mirror of
https://github.com/astral-sh/ruff
synced 2026-01-21 13:30:49 -05:00
033ecf5a4b
## Summary This PR changes our zizmor configuration to also flag low-severity security issues in our GitHub Actions workflows. It's a followup to https://github.com/astral-sh/ruff/pull/14844. The issues being fixed here were all flagged by [zizmor's `template-injection` rule](https://woodruffw.github.io/zizmor/audits/#template-injection): > Detects potential sources of code injection via template expansion. > > GitHub Actions allows workflows to define template expansions, which occur within special `${{ ... }}` delimiters. These expansions happen before workflow and job execution, meaning the expansion of a given expression appears verbatim in whatever context it was performed in. > > Template expansions aren't syntax-aware, meaning that they can result in unintended shell injection vectors. This is especially true when they're used with attacker-controllable expression contexts, such as `github.event.issue.title` (which the attacker can fully control by supplying a new issue title). [...] > To fully remediate the vulnerability, you should not use `${{ env.VARNAME }}`, since that is still a template expansion. Instead, you should use `${VARNAME}` to ensure that the shell itself performs the variable expansion. ## Test Plan I tested that this passes all zizmore warnings by running `pre-commit run -a zizmor` locally. The other test is obviously to check that the workflows all still run correctly in CI 😄
106 lines
2.6 KiB
YAML
106 lines
2.6 KiB
YAML
fail_fast: false
|
|
|
|
exclude: |
|
|
(?x)^(
|
|
crates/red_knot_vendored/vendor/.*|
|
|
crates/red_knot_workspace/resources/.*|
|
|
crates/ruff_linter/resources/.*|
|
|
crates/ruff_linter/src/rules/.*/snapshots/.*|
|
|
crates/ruff_notebook/resources/.*|
|
|
crates/ruff_server/resources/.*|
|
|
crates/ruff/resources/.*|
|
|
crates/ruff_python_formatter/resources/.*|
|
|
crates/ruff_python_formatter/tests/snapshots/.*|
|
|
crates/ruff_python_resolver/resources/.*|
|
|
crates/ruff_python_resolver/tests/snapshots/.*
|
|
)$
|
|
|
|
repos:
|
|
- repo: https://github.com/abravalheri/validate-pyproject
|
|
rev: v0.23
|
|
hooks:
|
|
- id: validate-pyproject
|
|
|
|
- repo: https://github.com/executablebooks/mdformat
|
|
rev: 0.7.19
|
|
hooks:
|
|
- id: mdformat
|
|
additional_dependencies:
|
|
- mdformat-mkdocs
|
|
- mdformat-admon
|
|
- mdformat-footnote
|
|
exclude: |
|
|
(?x)^(
|
|
docs/formatter/black\.md
|
|
| docs/\w+\.md
|
|
)$
|
|
|
|
- repo: https://github.com/igorshubovych/markdownlint-cli
|
|
rev: v0.43.0
|
|
hooks:
|
|
- id: markdownlint-fix
|
|
exclude: |
|
|
(?x)^(
|
|
docs/formatter/black\.md
|
|
| docs/\w+\.md
|
|
)$
|
|
|
|
- repo: https://github.com/adamchainz/blacken-docs
|
|
rev: 1.19.1
|
|
hooks:
|
|
- id: blacken-docs
|
|
args: ["--pyi", "--line-length", "130"]
|
|
files: '^crates/.*/resources/mdtest/.*\.md'
|
|
exclude: |
|
|
(?x)^(
|
|
.*?invalid(_.+)*_syntax\.md
|
|
)$
|
|
additional_dependencies:
|
|
- black==24.10.0
|
|
|
|
- repo: https://github.com/crate-ci/typos
|
|
rev: v1.28.2
|
|
hooks:
|
|
- id: typos
|
|
|
|
- repo: local
|
|
hooks:
|
|
- id: cargo-fmt
|
|
name: cargo fmt
|
|
entry: cargo fmt --
|
|
language: system
|
|
types: [rust]
|
|
pass_filenames: false # This makes it a lot faster
|
|
|
|
- repo: https://github.com/astral-sh/ruff-pre-commit
|
|
rev: v0.8.2
|
|
hooks:
|
|
- id: ruff-format
|
|
- id: ruff
|
|
args: [--fix, --exit-non-zero-on-fix]
|
|
types_or: [python, pyi]
|
|
require_serial: true
|
|
|
|
# Prettier
|
|
- repo: https://github.com/rbubley/mirrors-prettier
|
|
rev: v3.4.2
|
|
hooks:
|
|
- id: prettier
|
|
types: [yaml]
|
|
|
|
- repo: https://github.com/woodruffw/zizmor-pre-commit
|
|
rev: v0.8.0
|
|
hooks:
|
|
- id: zizmor
|
|
# `release.yml` is autogenerated by `dist`; security issues need to be fixed there
|
|
# (https://opensource.axo.dev/cargo-dist/)
|
|
exclude: .github/workflows/release.yml
|
|
|
|
- repo: https://github.com/python-jsonschema/check-jsonschema
|
|
rev: 0.30.0
|
|
hooks:
|
|
- id: check-github-workflows
|
|
|
|
ci:
|
|
skip: [cargo-fmt, dev-generate-all]
|