Skip to content

Commit 1736043

Browse files
AustinBenoitAustinBenoit
authored
Merge branch 'main' into symbol-fix
2 parents 81c2b7b + cd6e107 commit 1736043

28 files changed

Lines changed: 186 additions & 62 deletions

‎.github/workflows/android.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ env:
1515
GITHUB_TOKEN: ${{ github.token }}
1616
xcodeVersion: "26.2" # Only affects Mac runners, and only for prerequisites.
1717

18+
permissions:
19+
contents: read
20+
1821
concurrency:
1922
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
2023
cancel-in-progress: true
@@ -29,6 +32,7 @@ jobs:
2932
steps:
3033
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
3134
with:
35+
persist-credentials: true # zizmor: ignore[artipacked]
3236
submodules: false
3337
- name: Use expanded matrix
3438
if: github.event.inputs.use_expanded_matrix == '1'
@@ -93,6 +97,7 @@ jobs:
9397
9498
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
9599
with:
100+
persist-credentials: true # zizmor: ignore[artipacked]
96101
submodules: true
97102

98103
- name: Set env variables for subsequent steps (all)

‎.github/workflows/build-report.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ jobs:
3131
python-version: 3.9
3232
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
3333
with:
34+
persist-credentials: true # zizmor: ignore[artipacked]
3435
fetch-depth: 0
3536
- name: Install Desktop SDK prerequisites
3637
uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2

‎.github/workflows/checks.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ jobs:
2424
steps:
2525
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
2626
with:
27+
persist-credentials: true # zizmor: ignore[artipacked]
2728
submodules: false
2829
- name: Setup python
2930
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
@@ -65,6 +66,7 @@ jobs:
6566
cmakeVersion: "~3.31.0"
6667
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
6768
with:
69+
persist-credentials: true # zizmor: ignore[artipacked]
6870
submodules: false
6971
- name: Setup python
7072
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
@@ -104,6 +106,7 @@ jobs:
104106
steps:
105107
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
106108
with:
109+
persist-credentials: true # zizmor: ignore[artipacked]
107110
submodules: false
108111
- name: Run check_copyright.sh
109112
run: |
@@ -118,6 +121,7 @@ jobs:
118121
# Skip this if the PR has the skipReleaseNotes label or if it's a merge to other than main.
119122
if: ${{!contains(github.event.pull_request.labels.*.name, env.skipReleaseNotesLabel) && (github.event.pull_request.base.ref == 'main')}}
120123
with:
124+
persist-credentials: true # zizmor: ignore[artipacked]
121125
fetch-depth: 0
122126
submodules: false
123127
- name: Check whether release notes have been updated

‎.github/workflows/checks_secure.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ jobs:
3131
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
3232
if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository
3333
with:
34+
persist-credentials: true # zizmor: ignore[artipacked]
3435
submodules: false
3536
- name: Setup python
3637
if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository

‎.github/workflows/cpp-packaging.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,7 @@ jobs:
141141
if: ${{ matrix.tools_platform == 'darwin' && !steps.cache_llvm.outputs.cache-hit }}
142142
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
143143
with:
144+
persist-credentials: true # zizmor: ignore[artipacked]
144145
repository: llvm/llvm-project
145146
path: llvm-src
146147
ref: ${{ env.llvmVer }}
@@ -163,6 +164,7 @@ jobs:
163164
- name: fetch demumble
164165
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
165166
with:
167+
persist-credentials: true # zizmor: ignore[artipacked]
166168
repository: nico/demumble
167169
path: demumble-src
168170
ref: ${{ env.demumbleVer }}
@@ -211,6 +213,7 @@ jobs:
211213
- name: fetch SDK
212214
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
213215
with:
216+
persist-credentials: true # zizmor: ignore[artipacked]
214217
path: sdk-src
215218

216219
- name: Setup python
@@ -266,6 +269,7 @@ jobs:
266269
- name: fetch SDK
267270
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
268271
with:
272+
persist-credentials: true # zizmor: ignore[artipacked]
269273
path: sdk-src
270274

271275
- name: Store git credentials for all git commands
@@ -380,6 +384,7 @@ jobs:
380384

381385
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
382386
with:
387+
persist-credentials: true # zizmor: ignore[artipacked]
383388
submodules: true
384389

385390
- name: Set env variables for subsequent steps (all)
@@ -523,6 +528,7 @@ jobs:
523528
- name: fetch SDK
524529
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
525530
with:
531+
persist-credentials: true # zizmor: ignore[artipacked]
526532
path: sdk-src
527533

528534
- name: download packaging-tool artifacts
@@ -733,6 +739,7 @@ jobs:
733739
- name: fetch SDK
734740
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
735741
with:
742+
persist-credentials: true # zizmor: ignore[artipacked]
736743
path: sdk-src
737744

738745
- name: download artifact
@@ -859,6 +866,8 @@ jobs:
859866
steps:
860867
- name: Checkout repo
861868
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
869+
with:
870+
persist-credentials: true # zizmor: ignore[artipacked]
862871

863872
- name: Setup python
864873
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
@@ -933,6 +942,8 @@ jobs:
933942
steps:
934943
- name: Checkout repo
935944
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
945+
with:
946+
persist-credentials: true # zizmor: ignore[artipacked]
936947
- name: Setup python
937948
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
938949
with:

‎.github/workflows/desktop.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ env:
1414
CCACHE_DIR: ${{ github.workspace }}/ccache_dir
1515
GITHUB_TOKEN: ${{ github.token }}
1616

17+
permissions:
18+
contents: read
19+
1720
concurrency:
1821
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
1922
cancel-in-progress: true
@@ -31,6 +34,7 @@ jobs:
3134
steps:
3235
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
3336
with:
37+
persist-credentials: true # zizmor: ignore[artipacked]
3438
submodules: false
3539
- name: Use expanded matrix
3640
if: github.event.inputs.expanded_matrix == '1'
@@ -113,10 +117,13 @@ jobs:
113117

114118
- name: Setup Xcode version (macos)
115119
if: runner.os == 'macOS'
116-
run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app/Contents/Developer
120+
run: sudo xcode-select -s /Applications/Xcode_${XCODE_VERSION}.app/Contents/Developer
121+
env:
122+
XCODE_VERSION: ${{ matrix.xcode_version }}
117123

118124
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
119125
with:
126+
persist-credentials: true # zizmor: ignore[artipacked]
120127
submodules: true
121128

122129
- name: Set env vars (ubuntu)
@@ -327,6 +334,7 @@ jobs:
327334
cmakeVersion: "~3.31.0"
328335
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
329336
with:
337+
persist-credentials: true # zizmor: ignore[artipacked]
330338
ref: ${{needs.check_and_prepare.outputs.github_ref}}
331339
submodules: true
332340
- name: Cache vcpkg C++ dependencies

‎.github/workflows/integration_tests.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ jobs:
155155
access_token: ${{ github.token }}
156156
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
157157
with:
158+
persist-credentials: true # zizmor: ignore[artipacked]
158159
ref: ${{steps.set_outputs.outputs.github_ref}}
159160
fetch-depth: 0
160161
submodules: false
@@ -309,6 +310,7 @@ jobs:
309310
cmakeVersion: "~3.31.0"
310311
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
311312
with:
313+
persist-credentials: true # zizmor: ignore[artipacked]
312314
ref: ${{needs.check_and_prepare.outputs.github_ref}}
313315
submodules: true
314316
- name: Setup python
@@ -482,6 +484,7 @@ jobs:
482484
cmakeVersion: "~3.31.0"
483485
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
484486
with:
487+
persist-credentials: true # zizmor: ignore[artipacked]
485488
ref: ${{needs.check_and_prepare.outputs.github_ref}}
486489
submodules: true
487490
- run: df -h
@@ -626,6 +629,7 @@ jobs:
626629
cmakeVersion: "~3.31.0"
627630
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
628631
with:
632+
persist-credentials: true # zizmor: ignore[artipacked]
629633
ref: ${{needs.check_and_prepare.outputs.github_ref}}
630634
submodules: true
631635
- name: Setup python
@@ -748,6 +752,7 @@ jobs:
748752
cmakeVersion: "~3.31.0"
749753
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
750754
with:
755+
persist-credentials: true # zizmor: ignore[artipacked]
751756
ref: ${{needs.check_and_prepare.outputs.github_ref}}
752757
submodules: true
753758
- name: Setup python
@@ -888,6 +893,7 @@ jobs:
888893
steps:
889894
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
890895
with:
896+
persist-credentials: true # zizmor: ignore[artipacked]
891897
ref: ${{needs.check_and_prepare.outputs.github_ref}}
892898
- name: Download Desktop integration tests artifact
893899
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
@@ -1018,6 +1024,7 @@ jobs:
10181024
steps:
10191025
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
10201026
with:
1027+
persist-credentials: true # zizmor: ignore[artipacked]
10211028
ref: ${{needs.check_and_prepare.outputs.github_ref}}
10221029
- name: Download Android integration tests artifact
10231030
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
@@ -1163,6 +1170,7 @@ jobs:
11631170
steps:
11641171
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
11651172
with:
1173+
persist-credentials: true # zizmor: ignore[artipacked]
11661174
ref: ${{needs.check_and_prepare.outputs.github_ref}}
11671175
- name: Download iOS integration tests artifact
11681176
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
@@ -1348,6 +1356,7 @@ jobs:
13481356
steps:
13491357
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
13501358
with:
1359+
persist-credentials: true # zizmor: ignore[artipacked]
13511360
ref: ${{needs.check_and_prepare.outputs.github_ref}}
13521361
- name: Download tvOS integration tests artifact
13531362
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
@@ -1496,6 +1505,7 @@ jobs:
14961505
steps:
14971506
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
14981507
with:
1508+
persist-credentials: true # zizmor: ignore[artipacked]
14991509

15001510
ref: ${{needs.check_and_prepare.outputs.github_ref}}
15011511
- name: Setup python
@@ -1576,6 +1586,7 @@ jobs:
15761586
steps:
15771587
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
15781588
with:
1589+
persist-credentials: true # zizmor: ignore[artipacked]
15791590

15801591
ref: ${{needs.check_and_prepare.outputs.github_ref}}
15811592
- name: Setup python

‎.github/workflows/ios.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ on:
1313
env:
1414
GITHUB_TOKEN: ${{ github.token }}
1515

16+
permissions:
17+
contents: read
18+
1619
concurrency:
1720
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
1821
cancel-in-progress: true
@@ -25,6 +28,7 @@ jobs:
2528
steps:
2629
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
2730
with:
31+
persist-credentials: true # zizmor: ignore[artipacked]
2832
submodules: false
2933
- name: Use expanded matrix
3034
if: github.event.inputs.use_expanded_matrix == '1'
@@ -56,10 +60,13 @@ jobs:
5660
5761
- name: setup Xcode version (macos)
5862
if: runner.os == 'macOS'
59-
run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app/Contents/Developer
63+
run: sudo xcode-select -s /Applications/Xcode_${XCODE_VERSION}.app/Contents/Developer
64+
env:
65+
XCODE_VERSION: ${{ matrix.xcode_version }}
6066

6167
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
6268
with:
69+
persist-credentials: true # zizmor: ignore[artipacked]
6370
submodules: true
6471

6572
- name: Setup python

‎.github/workflows/lint.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,29 @@ on:
44
pull_request:
55
types: [opened,synchronize]
66

7+
permissions:
8+
contents: read
9+
710
concurrency:
811
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
912
cancel-in-progress: true
1013

1114
jobs:
1215
lint_warnings_check_and_comment:
1316
runs-on: ubuntu-22.04
17+
permissions:
18+
contents: read
19+
pull-requests: write
1420
steps:
1521
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
1622
with:
23+
persist-credentials: true # zizmor: ignore[artipacked]
1724
repository: cpplint/cpplint
1825
ref: "1.5.5"
1926
path: cpplint
2027
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
2128
with:
29+
persist-credentials: true # zizmor: ignore[artipacked]
2230
submodules: false
2331
path: firebase
2432

‎.github/workflows/retry-test-failures.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
default: ''
88
required: true
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
check_results_and_retry_if_needed:
1215
name: check-results-and-retry-if-needed
@@ -27,6 +30,7 @@ jobs:
2730

2831
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
2932
with:
33+
persist-credentials: true # zizmor: ignore[artipacked]
3034
ref: ${{ matrix.branch_name }}
3135
fetch-depth: 0
3236
submodules: false

0 commit comments

Comments
 (0)