From 375bfd7e3bcf7e9854dc023d8e82d58d38889829 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 14 Mar 2026 11:34:17 -0400 Subject: [PATCH 1/7] Revert "ci: temporarily pin to setup-ruby with windows ruby 4" This reverts commit d479c8118d509202bcd1f99a900011f45fb1d8a4. --- .github/workflows/ci.yml | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a86decee..256cfa5e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,7 +38,7 @@ jobs: BUNDLE_WITHOUT: "" # we need rubocop, obviously steps: - uses: actions/checkout@v6 - - uses: ruby/setup-ruby@d3e3bd032ad2222a8ac878bbccf2aba78864e134 + - uses: ruby/setup-ruby@v1 with: ruby-version: "3.4" bundler-cache: true @@ -51,7 +51,6 @@ jobs: - uses: actions/checkout@v6 - uses: ruby/setup-ruby-pkgs@v1 with: - setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134 ruby-version: "3.4" bundler-cache: true apt-get: libsqlite3-dev @@ -83,7 +82,6 @@ jobs: - uses: actions/checkout@v6 - uses: ruby/setup-ruby-pkgs@v1 with: - setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134 ruby-version: ${{ matrix.ruby }} bundler-cache: true apt-get: libsqlite3-dev @@ -152,7 +150,6 @@ jobs: - uses: actions/checkout@v6 - uses: ruby/setup-ruby-pkgs@v1 with: - setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134 ruby-version: ${{ matrix.ruby }} bundler-cache: true apt-get: libsqlcipher-dev @@ -169,7 +166,6 @@ jobs: - uses: actions/checkout@v6 - uses: ruby/setup-ruby-pkgs@v1 with: - setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134 ruby-version: "3.4" bundler-cache: true apt-get: valgrind @@ -195,7 +191,7 @@ jobs: with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} - - uses: ruby/setup-ruby@d3e3bd032ad2222a8ac878bbccf2aba78864e134 + - uses: ruby/setup-ruby@v1 with: ruby-version: "3.4" bundler-cache: true @@ -213,7 +209,7 @@ jobs: with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} - - uses: ruby/setup-ruby@d3e3bd032ad2222a8ac878bbccf2aba78864e134 + - uses: ruby/setup-ruby@v1 with: ruby-version: "3.4" bundler-cache: true @@ -241,7 +237,6 @@ jobs: - uses: actions/checkout@v6 - uses: ruby/setup-ruby-pkgs@v1 with: - setup-ruby-ref: ruby/setup-ruby/d3e3bd032ad2222a8ac878bbccf2aba78864e134 ruby-version: ${{ matrix.ruby }} apt-get: libsqlite3-dev pkg-config mingw: sqlite3 @@ -349,7 +344,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v6 - - uses: ruby/setup-ruby@d3e3bd032ad2222a8ac878bbccf2aba78864e134 + - uses: ruby/setup-ruby@v1 with: ruby-version: "${{ matrix.ruby }}" - uses: actions/download-artifact@v8 From 0b22d917e259fb5e15f3d688876248d7efe4cf0e Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 14 Mar 2026 11:34:44 -0400 Subject: [PATCH 2/7] ci: pin github actions --- .github/workflows/ci.yml | 70 ++++++++++++++++---------------- .github/workflows/downstream.yml | 6 +-- .github/workflows/rdoc.yml | 10 ++--- .github/workflows/upstream.yml | 10 ++--- 4 files changed, 48 insertions(+), 48 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 256cfa5e..0d5116d8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,8 +37,8 @@ jobs: env: BUNDLE_WITHOUT: "" # we need rubocop, obviously steps: - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "3.4" bundler-cache: true @@ -48,8 +48,8 @@ jobs: needs: rubocop runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby-pkgs@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: "3.4" bundler-cache: true @@ -79,8 +79,8 @@ jobs: run: | git config --system core.autocrlf false git config --system core.eol lf - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby-pkgs@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: ${{ matrix.ruby }} bundler-cache: true @@ -88,7 +88,7 @@ jobs: mingw: sqlite3 vcpkg: sqlite3 - if: matrix.syslib == 'disable' - uses: actions/cache@v5 + uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: ports key: ports-${{ matrix.os }}-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} @@ -107,7 +107,7 @@ jobs: - run: | dnf group install -y "C Development Tools and Libraries" dnf install -y ruby ruby-devel patch - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - run: bundle install - run: bundle exec rake compile -- --disable-system-libraries - run: bundle exec rake test @@ -117,8 +117,8 @@ jobs: name: "FreeBSD" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: vmactions/freebsd-vm@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: vmactions/freebsd-vm@4807432c7cab1c3f97688665332c0b932062d31f # v1.4.3 with: usesh: true copyback: false @@ -147,8 +147,8 @@ jobs: run: | git config --system core.autocrlf false git config --system core.eol lf - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby-pkgs@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: ${{ matrix.ruby }} bundler-cache: true @@ -163,13 +163,13 @@ jobs: needs: basic runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby-pkgs@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: "3.4" bundler-cache: true apt-get: valgrind - - uses: actions/cache@v5 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: ports key: ports-ubuntu-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} @@ -186,12 +186,12 @@ jobs: outputs: rcd_image_version: ${{ steps.rcd_image_version.outputs.rcd_image_version }} steps: - - uses: actions/checkout@v6 - - uses: actions/cache@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "3.4" bundler-cache: true @@ -204,17 +204,17 @@ jobs: name: "build source" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/cache@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "3.4" bundler-cache: true - run: ./bin/test-gem-build gems ruby - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: source-gem path: gems @@ -234,13 +234,13 @@ jobs: - { os: macos, syslib: enable, compile_flags: "--with-opt-dir=$(brew --prefix sqlite3)" } runs-on: ${{ matrix.os }}-latest steps: - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby-pkgs@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: ${{ matrix.ruby }} apt-get: libsqlite3-dev pkg-config mingw: sqlite3 - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: source-gem path: gems @@ -267,8 +267,8 @@ jobs: - x86_64-linux-musl runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/cache@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} @@ -276,7 +276,7 @@ jobs: docker run --rm -v $PWD:/work -w /work \ ghcr.io/rake-compiler/rake-compiler-dock-image:${{ needs.native_setup.outputs.rcd_image_version }}-mri-${{ matrix.platform }} \ ./bin/test-gem-build gems ${{ matrix.platform }} - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: "cruby-${{ matrix.platform }}-gem" path: gems @@ -313,8 +313,8 @@ jobs: - { runner: ubuntu-latest, platform: x86-linux-musl, docker_platform: "--platform=linux/386" } runs-on: ${{ matrix.runner || 'ubuntu-latest' }} steps: - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: cruby-${{ matrix.platform }}-gem path: gems @@ -343,11 +343,11 @@ jobs: platform: x64-mingw-ucrt runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "${{ matrix.ruby }}" - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: cruby-${{ matrix.platform }}-gem path: gems @@ -370,8 +370,8 @@ jobs: container: image: ruby:${{matrix.ruby}}-${{matrix.flavor}} steps: - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: cruby-x86_64-linux-musl-gem path: gems diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml index e43e1430..cc0b871d 100644 --- a/.github/workflows/downstream.yml +++ b/.github/workflows/downstream.yml @@ -21,14 +21,14 @@ jobs: activerecord: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby-pkgs@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: "3.4" bundler: latest bundler-cache: true apt-get: sqlite3 # active record test suite uses the sqlite3 cli - - uses: actions/cache@v5 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: ports key: ports-ubuntu-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} diff --git a/.github/workflows/rdoc.yml b/.github/workflows/rdoc.yml index a06a6d7c..3d1a979b 100644 --- a/.github/workflows/rdoc.yml +++ b/.github/workflows/rdoc.yml @@ -23,15 +23,15 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/configure-pages@v5 - - uses: ruby/setup-ruby@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 + - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "4.0" bundler-cache: true - run: bundle exec rdoc - - uses: actions/upload-pages-artifact@v4 + - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0 with: path: 'doc' - - uses: actions/deploy-pages@v4 + - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 id: deployment diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml index b17aa774..9b97de83 100644 --- a/.github/workflows/upstream.yml +++ b/.github/workflows/upstream.yml @@ -17,11 +17,11 @@ jobs: sqlite-head: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - run: | git clone --depth=1 https://github.com/sqlite/sqlite git -C sqlite log -n1 - - uses: ruby/setup-ruby-pkgs@v1 + - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: "3.3" bundler-cache: true @@ -40,14 +40,14 @@ jobs: runs-on: ${{matrix.os}} steps: - - uses: actions/checkout@v6 - - uses: ruby/setup-ruby-pkgs@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: ${{matrix.ruby}} bundler-cache: true apt-get: libsqlite3-dev - if: matrix.lib == 'packaged' - uses: actions/cache@v5 + uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: ports key: ports-${{matrix.os}}-${{hashFiles('ext/sqlite3/extconf.rb','dependencies.yml')}} From bc87d0684d306b0c3e8ad9c72ab4d046470aeb8b Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 14 Mar 2026 11:41:55 -0400 Subject: [PATCH 3/7] ci: bump jobs to use ruby 4.0 --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/downstream.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0d5116d8..a28b82b4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,7 +40,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: - ruby-version: "3.4" + ruby-version: "4.0" bundler-cache: true - run: bundle exec rake rubocop @@ -51,7 +51,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: - ruby-version: "3.4" + ruby-version: "4.0" bundler-cache: true apt-get: libsqlite3-dev - run: bundle exec rake compile -- --enable-system-libraries @@ -166,7 +166,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: - ruby-version: "3.4" + ruby-version: "4.0" bundler-cache: true apt-get: valgrind - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 @@ -193,7 +193,7 @@ jobs: key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: - ruby-version: "3.4" + ruby-version: "4.0" bundler-cache: true - run: bundle exec ruby ./ext/sqlite3/extconf.rb --download-dependencies - id: rcd_image_version @@ -211,7 +211,7 @@ jobs: key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: - ruby-version: "3.4" + ruby-version: "4.0" bundler-cache: true - run: ./bin/test-gem-build gems ruby - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml index cc0b871d..ca4a9b5c 100644 --- a/.github/workflows/downstream.yml +++ b/.github/workflows/downstream.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: - ruby-version: "3.4" + ruby-version: "4.0" bundler: latest bundler-cache: true apt-get: sqlite3 # active record test suite uses the sqlite3 cli From 4e978068a280876887986a3d6051da43c8bec41d Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 14 Mar 2026 11:42:23 -0400 Subject: [PATCH 4/7] ci: zizmor-ignore bundler cache on non-publishing jobs --- .github/workflows/ci.yml | 6 +++--- .github/workflows/rdoc.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a28b82b4..1d44f988 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,7 +41,7 @@ jobs: - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "4.0" - bundler-cache: true + bundler-cache: true # zizmor: ignore[cache-poisoning] - run: bundle exec rake rubocop basic: @@ -194,7 +194,7 @@ jobs: - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "4.0" - bundler-cache: true + bundler-cache: true # zizmor: ignore[cache-poisoning] - run: bundle exec ruby ./ext/sqlite3/extconf.rb --download-dependencies - id: rcd_image_version run: bundle exec ruby -e 'require "rake_compiler_dock"; puts "rcd_image_version=#{RakeCompilerDock::IMAGE_VERSION}"' >> $GITHUB_OUTPUT @@ -212,7 +212,7 @@ jobs: - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "4.0" - bundler-cache: true + bundler-cache: true # zizmor: ignore[cache-poisoning] - run: ./bin/test-gem-build gems ruby - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: diff --git a/.github/workflows/rdoc.yml b/.github/workflows/rdoc.yml index 3d1a979b..f9db3b1b 100644 --- a/.github/workflows/rdoc.yml +++ b/.github/workflows/rdoc.yml @@ -28,7 +28,7 @@ jobs: - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "4.0" - bundler-cache: true + bundler-cache: true # zizmor: ignore[cache-poisoning] - run: bundle exec rdoc - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0 with: From dbb4b131e0bdb99e6c2d8cab0ea5213ce3c8bfdf Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 14 Mar 2026 12:03:08 -0400 Subject: [PATCH 5/7] ci: ignore cache-poisoning false positives --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/downstream.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1d44f988..d348bea2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -88,7 +88,7 @@ jobs: mingw: sqlite3 vcpkg: sqlite3 - if: matrix.syslib == 'disable' - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports key: ports-${{ matrix.os }}-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} @@ -169,7 +169,7 @@ jobs: ruby-version: "4.0" bundler-cache: true apt-get: valgrind - - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports key: ports-ubuntu-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} @@ -187,7 +187,7 @@ jobs: rcd_image_version: ${{ steps.rcd_image_version.outputs.rcd_image_version }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} @@ -205,7 +205,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} @@ -268,7 +268,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml index ca4a9b5c..9b544828 100644 --- a/.github/workflows/downstream.yml +++ b/.github/workflows/downstream.yml @@ -28,7 +28,7 @@ jobs: bundler: latest bundler-cache: true apt-get: sqlite3 # active record test suite uses the sqlite3 cli - - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports key: ports-ubuntu-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} From 96e45c50cc44238098a446f6e5b074e498b9fdb8 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 14 Mar 2026 12:03:23 -0400 Subject: [PATCH 6/7] ci: set contents permissions to read --- .github/workflows/ci.yml | 3 +++ .github/workflows/downstream.yml | 3 +++ .github/workflows/upstream.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d348bea2..e8b99b5f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,9 @@ on: branches: - '*' +permissions: + contents: read + env: BUNDLE_WITHOUT: "development" diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml index 9b544828..7dbeec82 100644 --- a/.github/workflows/downstream.yml +++ b/.github/workflows/downstream.yml @@ -17,6 +17,9 @@ on: branches: - '*' +permissions: + contents: read + jobs: activerecord: runs-on: ubuntu-latest diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml index 9b97de83..426339bc 100644 --- a/.github/workflows/upstream.yml +++ b/.github/workflows/upstream.yml @@ -13,6 +13,9 @@ on: paths: - .github/workflows/upstream.yml # this file +permissions: + contents: read + jobs: sqlite-head: runs-on: ubuntu-latest From 9ebda352723ac2db6929cabe66f1e148948a704d Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 14 Mar 2026 12:06:38 -0400 Subject: [PATCH 7/7] ci: address zizmor artipacked and template-injection --- .github/workflows/ci.yml | 38 +++++++++++++++++++++++++++++--- .github/workflows/downstream.yml | 2 ++ .github/workflows/rdoc.yml | 2 ++ .github/workflows/upstream.yml | 4 ++++ 4 files changed, 43 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e8b99b5f..4b27b496 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,6 +41,8 @@ jobs: BUNDLE_WITHOUT: "" # we need rubocop, obviously steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "4.0" @@ -52,6 +54,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: "4.0" @@ -83,6 +87,8 @@ jobs: git config --system core.autocrlf false git config --system core.eol lf - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: ${{ matrix.ruby }} @@ -111,6 +117,8 @@ jobs: dnf group install -y "C Development Tools and Libraries" dnf install -y ruby ruby-devel patch - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - run: bundle install - run: bundle exec rake compile -- --disable-system-libraries - run: bundle exec rake test @@ -121,6 +129,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: vmactions/freebsd-vm@4807432c7cab1c3f97688665332c0b932062d31f # v1.4.3 with: usesh: true @@ -151,6 +161,8 @@ jobs: git config --system core.autocrlf false git config --system core.eol lf - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: ${{ matrix.ruby }} @@ -167,6 +179,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: "4.0" @@ -190,6 +204,8 @@ jobs: rcd_image_version: ${{ steps.rcd_image_version.outputs.rcd_image_version }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports/archives @@ -208,6 +224,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports/archives @@ -238,6 +256,8 @@ jobs: runs-on: ${{ matrix.os }}-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: ${{ matrix.ruby }} @@ -271,14 +291,18 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] with: path: ports/archives key: ports-archives-tarball-${{ hashFiles('ext/sqlite3/extconf.rb','dependencies.yml') }} - run: | docker run --rm -v $PWD:/work -w /work \ - ghcr.io/rake-compiler/rake-compiler-dock-image:${{ needs.native_setup.outputs.rcd_image_version }}-mri-${{ matrix.platform }} \ + ghcr.io/rake-compiler/rake-compiler-dock-image:${NEEDS_NATIVE_SETUP_OUTPUTS_RCD_IMAGE_VERSION}-mri-${{ matrix.platform }} \ ./bin/test-gem-build gems ${{ matrix.platform }} + env: + NEEDS_NATIVE_SETUP_OUTPUTS_RCD_IMAGE_VERSION: ${{ needs.native_setup.outputs.rcd_image_version }} - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: "cruby-${{ matrix.platform }}-gem" @@ -317,17 +341,21 @@ jobs: runs-on: ${{ matrix.runner || 'ubuntu-latest' }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: cruby-${{ matrix.platform }}-gem path: gems - run: | docker run --rm -v $PWD:/work -w /work \ - ${{ matrix.docker_platform}} ruby:${{ matrix.ruby }}${{ matrix.docker_tag }} \ + ${{ matrix.docker_platform }} ruby:${MATRIX_RUBY}${{ matrix.docker_tag }} \ sh -c " ${{ matrix.bootstrap }} ./bin/test-gem-install ./gems " + env: + MATRIX_RUBY: ${{ matrix.ruby }} test_the_rest: name: "${{ matrix.platform }} ${{ matrix.ruby }}" @@ -347,6 +375,8 @@ jobs: runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: ruby-version: "${{ matrix.ruby }}" @@ -371,9 +401,11 @@ jobs: - { ruby: "4.0", flavor: "alpine" } runs-on: ubuntu-latest container: - image: ruby:${{matrix.ruby}}-${{matrix.flavor}} + image: ruby:${{ matrix.ruby }}-${{ matrix.flavor }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: cruby-x86_64-linux-musl-gem diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml index 7dbeec82..902fb26f 100644 --- a/.github/workflows/downstream.yml +++ b/.github/workflows/downstream.yml @@ -25,6 +25,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: "4.0" diff --git a/.github/workflows/rdoc.yml b/.github/workflows/rdoc.yml index f9db3b1b..b508f764 100644 --- a/.github/workflows/rdoc.yml +++ b/.github/workflows/rdoc.yml @@ -24,6 +24,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 with: diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml index 426339bc..69eb0892 100644 --- a/.github/workflows/upstream.yml +++ b/.github/workflows/upstream.yml @@ -21,6 +21,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - run: | git clone --depth=1 https://github.com/sqlite/sqlite git -C sqlite log -n1 @@ -44,6 +46,8 @@ jobs: runs-on: ${{matrix.os}} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5 with: ruby-version: ${{matrix.ruby}}