From 012adf4e2cb6374730d30e45ac1fdc1895e3c3ba Mon Sep 17 00:00:00 2001 From: 3405691582 Date: Tue, 11 Aug 2026 13:39:00 +0000 Subject: [PATCH 1/2] Fix workflow typos and unify file extensions --- .github/workflows/cloud-init-image-for-cuttlefish.yaml | 2 +- .../workflows/{gemini-dispatch.yml => gemini-dispatch.yaml} | 6 +++--- .github/workflows/{gemini-invoke.yml => gemini-invoke.yaml} | 0 .../{gemini-plan-execute.yml => gemini-plan-execute.yaml} | 0 .github/workflows/{gemini-review.yml => gemini-review.yaml} | 0 .github/workflows/gigabyte-ampere-cloud-installer.yaml | 2 +- .github/workflows/gigabyte-ampere-cuttlefish-installer.yaml | 2 +- 7 files changed, 6 insertions(+), 6 deletions(-) rename .github/workflows/{gemini-dispatch.yml => gemini-dispatch.yaml} (97%) rename .github/workflows/{gemini-invoke.yml => gemini-invoke.yaml} (100%) rename .github/workflows/{gemini-plan-execute.yml => gemini-plan-execute.yaml} (100%) rename .github/workflows/{gemini-review.yml => gemini-review.yaml} (100%) diff --git a/.github/workflows/cloud-init-image-for-cuttlefish.yaml b/.github/workflows/cloud-init-image-for-cuttlefish.yaml index ea1a0b71ad4..7324c712975 100644 --- a/.github/workflows/cloud-init-image-for-cuttlefish.yaml +++ b/.github/workflows/cloud-init-image-for-cuttlefish.yaml @@ -5,7 +5,7 @@ on: paths: - 'cloud-init-image-for-cuttlefish/**' push: - branchs: + branches: - '**' permissions: diff --git a/.github/workflows/gemini-dispatch.yml b/.github/workflows/gemini-dispatch.yaml similarity index 97% rename from .github/workflows/gemini-dispatch.yml rename to .github/workflows/gemini-dispatch.yaml index 5f10a5d25c7..5ea827a1778 100644 --- a/.github/workflows/gemini-dispatch.yml +++ b/.github/workflows/gemini-dispatch.yaml @@ -111,7 +111,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'review' }} - uses: './.github/workflows/gemini-review.yml' + uses: './.github/workflows/gemini-review.yaml' permissions: contents: 'read' id-token: 'write' @@ -124,7 +124,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'invoke' }} - uses: './.github/workflows/gemini-invoke.yml' + uses: './.github/workflows/gemini-invoke.yaml' permissions: contents: 'read' id-token: 'write' @@ -137,7 +137,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'approve' }} - uses: './.github/workflows/gemini-plan-execute.yml' + uses: './.github/workflows/gemini-plan-execute.yaml' permissions: contents: 'write' id-token: 'write' diff --git a/.github/workflows/gemini-invoke.yml b/.github/workflows/gemini-invoke.yaml similarity index 100% rename from .github/workflows/gemini-invoke.yml rename to .github/workflows/gemini-invoke.yaml diff --git a/.github/workflows/gemini-plan-execute.yml b/.github/workflows/gemini-plan-execute.yaml similarity index 100% rename from .github/workflows/gemini-plan-execute.yml rename to .github/workflows/gemini-plan-execute.yaml diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yaml similarity index 100% rename from .github/workflows/gemini-review.yml rename to .github/workflows/gemini-review.yaml diff --git a/.github/workflows/gigabyte-ampere-cloud-installer.yaml b/.github/workflows/gigabyte-ampere-cloud-installer.yaml index 713488a2403..bcfaa12bb8f 100644 --- a/.github/workflows/gigabyte-ampere-cloud-installer.yaml +++ b/.github/workflows/gigabyte-ampere-cloud-installer.yaml @@ -5,7 +5,7 @@ on: paths: - 'gigabyte-ampere-cloud-installer/**' push: - branchs: + branches: - '**' jobs: diff --git a/.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml b/.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml index 32ef8127919..ca4c4c3b53e 100644 --- a/.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml +++ b/.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml @@ -6,7 +6,7 @@ on: - '.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml' - 'gigabyte-ampere-cuttlefish-installer/**' push: - branchs: + branches: - '**' permissions: From cc65dd93c91a4765f37e6065972b214d5c081b15 Mon Sep 17 00:00:00 2001 From: 3405691582 Date: Tue, 11 Aug 2026 15:25:49 +0000 Subject: [PATCH 2/2] # This is a combination of 2 commits. Pin action references to full commit SHAs Pin third-party GitHub actions to full commit SHAs across workflow files to comply with zizmor blanket policy for action pinning. Additionally, we add workflow permissions and suppress the secrets rule to satisfy the zizmor check. --- .../cloud-init-image-for-cuttlefish.yaml | 8 +-- .github/workflows/gemini-dispatch.yaml | 6 +- .github/workflows/gemini-invoke.yaml | 4 +- .github/workflows/gemini-plan-execute.yaml | 4 +- .github/workflows/gemini-review.yaml | 4 +- .../gigabyte-ampere-cloud-installer.yaml | 55 ++++++++++--------- 6 files changed, 42 insertions(+), 39 deletions(-) diff --git a/.github/workflows/cloud-init-image-for-cuttlefish.yaml b/.github/workflows/cloud-init-image-for-cuttlefish.yaml index 7324c712975..f886b73439c 100644 --- a/.github/workflows/cloud-init-image-for-cuttlefish.yaml +++ b/.github/workflows/cloud-init-image-for-cuttlefish.yaml @@ -21,7 +21,7 @@ jobs: working-directory: ./cloud-init-image-for-cuttlefish steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setting up build environment run: | apt-get update @@ -37,7 +37,7 @@ jobs: run: | ./gen_cidata_iso.sh - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: cloud-init-image-for-cuttlefish-artifacts path: cloud-init-image-for-cuttlefish/gigabyte-cidata.iso @@ -54,9 +54,9 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: cloud-init-image-for-cuttlefish-artifacts - name: Prepare test environment diff --git a/.github/workflows/gemini-dispatch.yaml b/.github/workflows/gemini-dispatch.yaml index 5ea827a1778..9dfb0138636 100644 --- a/.github/workflows/gemini-dispatch.yaml +++ b/.github/workflows/gemini-dispatch.yaml @@ -111,7 +111,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'review' }} - uses: './.github/workflows/gemini-review.yaml' + uses: './.github/workflows/gemini-review.yaml' # zizmor: ignore[secrets-inherit] permissions: contents: 'read' id-token: 'write' @@ -124,7 +124,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'invoke' }} - uses: './.github/workflows/gemini-invoke.yaml' + uses: './.github/workflows/gemini-invoke.yaml' # zizmor: ignore[secrets-inherit] permissions: contents: 'read' id-token: 'write' @@ -137,7 +137,7 @@ jobs: needs: 'dispatch' if: |- ${{ needs.dispatch.outputs.command == 'approve' }} - uses: './.github/workflows/gemini-plan-execute.yaml' + uses: './.github/workflows/gemini-plan-execute.yaml' # zizmor: ignore[secrets-inherit] permissions: contents: 'write' id-token: 'write' diff --git a/.github/workflows/gemini-invoke.yaml b/.github/workflows/gemini-invoke.yaml index 396d7f23002..7565493e9c1 100644 --- a/.github/workflows/gemini-invoke.yaml +++ b/.github/workflows/gemini-invoke.yaml @@ -36,11 +36,11 @@ jobs: permission-pull-requests: 'write' - name: 'Checkout Code' - uses: 'actions/checkout@v4' # ratchet:exclude + uses: 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262' # v4 - name: 'Run Gemini CLI' id: 'run_gemini' - uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0 env: TITLE: '${{ github.event.pull_request.title }}' DESCRIPTION: '${{ github.event.pull_request.body }}' diff --git a/.github/workflows/gemini-plan-execute.yaml b/.github/workflows/gemini-plan-execute.yaml index 29f6da05351..b41a7f2d28b 100644 --- a/.github/workflows/gemini-plan-execute.yaml +++ b/.github/workflows/gemini-plan-execute.yaml @@ -38,11 +38,11 @@ jobs: permission-pull-requests: 'write' - name: 'Checkout Code' - uses: 'actions/checkout@v4' # ratchet:exclude + uses: 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262' # v4 - name: 'Run Gemini CLI' id: 'run_gemini' - uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0 env: TITLE: '${{ github.event.pull_request.title }}' DESCRIPTION: '${{ github.event.pull_request.body }}' diff --git a/.github/workflows/gemini-review.yaml b/.github/workflows/gemini-review.yaml index 80522f0bfeb..2f57f3251b8 100644 --- a/.github/workflows/gemini-review.yaml +++ b/.github/workflows/gemini-review.yaml @@ -40,7 +40,7 @@ jobs: uses: 'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8' # ratchet:actions/checkout@v6 - name: 'Run Gemini pull request review' - uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0 id: 'gemini_pr_review' env: GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}' @@ -113,7 +113,7 @@ jobs: ] prompt: '/pr-code-review' - name: 'Run Gemini security analysis review' - uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude + uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0 id: 'gemini_security_analysis' env: GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}' diff --git a/.github/workflows/gigabyte-ampere-cloud-installer.yaml b/.github/workflows/gigabyte-ampere-cloud-installer.yaml index bcfaa12bb8f..d91e3fa5e4d 100644 --- a/.github/workflows/gigabyte-ampere-cloud-installer.yaml +++ b/.github/workflows/gigabyte-ampere-cloud-installer.yaml @@ -8,6 +8,9 @@ on: branches: - '**' +permissions: + contents: read + jobs: build-cloud-installer-initramfs-job: runs-on: ubuntu-22.04-arm @@ -19,7 +22,7 @@ jobs: working-directory: ./gigabyte-ampere-cloud-installer steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setting up build environment run: | apt-get update @@ -39,7 +42,7 @@ jobs: export HOME=$GITHUB_WORKSPACE ./regenerate-initramfs.sh - name: Upload artifacts for initramfs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: gigabyte-ampere-cloud-installer-initramfs-artifacts path: gigabyte-ampere-cloud-installer/initrd.img-* @@ -55,9 +58,9 @@ jobs: working-directory: ./gigabyte-ampere-cloud-installer steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-initramfs-artifacts path: ./gigabyte-ampere-cloud-installer @@ -91,7 +94,7 @@ jobs: - name: Clean build directory run: ./lb_clean.sh - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: gigabyte-ampere-cloud-installer/live-image-arm64.iso.xz @@ -103,7 +106,7 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Use github CLI to search for run-id id: search-run env: @@ -113,13 +116,13 @@ jobs: echo "Found Run ID is : ${RUN_ID}" echo "target_id=$RUN_ID" >> $GITHUB_OUTPUT - name: Download artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: cloud-init-image-for-cuttlefish-artifacts run-id: ${{ steps.search-run.outputs.target_id }} github-token: ${{ secrets.GITHUB_TOKEN }} - name: Reupload artifact for later test cases - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: gigabyte-cidata.iso @@ -138,14 +141,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -194,14 +197,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -252,14 +255,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -310,14 +313,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -370,14 +373,14 @@ jobs: TEST_DISK_SIZE: "10G" steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer @@ -445,14 +448,14 @@ jobs: working-directory: ./gigabyte-ampere-cloud-installer steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Download installer artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-artifacts path: ./gigabyte-ampere-cloud-installer - name: Download cidata artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: gigabyte-ampere-cloud-installer-cidata path: ./gigabyte-ampere-cloud-installer