From 6ec6b83b4cc594a840f761e781c015e1409894e0 Mon Sep 17 00:00:00 2001 From: Takahito Nakano Date: Thu, 15 Oct 2026 20:30:00 +0900 Subject: [PATCH 1/3] chore(deps): update jactionlint to v2.2.0 --- mise.lock | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/mise.lock b/mise.lock index 68bf32a..708772b 100644 --- a/mise.lock +++ b/mise.lock @@ -187,50 +187,50 @@ url = "https://github.com/jdx/hk/releases/download/v2.6.0/hk-x86_64-pc-windows-m signer = "sigstore-oidc:https://github.com/jdx/hk/.github/workflows/release.yml" [[tools.jactionlint]] -version = "2.1.0" +version = "2.2.0" backend = "github:jdx/jactionlint" specifiers = ["latest"] [tools.jactionlint."platforms.linux-arm64"] -checksum = "sha256:ec0c6496d8a2f37b2ae2a1af0fbf98d58df1f7c98a27cf9fdd64c20ad317234b" -url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112146" +checksum = "sha256:6d4c3831cc360b14550fb2f4605b4de9d2761515cd3fd5c1da718528b314647d" +url = "https://github.com/jdx/jactionlint/releases/download/v2.2.0/jactionlint_2.2.0_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/640875713" provenance = "github-attestations" [tools.jactionlint."platforms.linux-arm64-musl"] -checksum = "sha256:ec0c6496d8a2f37b2ae2a1af0fbf98d58df1f7c98a27cf9fdd64c20ad317234b" -url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112146" +checksum = "sha256:6d4c3831cc360b14550fb2f4605b4de9d2761515cd3fd5c1da718528b314647d" +url = "https://github.com/jdx/jactionlint/releases/download/v2.2.0/jactionlint_2.2.0_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/640875713" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64"] -checksum = "sha256:baebfc5792135438fb3bb5ea266c3bf2538a089753616f1988ef618e4c0c3cb1" -url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112089" +checksum = "sha256:8137d5bfe266dd5e48d2af2306827785ce07c6988e04b1c3d6ad4776e97d27d2" +url = "https://github.com/jdx/jactionlint/releases/download/v2.2.0/jactionlint_2.2.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/640875708" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64-musl"] -checksum = "sha256:baebfc5792135438fb3bb5ea266c3bf2538a089753616f1988ef618e4c0c3cb1" -url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112089" +checksum = "sha256:8137d5bfe266dd5e48d2af2306827785ce07c6988e04b1c3d6ad4776e97d27d2" +url = "https://github.com/jdx/jactionlint/releases/download/v2.2.0/jactionlint_2.2.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/640875708" provenance = "github-attestations" [tools.jactionlint."platforms.macos-arm64"] -checksum = "sha256:3766a4b0890d3eb36fe58760289885712131c7974de4bc9fabb9a3faa599e931" -url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628111988" +checksum = "sha256:622b29b15a59618bc032163073209ffc434252e9a19eafd451e69207a50f266a" +url = "https://github.com/jdx/jactionlint/releases/download/v2.2.0/jactionlint_2.2.0_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/640875646" provenance = "github-attestations" [tools.jactionlint."platforms.macos-x64"] -checksum = "sha256:a88f2be76def62dd4fd9aed38c81d0db4144763012128a89800be80b1ee82e89" -url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_darwin_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112083" +checksum = "sha256:74efa76b1c200a2b7778c28e9aa0c3ba1c843863006a2f8916f252f8c048d42b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.2.0/jactionlint_2.2.0_darwin_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/640875655" provenance = "github-attestations" [tools.jactionlint."platforms.windows-x64"] -checksum = "sha256:5925a118df6db8c5be418acb05bd815d3c14ca98d91a9ecba6156753b87d4ae7" -url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_windows_amd64.zip" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112198" +checksum = "sha256:97300770d2bea28110736e34edfc9a21d80840090af64dc4b6116b6467f537a4" +url = "https://github.com/jdx/jactionlint/releases/download/v2.2.0/jactionlint_2.2.0_windows_amd64.zip" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/640875792" provenance = "github-attestations" [[tools."npm:@commitlint/cli"]] From 5d3ce7250667f5b92d377945cb86856c2c4920cb Mon Sep 17 00:00:00 2001 From: Takahito Nakano Date: Thu, 15 Oct 2026 20:30:00 +0900 Subject: [PATCH 2/3] ci: fix ubuntu-slim-limits violations --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 971d685..25a7a1b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: - editorconfig - ryl runs-on: ubuntu-slim - timeout-minutes: 60 + timeout-minutes: 15 steps: - name: Fail if any required jobs failed or cancelled if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }} @@ -35,7 +35,7 @@ jobs: name: Get changed files if: ${{ github.event_name == 'pull_request' }} runs-on: ubuntu-slim - timeout-minutes: 60 + timeout-minutes: 15 permissions: contents: read outputs: From 93113a389ff91a8688526f34a6321c65e85d7db8 Mon Sep 17 00:00:00 2001 From: Takahito Nakano Date: Thu, 15 Oct 2026 20:30:00 +0900 Subject: [PATCH 3/3] ci: consolidate GitHub Actions linting --- .github/ghalint.yml | 4 -- .github/workflows/ci.yml | 57 +++------------------ .github/zizmor.yml | 5 -- hk.pkl | 3 -- mise.lock | 108 --------------------------------------- mise.toml | 2 - 6 files changed, 7 insertions(+), 172 deletions(-) delete mode 100644 .github/ghalint.yml delete mode 100644 .github/zizmor.yml diff --git a/.github/ghalint.yml b/.github/ghalint.yml deleted file mode 100644 index 4321317..0000000 --- a/.github/ghalint.yml +++ /dev/null @@ -1,4 +0,0 @@ -excludes: - - policy_name: checkout_persist_credentials_should_be_false - workflow_file_path: .github/workflows/ci.yml - job_name: changed-files diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 25a7a1b..6843552 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,9 +15,7 @@ jobs: if: ${{ always() }} needs: - changed-files - - ghalint - jactionlint - - zizmor - build - check - commitlint @@ -40,9 +38,9 @@ jobs: contents: read outputs: # reference: https://github.com/tj-actions/changed-files#outputs- - actions: ${{ steps.changed-files.outputs.actions_any_modified == 'true' }} build: ${{ steps.changed-files.outputs.build_any_modified == 'true' }} compile: ${{ steps.changed-files.outputs.compile_any_modified == 'true' }} + jactionlint: ${{ steps.changed-files.outputs.actions_any_modified == 'true' }} ryl: ${{ steps.changed-files.outputs.ryl_any_modified == 'true' }} steps: - name: Checkout @@ -62,10 +60,6 @@ jobs: - mise.lock - mise.toml - pnpm-lock.yaml - actions: - - *dependencies - - "**/action.{yaml,yml}" - - ".github/workflows/*.{yaml,yml}" build: - *common - *dependencies @@ -74,35 +68,19 @@ jobs: - *common - *dependencies - "packages/**/*.{ts,tsx}" + jactionlint: + - *dependencies + - "**/action.{yaml,yml}" + - ".github/workflows/*.{yaml,yml}" + - .github/jactionlint.yaml ryl: - *common - *dependencies - "**/*.{yaml,yml}" - ghalint: - name: ghalint - if: ${{ always() && !failure() && !cancelled() && - (needs.changed-files.result == 'skipped' || needs.changed-files.outputs.actions == 'true') }} - needs: changed-files - runs-on: ubuntu-slim - timeout-minutes: 60 - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - name: Set up mise - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 - - name: Run ghalint - run: | - ghalint run - ghalint act - shell: bash jactionlint: name: jactionlint if: ${{ always() && !failure() && !cancelled() && - (needs.changed-files.result == 'skipped' || needs.changed-files.outputs.actions == 'true') }} + (needs.changed-files.result == 'skipped' || needs.changed-files.outputs.jactionlint == 'true') }} needs: changed-files runs-on: ubuntu-26.04 timeout-minutes: 60 @@ -118,27 +96,6 @@ jobs: - name: Run jactionlint run: jactionlint --format=github --color shell: bash - zizmor: - name: zizmor - if: ${{ always() && !failure() && !cancelled() && - (needs.changed-files.result == 'skipped' || needs.changed-files.outputs.actions == 'true') }} - needs: changed-files - runs-on: ubuntu-26.04 - timeout-minutes: 60 - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - name: Set up mise - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 - - name: Run zizmor - env: - GH_TOKEN: ${{ github.token }} - run: zizmor -p --format=github --min-severity=low . - shell: bash build: name: Build if: ${{ always() && !failure() && !cancelled() && diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index 061a911..0000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,5 +0,0 @@ -rules: - secrets-outside-env: - config: - allow: - - CACHIX_AUTH_TOKEN diff --git a/hk.pkl b/hk.pkl index fc29da9..9d92bcf 100644 --- a/hk.pkl +++ b/hk.pkl @@ -4,8 +4,6 @@ import "package://github.com/jdx/hk/releases/download/v2.6.0/hk@2.6.0#/Builtins. steps { ["editorconfig_checker"] = Builtins.editorconfig_checker - ["ghalint_action"] = Builtins.ghalint_action - ["ghalint_workflow"] = Builtins.ghalint_workflow ["jactionlint"] = Builtins.jactionlint ["ryl"] = Builtins.ryl ["vp_check"] = (Builtins.vp_check) { @@ -22,7 +20,6 @@ steps { effect = "write" } } - ["zizmor"] = Builtins.zizmor } hooks { diff --git a/mise.lock b/mise.lock index 708772b..879778d 100644 --- a/mise.lock +++ b/mise.lock @@ -90,67 +90,6 @@ url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/dow url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/574675794" provenance = "github-attestations" -[[tools.ghalint]] -version = "1.5.6" -backend = "aqua:suzuki-shunsuke/ghalint" -specifiers = ["latest"] - -[tools.ghalint."platforms.linux-arm64"] -checksum = "sha256:203a22c70b40bb161626973ad2a8dd06aeb736699fc8e03dd425dee8ff3406e6" -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/ghalint_1.5.6_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/suzuki-shunsuke/ghalint/releases/assets/409631231" - -[tools.ghalint."platforms.linux-arm64".provenance.slsa] -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/multiple.intoto.jsonl" - -[tools.ghalint."platforms.linux-arm64-musl"] -checksum = "sha256:203a22c70b40bb161626973ad2a8dd06aeb736699fc8e03dd425dee8ff3406e6" -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/ghalint_1.5.6_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/suzuki-shunsuke/ghalint/releases/assets/409631231" - -[tools.ghalint."platforms.linux-arm64-musl".provenance.slsa] -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/multiple.intoto.jsonl" - -[tools.ghalint."platforms.linux-x64"] -checksum = "sha256:98ee0e3330de7286f470d1e89c03ff7ce70d7a5998ba0f15969c400447be579c" -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/ghalint_1.5.6_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/suzuki-shunsuke/ghalint/releases/assets/409631220" - -[tools.ghalint."platforms.linux-x64".provenance.slsa] -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/multiple.intoto.jsonl" - -[tools.ghalint."platforms.linux-x64-musl"] -checksum = "sha256:98ee0e3330de7286f470d1e89c03ff7ce70d7a5998ba0f15969c400447be579c" -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/ghalint_1.5.6_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/suzuki-shunsuke/ghalint/releases/assets/409631220" - -[tools.ghalint."platforms.linux-x64-musl".provenance.slsa] -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/multiple.intoto.jsonl" - -[tools.ghalint."platforms.macos-arm64"] -checksum = "sha256:1262cac411e27b4653e6b66b7b06580ebcc2026fdd903e12e6cb0e4591639de6" -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/ghalint_1.5.6_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/suzuki-shunsuke/ghalint/releases/assets/409631219" - -[tools.ghalint."platforms.macos-arm64".provenance.slsa] -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/multiple.intoto.jsonl" - -[tools.ghalint."platforms.macos-x64"] -checksum = "sha256:d2a0e8605333068065dcf4c9b7b7a24891eda1750ac01fb755dfba426a390883" -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/ghalint_1.5.6_darwin_amd64.tar.gz" -url_api = "https://api.github.com/repos/suzuki-shunsuke/ghalint/releases/assets/409631204" - -[tools.ghalint."platforms.macos-x64".provenance.slsa] -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/multiple.intoto.jsonl" - -[tools.ghalint."platforms.windows-x64"] -checksum = "sha256:109ea9b39c8e263cef924bd3b4fe5505964204f934ca60d986f4090d01a99ba5" -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/ghalint_1.5.6_windows_amd64.zip" -url_api = "https://api.github.com/repos/suzuki-shunsuke/ghalint/releases/assets/409631234" - -[tools.ghalint."platforms.windows-x64".provenance.slsa] -url = "https://github.com/suzuki-shunsuke/ghalint/releases/download/v1.5.6/multiple.intoto.jsonl" - [[tools.hk]] version = "2.6.0" backend = "packslip:github.com/jdx/hk" @@ -278,50 +217,3 @@ url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/2790 checksum = "sha256:8a4e35ab0b331c85d73567b12f2a444df187f483e5079ceffa6bda1faa2e740e" url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.zip" url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056944" - -[[tools.zizmor]] -version = "1.30.1" -backend = "aqua:zizmorcore/zizmor" -specifiers = ["latest"] - -[tools.zizmor."platforms.linux-arm64"] -checksum = "sha256:7ff1dce33bdd18fd2a4affe63bdd47efcccca97b2cec1c1863ec26e9e2647540" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-aarch64-unknown-linux-gnu.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067643" -provenance = "github-attestations" - -[tools.zizmor."platforms.linux-arm64-musl"] -checksum = "sha256:7ff1dce33bdd18fd2a4affe63bdd47efcccca97b2cec1c1863ec26e9e2647540" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-aarch64-unknown-linux-gnu.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067643" -provenance = "github-attestations" - -[tools.zizmor."platforms.linux-x64"] -checksum = "sha256:e65324f4430c2717591937edcec90ccbefaf14c174f8ec9415e03ca875b46e1a" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-unknown-linux-gnu.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067642" -provenance = "github-attestations" - -[tools.zizmor."platforms.linux-x64-musl"] -checksum = "sha256:e65324f4430c2717591937edcec90ccbefaf14c174f8ec9415e03ca875b46e1a" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-unknown-linux-gnu.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067642" -provenance = "github-attestations" - -[tools.zizmor."platforms.macos-arm64"] -checksum = "sha256:e28d22b087f9ebb8d99da6e740d348c930f559961c7c3f12badda54f882195a2" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-aarch64-apple-darwin.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067640" -provenance = "github-attestations" - -[tools.zizmor."platforms.macos-x64"] -checksum = "sha256:10e6b18b11ea07e515a16f0f0518c7b07527bc9977c1fd5698181ce7f3554202" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-apple-darwin.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067641" -provenance = "github-attestations" - -[tools.zizmor."platforms.windows-x64"] -checksum = "sha256:b183b1e996eddfab9659f1e9b46e059f1ef1cf984a1f14e5da09f7876a4b3a1c" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-pc-windows-msvc.zip" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067645" -provenance = "github-attestations" diff --git a/mise.toml b/mise.toml index b638870..3181551 100644 --- a/mise.toml +++ b/mise.toml @@ -9,8 +9,6 @@ _.path = [ "aqua:owenlamont/ryl" = "latest" "npm:@commitlint/cli" = "latest" editorconfig-checker = "latest" -ghalint = "latest" hk = "latest" jactionlint = "latest" shellcheck = "latest" -zizmor = "latest"