From eebccb11f8a277c1ac8fa262ad840aa076cc7ed5 Mon Sep 17 00:00:00 2001 From: Chris Povirk Date: Fri, 31 Jul 2026 15:47:54 -0400 Subject: [PATCH 1/3] Address `zizmor` findings: - [`persist-credentials: false`](https://docs.zizmor.sh/audits/#artipacked) - [pinning `uses`](https://docs.zizmor.sh/audits/#unpinned-uses) There may be other findings, but these are the easy one. --- .github/workflows/ci.yml | 34 ++++++++++++++++++++-------------- .github/workflows/release.yml | 12 +++++++----- 2 files changed, 27 insertions(+), 19 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8b6d7ebc570..aa0eb3a1fc4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -47,39 +47,41 @@ jobs: continue-on-error: ${{ matrix.experimental }} steps: - name: Cancel previous - uses: styfle/cancel-workflow-action@0.13.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }} - name: 'Check out repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: 'Set up JDK 21' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 21 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 25' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 25 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 28 from jdk.java.net' - uses: oracle-actions/setup-java@v1 + uses: oracle-actions/setup-java@ec7274acdd237c7fe61395ed2edda22d756b5afe # v1 with: website: jdk.java.net release: 28 cache: 'maven' - name: 'Set up JDK ${{ matrix.java }} from jdk.java.net' if: ${{ matrix.java == 'EA' }} - uses: oracle-actions/setup-java@v1 + uses: oracle-actions/setup-java@ec7274acdd237c7fe61395ed2edda22d756b5afe # v1 with: website: jdk.java.net release: ${{ matrix.java }} cache: 'maven' - name: 'Set up JDK ${{ matrix.java }}' if: ${{ matrix.java != 'EA' }} - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: ${{ matrix.java }} distribution: 'zulu' @@ -101,15 +103,17 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Check out repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: 'Set up JDK 25' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 25 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 21' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 21 distribution: 'zulu' @@ -133,21 +137,23 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Check out repository' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: 'Set up JDK 25' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 25 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 23' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 23 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 21' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 21 distribution: 'zulu' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 71c6d608d27..465dc2ba778 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,24 +14,26 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: 'Set up JDK 25' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 25 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 23' - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 23 distribution: 'zulu' cache: 'maven' - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: java-version: 21 distribution: 'zulu' @@ -70,7 +72,7 @@ jobs: GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }} - name: Draft Release Entry - uses: softprops/action-gh-release@v3.0.1 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 with: draft: true name: Error Prone ${{ github.event.input.version }} From 6475e5269242745fc0071f24a9ea7cd827189ebe Mon Sep 17 00:00:00 2001 From: Chris Povirk Date: Fri, 31 Jul 2026 17:24:21 -0400 Subject: [PATCH 2/3] Improve version comments. --- .github/workflows/ci.yml | 16 ++++++++-------- .github/workflows/release.yml | 6 +++--- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index aa0eb3a1fc4..436983456ac 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -55,13 +55,13 @@ jobs: with: persist-credentials: false - name: 'Set up JDK 21' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 25' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 25 distribution: 'zulu' @@ -81,7 +81,7 @@ jobs: cache: 'maven' - name: 'Set up JDK ${{ matrix.java }}' if: ${{ matrix.java != 'EA' }} - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ matrix.java }} distribution: 'zulu' @@ -107,13 +107,13 @@ jobs: with: persist-credentials: false - name: 'Set up JDK 25' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 25 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 21' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: 'zulu' @@ -141,19 +141,19 @@ jobs: with: persist-credentials: false - name: 'Set up JDK 25' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 25 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 23' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 23 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 21' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: 'zulu' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 465dc2ba778..b77a9f6723c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,21 +19,21 @@ jobs: persist-credentials: false - name: 'Set up JDK 25' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 25 distribution: 'zulu' cache: 'maven' - name: 'Set up JDK 23' - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 23 distribution: 'zulu' cache: 'maven' - name: Set up JDK - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: 'zulu' From 3068f8aacdae4117c89f6b48406ef41207a3e5b1 Mon Sep 17 00:00:00 2001 From: Chris Povirk Date: Fri, 31 Jul 2026 17:53:58 -0400 Subject: [PATCH 3/3] Address [excessive permissions](https://docs.zizmor.sh/audits/#excessive-permissions). --- .github/workflows/ci.yml | 3 +++ .github/workflows/release.yml | 2 ++ 2 files changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 436983456ac..816740376ec 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -97,6 +97,9 @@ jobs: run: mvn -P '!examples' javadoc:javadoc publish_snapshot: + permissions: + contents: read # to fetch code (actions/checkout) + name: 'Publish snapshot' needs: test if: github.event_name == 'push' && github.repository == 'google/error-prone' && github.ref == 'refs/heads/master' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b77a9f6723c..da75410e380 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,6 +7,8 @@ on: description: "version number for this release." required: true +permissions: {} + jobs: build-maven-jars: runs-on: ubuntu-latest