Skip to content

Commit 313207f

Browse files
pixlwavepixlwave
committed
Merge branch 'release/1.11.36/master'
2 parents ef2d927 + 74b2dd9 commit 313207f

16 files changed

Lines changed: 162 additions & 236 deletions

‎.github/workflows/ci-build.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
# Allows you to run this workflow manually from the Actions tab
99
workflow_dispatch:
1010

11+
permissions: {}
12+
1113
env:
1214
# Make the git branch for a PR available to our Fastfile
1315
MX_GIT_BRANCH: ${{ github.event.pull_request.head.ref }}
@@ -20,19 +22,20 @@ jobs:
2022
# Concurrency group not needed as this workflow only runs on develop which we always want to test.
2123

2224
steps:
23-
- uses: actions/checkout@v4
25+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2426
with:
2527
submodules: 'true'
28+
persist-credentials: false
2629

2730
# Common cache
2831
# Note: GH actions do not support yaml anchor yet. We need to duplicate this for every job
29-
- uses: actions/cache@v4
32+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
3033
with:
3134
path: Pods
3235
key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
3336
restore-keys: |
3437
${{ runner.os }}-pods-
35-
- uses: actions/cache@v4
38+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
3639
with:
3740
path: vendor/bundle
3841
key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

‎.github/workflows/ci-tests.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ on:
99
# Allows you to run this workflow manually from the Actions tab
1010
workflow_dispatch:
1111

12+
permissions: {}
13+
1214
env:
1315
# Make the git branch for a PR available to our Fastfile
1416
MX_GIT_BRANCH: ${{ github.event.pull_request.head.ref }}
@@ -25,19 +27,20 @@ jobs:
2527
cancel-in-progress: true
2628

2729
steps:
28-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2931
with:
3032
submodules: 'true'
33+
persist-credentials: false
3134

3235
# Common cache
3336
# Note: GH actions do not support yaml anchor yet. We need to duplicate this for every job
34-
- uses: actions/cache@v4
37+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
3538
with:
3639
path: Pods
3740
key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
3841
restore-keys: |
3942
${{ runner.os }}-pods-
40-
- uses: actions/cache@v4
43+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
4144
with:
4245
path: vendor/bundle
4346
key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
@@ -65,7 +68,7 @@ jobs:
6568
run: bundle exec fastlane test
6669

6770
- name: Upload coverage to Codecov
68-
uses: codecov/codecov-action@v4
71+
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
6972
with:
7073
token: ${{ secrets.CODECOV_TOKEN }}
7174
flags: unittests

‎.github/workflows/ci-ui-tests.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55

66
workflow_dispatch:
77

8+
permissions: {}
9+
810
env:
911
# Make the git branch for a PR available to our Fastfile
1012
MX_GIT_BRANCH: ${{ github.event.pull_request.head.ref }}
@@ -20,19 +22,20 @@ jobs:
2022
cancel-in-progress: true
2123

2224
steps:
23-
- uses: actions/checkout@v4
25+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2426
with:
2527
submodules: 'true'
28+
persist-credentials: false
2629

2730
# Common cache
2831
# Note: GH actions do not support yaml anchor yet. We need to duplicate this for every job
29-
- uses: actions/cache@v4
32+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
3033
with:
3134
path: Pods
3235
key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
3336
restore-keys: |
3437
${{ runner.os }}-pods-
35-
- uses: actions/cache@v4
38+
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
3639
with:
3740
path: vendor/bundle
3841
key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
@@ -60,7 +63,7 @@ jobs:
6063
run: bundle exec fastlane uitest
6164

6265
- name: Upload coverage to Codecov
63-
uses: codecov/codecov-action@v4
66+
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
6467
with:
6568
token: ${{ secrets.CODECOV_TOKEN }}
6669
flags: uitests

‎.github/workflows/release-alpha.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Build alpha release
22

33
on:
4-
54
# Triggers the workflow on any pull request
65
pull_request:
76
types: [ labeled, synchronize, opened, reopened ]
87

8+
permissions: {}
9+
910
env:
1011
# Make the git branch for a PR available to our Fastfile
1112
MX_GIT_BRANCH: ${{ github.event.pull_request.head.ref }}
@@ -25,22 +26,23 @@ jobs:
2526
cancel-in-progress: true
2627

2728
steps:
28-
- uses: actions/checkout@v4
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2930
with:
3031
submodules: 'true'
32+
persist-credentials: false
3133

3234
# Common cache
3335
# Note: GH actions do not support yaml anchor yet. We need to duplicate this for every job
3436
- name: Cache CocoaPods libraries
35-
uses: actions/cache@v4
37+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
3638
with:
3739
path: Pods
3840
key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
3941
restore-keys: |
4042
${{ runner.os }}-pods-
4143
4244
- name: Cache Ruby gems
43-
uses: actions/cache@v4
45+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
4446
with:
4547
path: vendor/bundle
4648
key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
@@ -62,7 +64,7 @@ jobs:
6264
6365
# Import alpha release private signing certificate
6466
- name: Import signing certificate
65-
uses: apple-actions/import-codesign-certs@v1
67+
uses: apple-actions/import-codesign-certs@b610f78488812c1e56b20e6df63ec42d833f2d14 # v6.0.0
6668
with:
6769
p12-file-base64: ${{ secrets.ALPHA_CERTIFICATES_P12 }}
6870
p12-password: ${{ secrets.ALPHA_CERTIFICATES_P12_PASSWORD }}
@@ -80,7 +82,7 @@ jobs:
8082
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
8183

8284
- name: Add or update PR comment with Ad-hoc release informations
83-
uses: NejcZdovc/comment-pr@v1
85+
uses: NejcZdovc/comment-pr@a423635d183a8259308e80593c96fecf31539c26 # v2.1.0
8486
with:
8587
message: |
8688
:iphone: Scan the QR code below to install the build for this PR.

‎.github/workflows/triage-move-labelled.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ on:
44
issues:
55
types: [labeled]
66

7+
permissions: {} # We use ELEMENT_BOT_TOKEN instead
8+
79
jobs:
810
apply_Z-Labs_label:
911
name: Add Z-Labs label for features behind labs flags
@@ -20,7 +22,7 @@ jobs:
2022
contains(github.event.issue.labels.*.name, 'A-Tags') ||
2123
contains(github.event.issue.labels.*.name, 'A-Rich-Text-Editor')
2224
steps:
23-
- uses: actions/github-script@v5
25+
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
2426
with:
2527
script: |
2628
github.rest.issues.addLabels({
@@ -42,7 +44,7 @@ jobs:
4244
contains(github.event.issue.labels.*.name, 'O-Frequent')) ||
4345
contains(github.event.issue.labels.*.name, 'A11y'))
4446
steps:
45-
- uses: actions/add-to-project@main
47+
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
4648
with:
4749
project-url: https://github.com/orgs/element-hq/projects/18
4850
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
@@ -53,7 +55,7 @@ jobs:
5355
if: >
5456
contains(github.event.issue.labels.*.name, 'X-Needs-Product')
5557
steps:
56-
- uses: actions/add-to-project@main
58+
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
5759
with:
5860
project-url: https://github.com/orgs/element-hq/projects/28
5961
github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

‎.github/workflows/triage-priority-bugs.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ on:
44
issues:
55
types: [labeled, unlabeled]
66

7+
permissions: {} # We use ELEMENT_BOT_TOKEN instead
8+
79
jobs:
810
p1_issues_to_team_workboard:
911
runs-on: ubuntu-latest

‎.github/workflows/triage-review-requests.yml‎

Lines changed: 0 additions & 139 deletions
This file was deleted.

‎.github/workflows/zizmor.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: GitHub Actions Security Analysis with zizmor 🌈
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions: {}
10+
11+
jobs:
12+
zizmor:
13+
name: Run zizmor 🌈
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20+
with:
21+
persist-credentials: false
22+
23+
- name: Run zizmor 🌈
24+
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0

0 commit comments

Comments
 (0)