Secure GitHub actions (#3279)
Add persist-credentials: false to every workflow file.
See https://docs.zizmor.sh/audits/#template-injection
Avoid potential sources of code injection via template expansion in
ci-unix-static-av2.yml.
See https://docs.zizmor.sh/audits/#template-injection
Simplify disabling mechanism in ci-unix-static-av2.yml.
See https://docs.zizmor.sh/audits/#obfuscation
diff --git a/.github/workflows/ci-android-emulator-tests.yml b/.github/workflows/ci-android-emulator-tests.yml
index 5c79425..c90da91 100644
--- a/.github/workflows/ci-android-emulator-tests.yml
+++ b/.github/workflows/ci-android-emulator-tests.yml
@@ -30,6 +30,8 @@
steps:
- name: Checkout the repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
# This is needed for faster emulators. See:
# https://github.com/ReactiveCircus/android-emulator-runner?tab=readme-ov-file#running-hardware-accelerated-emulators-on-linux-runners
- name: Enable KVM group perms
diff --git a/.github/workflows/ci-android-jni.yml b/.github/workflows/ci-android-jni.yml
index cbf0d7a..ee23f6b 100644
--- a/.github/workflows/ci-android-jni.yml
+++ b/.github/workflows/ci-android-jni.yml
@@ -18,6 +18,8 @@
steps:
- name: Checkout the repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- name: Download and Setup the Android NDK
uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1.6.0
id: setup-ndk
diff --git a/.github/workflows/ci-c-warnings.yml b/.github/workflows/ci-c-warnings.yml
index 0c1c9b3..a5a64b7 100644
--- a/.github/workflows/ci-c-warnings.yml
+++ b/.github/workflows/ci-c-warnings.yml
@@ -25,6 +25,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
if: runner.os == 'Linux'
with:
diff --git a/.github/workflows/ci-disable-gtest.yml b/.github/workflows/ci-disable-gtest.yml
index ab1a636..70a8180 100644
--- a/.github/workflows/ci-disable-gtest.yml
+++ b/.github/workflows/ci-disable-gtest.yml
@@ -37,6 +37,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
with:
codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-format-check.yml b/.github/workflows/ci-format-check.yml
index 2a0c774..3d442c1 100644
--- a/.github/workflows/ci-format-check.yml
+++ b/.github/workflows/ci-format-check.yml
@@ -14,6 +14,8 @@
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: RafikFarhad/clang-format-github-action@40f11200e893c5e48dee28fbfe3da60d6862418d # v6
with:
style: file
@@ -24,6 +26,8 @@
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: neg-c/cmake-format-action@ba83660ac46d64c12ca96f39478dcde7680a52bf # v0.1.3
with:
exclude: libavif.pc.cmake
diff --git a/.github/workflows/ci-fuzztest.yml b/.github/workflows/ci-fuzztest.yml
index ffc1570..ecd8e37 100644
--- a/.github/workflows/ci-fuzztest.yml
+++ b/.github/workflows/ci-fuzztest.yml
@@ -28,6 +28,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
id: setup
with:
diff --git a/.github/workflows/ci-linux-artifacts.yml b/.github/workflows/ci-linux-artifacts.yml
index d9037b9..b52cd3f 100644
--- a/.github/workflows/ci-linux-artifacts.yml
+++ b/.github/workflows/ci-linux-artifacts.yml
@@ -18,6 +18,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
with:
codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-linux-coverage.yml b/.github/workflows/ci-linux-coverage.yml
index 2b55e43..750cd4e 100644
--- a/.github/workflows/ci-linux-coverage.yml
+++ b/.github/workflows/ci-linux-coverage.yml
@@ -21,6 +21,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
id: setup
with:
diff --git a/.github/workflows/ci-linux-golden-tests.yml b/.github/workflows/ci-linux-golden-tests.yml
index 9328d0a..cef80db 100644
--- a/.github/workflows/ci-linux-golden-tests.yml
+++ b/.github/workflows/ci-linux-golden-tests.yml
@@ -27,6 +27,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
id: setup
with:
diff --git a/.github/workflows/ci-linux-oldest-cmake.yml b/.github/workflows/ci-linux-oldest-cmake.yml
index b54d0ca..70511ee 100644
--- a/.github/workflows/ci-linux-oldest-cmake.yml
+++ b/.github/workflows/ci-linux-oldest-cmake.yml
@@ -21,6 +21,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
with:
codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-macos-artifacts.yml b/.github/workflows/ci-macos-artifacts.yml
index ca74eb1..91cf05c 100644
--- a/.github/workflows/ci-macos-artifacts.yml
+++ b/.github/workflows/ci-macos-artifacts.yml
@@ -18,6 +18,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-macos
with:
codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-mingw.yml b/.github/workflows/ci-mingw.yml
index 603ec47..b2093a5 100644
--- a/.github/workflows/ci-mingw.yml
+++ b/.github/workflows/ci-mingw.yml
@@ -27,6 +27,8 @@
shell: msys2 {0}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
with:
msystem: ${{ matrix.sys }}
diff --git a/.github/workflows/ci-unix-shared-installed.yml b/.github/workflows/ci-unix-shared-installed.yml
index d5e04d0..53a07c6 100644
--- a/.github/workflows/ci-unix-shared-installed.yml
+++ b/.github/workflows/ci-unix-shared-installed.yml
@@ -35,6 +35,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
if: runner.os == 'Linux'
with:
diff --git a/.github/workflows/ci-unix-shared-local.yml b/.github/workflows/ci-unix-shared-local.yml
index 7361440..9227cb5 100644
--- a/.github/workflows/ci-unix-shared-local.yml
+++ b/.github/workflows/ci-unix-shared-local.yml
@@ -30,6 +30,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
if: runner.os == 'Linux'
with:
diff --git a/.github/workflows/ci-unix-static-av2.yml b/.github/workflows/ci-unix-static-av2.yml
index bdd2921..2681569 100644
--- a/.github/workflows/ci-unix-static-av2.yml
+++ b/.github/workflows/ci-unix-static-av2.yml
@@ -31,6 +31,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
with:
codec-aom: "LOCAL"
@@ -71,9 +73,9 @@
shell: bash
- name: Check static link bundling
# Disabled until libavm properly depends on tensorflow-lite.
- if: ${{ false }}
+ if: false
run: |
- ${{ env.CC }} -o avifenc -I./apps/shared -I./third_party/iccjpeg -I./include apps/avifenc.c \
+ ${CC} -o avifenc -I./apps/shared -I./third_party/iccjpeg -I./include apps/avifenc.c \
apps/shared/*.c third_party/iccjpeg/iccjpeg.c build/libavif.a \
-lpng -ljpeg -lz -lm -ldl -lstdc++
diff --git a/.github/workflows/ci-unix-static-sanitized-memory.yml b/.github/workflows/ci-unix-static-sanitized-memory.yml
index 7433bbd..1281346 100644
--- a/.github/workflows/ci-unix-static-sanitized-memory.yml
+++ b/.github/workflows/ci-unix-static-sanitized-memory.yml
@@ -20,6 +20,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
if: runner.os == 'Linux'
id: setup_linux
diff --git a/.github/workflows/ci-unix-static-sanitized.yml b/.github/workflows/ci-unix-static-sanitized.yml
index f38ec95..c608855 100644
--- a/.github/workflows/ci-unix-static-sanitized.yml
+++ b/.github/workflows/ci-unix-static-sanitized.yml
@@ -28,6 +28,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
if: runner.os == 'Linux'
id: setup_linux
diff --git a/.github/workflows/ci-unix-static.yml b/.github/workflows/ci-unix-static.yml
index 0722b92..d3fb415 100644
--- a/.github/workflows/ci-unix-static.yml
+++ b/.github/workflows/ci-unix-static.yml
@@ -32,6 +32,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-linux
if: runner.os == 'Linux'
with:
diff --git a/.github/workflows/ci-windows-artifacts.yml b/.github/workflows/ci-windows-artifacts.yml
index b99f6ff..15b98e8 100644
--- a/.github/workflows/ci-windows-artifacts.yml
+++ b/.github/workflows/ci-windows-artifacts.yml
@@ -18,6 +18,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-windows
id: setup
with:
diff --git a/.github/workflows/ci-windows-installed.yml b/.github/workflows/ci-windows-installed.yml
index d4ecb95..ee4a2b8 100644
--- a/.github/workflows/ci-windows-installed.yml
+++ b/.github/workflows/ci-windows-installed.yml
@@ -26,6 +26,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-windows
id: setup
with:
diff --git a/.github/workflows/ci-windows-shared-local.yml b/.github/workflows/ci-windows-shared-local.yml
index a6f15b7..4b9a66e 100644
--- a/.github/workflows/ci-windows-shared-local.yml
+++ b/.github/workflows/ci-windows-shared-local.yml
@@ -29,6 +29,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-windows
with:
codec-aom: "LOCAL"
diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
index 1647a10..337b7d9 100644
--- a/.github/workflows/ci-windows.yml
+++ b/.github/workflows/ci-windows.yml
@@ -37,6 +37,8 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
- uses: ./.github/actions/setup-windows
id: setup
with:
