Fix zizmor findings

aws-greengrass · Jan 9, 2025 · 9c1b688 · 9c1b688
1 parent b9c1f6f
commit 9c1b688
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 2 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -42,6 +42,7 @@ jobs:
     steps:
       - uses: actions/[email protected]
         with:
+          persist-credentials: false
           fetch-depth: 0
           filter: "tree:0"
       - uses: DeterminateSystems/nix-installer-action@main
@@ -61,6 +62,7 @@ jobs:
     steps:
       - uses: actions/[email protected]
         with:
+          persist-credentials: false
           fetch-depth: 0
           filter: "tree:0"
       - uses: DeterminateSystems/nix-installer-action@main
@@ -95,6 +97,7 @@ jobs:
     steps:
       - uses: actions/[email protected]
         with:
+          persist-credentials: false
           fetch-depth: 0
           filter: "tree:0"
       - uses: DeterminateSystems/nix-installer-action@main

diff --git a/.github/workflows/packaging.yml b/.github/workflows/packaging.yml
@@ -15,6 +15,8 @@ jobs:
         build_type: [RelWithDebInfo, MinSizeRel]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -76,7 +78,7 @@ jobs:
         run: |
           cat ${{ github.workspace }}/.github/workflows/packaging/readme.template.txt >> ${{ github.workspace }}/zipfile/readme.txt
           cp ${{ github.workspace }}/.github/workflows/packaging/install-greengrass-lite.sh ${{ github.workspace }}/zipfile/
-          sed -i 's|{{ VERSION_LINK }}|${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}|g' ${{ github.workspace }}/zipfile/readme.txt
+          sed -i 's|{{ VERSION_LINK }}|${ GITHUB_SERVER_URL }/${{ github.repository }}/commit/${{ github.sha }}|g' ${{ github.workspace }}/zipfile/readme.txt
           sed -i 's|{{ UBUNTU_VERSION }}|24.04|g' ${{ github.workspace }}/zipfile/install-greengrass-lite.sh
           cat ${{ github.workspace }}/LICENSE >> ${{ github.workspace }}/zipfile/readme.txt
 
@@ -99,6 +101,7 @@ jobs:
         if: matrix.build_type  == 'MinSizeRel' && matrix.architecture == ''
         uses: actions/upload-artifact@v4
         with:
+          persist-credentials: false
           name: aws-greengrass-lite-ubuntu-${{ matrix.architecture || 'x86-64'}}
           path: |
             ${{ github.workspace }}/zipfile/*

diff --git a/.github/workflows/static-packaging.yml b/.github/workflows/static-packaging.yml
@@ -16,6 +16,8 @@ jobs:
         build_type: [RelWithDebInfo, MinSizeRel]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -63,7 +65,7 @@ jobs:
         run: |
           cat ${{ github.workspace }}/.github/workflows/static-packaging/readme.template.txt >> ${{ github.workspace }}/zipfile/readme.txt
           cp ${{ github.workspace }}/.github/workflows/packaging/install-greengrass-lite.sh ${{ github.workspace }}/zipfile/
-          sed -i 's|{{ VERSION_LINK }}|${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}|g' ${{ github.workspace }}/zipfile/readme.txt
+          sed -i 's|{{ VERSION_LINK }}|${ GITHUB_SERVER_URL }/${{ github.repository }}/commit/${{ github.sha }}|g' ${{ github.workspace }}/zipfile/readme.txt
           sed -i 's|{{ UBUNTU_VERSION }}|22.04|g' ${{ github.workspace }}/zipfile/install-greengrass-lite.sh
           cat ${{ github.workspace }}/LICENSE >> ${{ github.workspace }}/zipfile/readme.txt
       - name: md5sums