From 640662d57c6520ce417aeb0d7fbfc84d85e4d719 Mon Sep 17 00:00:00 2001 From: Samuel Newman Date: Tue, 7 Jul 2026 14:20:50 +0300 Subject: [PATCH] Fix zizmor findings in build workflows (#11046) Co-authored-by: Claude Fable 5 --- .github/workflows/build-submit-android.yml | 38 ++++++++++++++++--- .github/workflows/build-submit-ios.yml | 23 +++++++++++ .../workflows/bundle-deploy-eas-update.yml | 2 +- .github/workflows/nightly-build.yml | 31 ++++++++++++++- .github/workflows/pull-request-commit.yml | 2 +- 5 files changed, 87 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-submit-android.yml b/.github/workflows/build-submit-android.yml index d336e9a9f8..87c7457706 100644 --- a/.github/workflows/build-submit-android.yml +++ b/.github/workflows/build-submit-android.yml @@ -23,6 +23,31 @@ on: version-code: description: Android version code value: ${{ jobs.build.outputs.version-code }} + secrets: + EXPO_TOKEN: + required: true + ENV_TOKEN: + required: true + SENTRY_DSN: + required: true + BITDRIFT_API_KEY: + required: true + EXPO_PUBLIC_GCP_PROJECT_ID: + required: true + GOOGLE_SERVICES_TOKEN: + required: true + SENTRY_AUTH_TOKEN: + required: true + SLACK_CLIENT_ALERT_WEBHOOK: + required: true + ANDROID_KEYSTORE_BASE64: + required: true + ANDROID_KEYSTORE_PASSWORD: + required: true + ANDROID_KEY_ALIAS: + required: true + ANDROID_KEY_PASSWORD: + required: true # Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code permissions: @@ -238,11 +263,14 @@ jobs: - name: 📎 Attach APK to GitHub Release id: attach if: ${{ steps.release-check.outputs.exists == 'true' }} - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 - with: - tag_name: ${{ github.ref_name }} - files: Bluesky-${{ needs.build.outputs.package-version }}.apk - fail_on_unmatched_files: true + env: + GH_TOKEN: ${{ github.token }} + TAG: ${{ github.ref_name }} + APK: Bluesky-${{ needs.build.outputs.package-version }}.apk + run: | + gh release upload "$TAG" "$APK" --clobber + url=$(gh release view "$TAG" --json url --jq .url) + echo "url=$url" >> "$GITHUB_OUTPUT" - name: 🔔 Notify Slack of Release Attachment if: ${{ steps.release-check.outputs.exists == 'true' }} diff --git a/.github/workflows/build-submit-ios.yml b/.github/workflows/build-submit-ios.yml index 55c29d9f12..c78d22d388 100644 --- a/.github/workflows/build-submit-ios.yml +++ b/.github/workflows/build-submit-ios.yml @@ -35,6 +35,29 @@ on: build-number: description: iOS build number value: ${{ jobs.build.outputs.build-number }} + secrets: + EXPO_TOKEN: + required: true + ENV_TOKEN: + required: true + SENTRY_DSN: + required: true + BITDRIFT_API_KEY: + required: true + EXPO_PUBLIC_GCP_PROJECT_ID: + required: true + GOOGLE_SERVICES_TOKEN: + required: true + SENTRY_AUTH_TOKEN: + required: true + ASC_KEY_ID: + required: true + ASC_ISSUER_ID: + required: true + ASC_KEY_P8_BASE64: + required: true + SLACK_CLIENT_ALERT_WEBHOOK: + required: true # Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code permissions: diff --git a/.github/workflows/bundle-deploy-eas-update.yml b/.github/workflows/bundle-deploy-eas-update.yml index 7fcbaffc31..3915b8823c 100644 --- a/.github/workflows/bundle-deploy-eas-update.yml +++ b/.github/workflows/bundle-deploy-eas-update.yml @@ -70,7 +70,7 @@ jobs: - name: 📷 Check fingerprint and install dependencies id: fingerprint - uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.1.0 + uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.2.0 with: profile: ${{ inputs.channel || 'testflight' }} previous-commit-tag: ${{ inputs.runtimeVersion }} diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml index 250ad038bd..a90eb55fe5 100644 --- a/.github/workflows/nightly-build.yml +++ b/.github/workflows/nightly-build.yml @@ -78,7 +78,20 @@ jobs: with: profile: testflight testFlightGroup: "QA Team" - secrets: inherit + # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`, + # so the nightly build never hands the reusable workflow the entire repo secret store. + secrets: + EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }} + ENV_TOKEN: ${{ secrets.ENV_TOKEN }} + SENTRY_DSN: ${{ secrets.SENTRY_DSN }} + BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }} + EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }} + GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }} + SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} + ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }} + ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }} + ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }} + SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }} android: name: Nightly Android Build @@ -91,7 +104,21 @@ jobs: uses: ./.github/workflows/build-submit-android.yml with: profile: testflight-android - secrets: inherit + # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`, + # so the nightly build never hands the reusable workflow the entire repo secret store. + secrets: + EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }} + ENV_TOKEN: ${{ secrets.ENV_TOKEN }} + SENTRY_DSN: ${{ secrets.SENTRY_DSN }} + BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }} + EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }} + GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }} + SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} + SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }} + ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }} + ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }} + ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }} + ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }} notify-ios: name: Notify Slack of iOS nightly diff --git a/.github/workflows/pull-request-commit.yml b/.github/workflows/pull-request-commit.yml index 33e811b4a5..3d4dfb9bf0 100644 --- a/.github/workflows/pull-request-commit.yml +++ b/.github/workflows/pull-request-commit.yml @@ -135,7 +135,7 @@ jobs: - name: 📷 Check fingerprint and install dependencies id: fingerprint timeout-minutes: 5 - uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.1.0 + uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.2.0 with: profile: pull-request