gethdf5base
run: echo "HDF5_NAME_BASE=$(cat last-file.txt)" >> $GITHUB_OUTPUT
- run: echo "hdf5 base name is ${{ steps.gethdf5base.outputs.HDF5_NAME_BASE }}."
- name: Print hdf5 base name
env:
HDF5_NAME_BASE: ${{ steps.gethdf5base.outputs.HDF5_NAME_BASE }}
run: echo "hdf5 base name is $HDF5_NAME_BASE."
- name: Read inputs
id: getinputs
env:
INPUTS_USE_IGNORE: ${{ inputs.use_ignore }}
run: |
echo "INPUTS_IGNORE=${{ inputs.use_ignore }}" >> $GITHUB_OUTPUT
echo "INPUTS_IGNORE=$INPUTS_USE_IGNORE" >> "$GITHUB_OUTPUT"
- run: echo "use_ignore is ${{ steps.getinputs.outputs.INPUTS_IGNORE }}."
- name: Print use_ignore
env:
INPUTS_IGNORE: ${{ steps.getinputs.outputs.INPUTS_IGNORE }}
run: echo "use_ignore is $INPUTS_IGNORE."
call-workflow-tarball:
needs: [get-old-names]
.github/workflows/daily-schedule.yml
+8 -2
View File
@@ -27,14 +27,17 @@ jobs:
steps:
- name: Get file base name
id: get-file-base
env:
DAILY_BUILD_FILE_BASE: ${{ needs.daily-build.outputs.file_base }}
run: |
FILE_NAME_BASE=$(echo "${{ needs.daily-build.outputs.file_base }}")
FILE_NAME_BASE="$DAILY_BUILD_FILE_BASE"
echo "FILE_BASE=$FILE_NAME_BASE" >> $GITHUB_OUTPUT
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- name: Get Sources
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false # Prevents tokens from being written to Git config files
fetch-depth: 0
ref: '${{ github.head_ref || github.ref_name }}'
@@ -53,6 +56,9 @@ jobs:
aws-region: ${{ secrets.AWS_REGION }}
- name: Sync userguide to latest S3 bucket
env:
FILE_BASE: ${{ steps.get-file-base.outputs.FILE_BASE }}
AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
run: |
aws s3 sync ./${{ steps.get-file-base.outputs.FILE_BASE }}.doxygen s3://${{ secrets.AWS_S3_BUCKET }}/documentation/hdf5/latest --delete
aws s3 sync ./"$FILE_BASE".doxygen s3://"$AWS_S3_BUCKET"/documentation/hdf5/latest --delete
.github/workflows/hdfeos5.yml
+6 -2
View File
@@ -35,11 +35,15 @@ jobs:
- name: Checkout HDF5
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false # Prevents tokens from being written to Git config files
- name: Configure
env:
RUNNER_WORKSPACE: ${{ runner.workspace }}
run: |
mkdir "${{ runner.workspace }}/build"
cd "${{ runner.workspace }}/build"
mkdir "$RUNNER_WORKSPACE/build"
cd "$RUNNER_WORKSPACE/build"
cmake -C $GITHUB_WORKSPACE/config/cmake/cacheinit.cmake \
-G Ninja \
-DCMAKE_BUILD_TYPE=Release \
.github/workflows/linkchecker.yml
+6 -2
View File
@@ -19,6 +19,8 @@ jobs:
steps:
- name: Checkout Repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false # Prevents tokens from being written to Git config files
- name: Install System Dependencies
run: |
@@ -82,13 +84,15 @@ jobs:
- name: Publish Report to Job Summary
if: always()
env:
LYCHEE_OUTCOME: ${{ steps.lychee.outcome }}
run: |
echo "## 🔗 Link Checker Report" >> "$GITHUB_STEP_SUMMARY"
# Check if lychee step succeeded or failed
if [ "${{ steps.lychee.outcome }}" = "success" ]; then
if [ "$LYCHEE_OUTCOME" = "success" ]; then
echo "✅ **No broken links found!**" >> "$GITHUB_STEP_SUMMARY"
elif [ "${{ steps.lychee.outcome }}" = "failure" ]; then
elif [ "$LYCHEE_OUTCOME" = "failure" ]; then
# Count actual broken links marked with the ❌ emoji.
# Default to 0 if grep finds nothing or fails.
FAILED_COUNT=$(grep -c "❌" lychee-report.md 2>/dev/null || echo 0)
.github/workflows/macos-26-matrix.yml
+9 -2
View File
@@ -5,6 +5,9 @@ on:
schedule:
- cron: "0 9 * * *"
permissions:
contents: read
# Using concurrency to cancel any in-progress job or run
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
@@ -190,11 +193,15 @@ jobs:
- name: Get Sources
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false # Prevents tokens from being written to Git config files
- name: Configure
env:
RUNNER_WORKSPACE: ${{ runner.workspace }}
run: |
mkdir "${{ runner.workspace }}/build"
cd "${{ runner.workspace }}/build"
mkdir "$RUNNER_WORKSPACE/build"
cd "$RUNNER_WORKSPACE/build"
# Base CMake options
CMAKE_OPTS="-G Ninja"
.github/workflows/netcdf.yml
+7 -2
View File
@@ -44,11 +44,15 @@ jobs:
- name: Checkout HDF5
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false # Prevents tokens from being written to Git config files
- name: Configure
env:
RUNNER_WORKSPACE: ${{ runner.workspace }}
run: |
mkdir "${{ runner.workspace }}/build"
cd "${{ runner.workspace }}/build"
mkdir "$RUNNER_WORKSPACE/build"
cd "$RUNNER_WORKSPACE/build"
cmake -C $GITHUB_WORKSPACE/config/cmake/cacheinit.cmake \
-G Ninja \
--log-level=VERBOSE \
@@ -80,6 +84,7 @@ jobs:
- name: Checkout netCDF
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false # Prevents tokens from being written to Git config files
repository: unidata/netcdf-c
path: netcdf-c