Update GitHub workflows (#524)

aviator-co · Feb 18, 2025 · 3caa8e3 · 3caa8e3
1 parent a2a7f84
commit 3caa8e3
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 1 deletion.
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -10,11 +10,16 @@ on:
   pull_request:
     branches: ["**"]
 
+permissions:
+  contents: "read"
+
 jobs:
   go-unit-test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
@@ -30,6 +35,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
@@ -38,3 +45,22 @@ jobs:
         uses: golangci/golangci-lint-action@v6
         with:
           version: latest
+
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install pre-commit
+        run: pip install pre-commit
+      - name: "Cache pre-commit"
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+      - name: "Run pre-commit"
+        run: pre-commit run --show-diff-on-failure --all-files --color=always
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -14,14 +14,15 @@ jobs:
       - name: checkout
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: fetch tags
         run: git fetch --force --tags
       - name: install go
         uses: actions/setup-go@v5
         with:
+          cache: false
           go-version-file: go.mod
-          cache-dependency-path: go.sum
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -20,3 +20,15 @@ repos:
       - id: end-of-file-fixer
       - id: no-commit-to-branch
         args: ['--branch', 'master']
+
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.31.1
+    hooks:
+      - id: check-dependabot
+      - id: check-github-actions
+      - id: check-github-workflows
+
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.3.1
+    hooks:
+      - id: zizmor