From 51d0d18f815085948b78dc7e653033e59e0214e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Thu, 3 Sep 2026 21:04:24 +0300 Subject: [PATCH 1/6] Add zizmor to git hooks and CI Relates to: - #8620 - #9033 --- .github/workflows/git-hooks.yml | 29 +++++++++++++++++++++++++++++ .pre-commit-config.yaml | 6 ++++++ 2 files changed, 35 insertions(+) create mode 100644 .github/workflows/git-hooks.yml create mode 100644 .pre-commit-config.yaml diff --git a/.github/workflows/git-hooks.yml b/.github/workflows/git-hooks.yml new file mode 100644 index 0000000000..3ef7799a14 --- /dev/null +++ b/.github/workflows/git-hooks.yml @@ -0,0 +1,29 @@ +name: "Git Hooks" + +on: + workflow_dispatch: + push: + branches: + - main + pull_request: ~ + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + run-prek: + name: prek run --all-files + runs-on: ubuntu-24.04 + timeout-minutes: 1 + + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run prek + uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000000..080686f9cc --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,6 @@ +repos: + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: v1.29.0 + hooks: + - id: zizmor + args: ["--no-progress", "--persona=auditor"] From f47be35849140ac775b9ecd5278377ef8d8554b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 21 Sep 2026 17:23:39 +0300 Subject: [PATCH 2/6] Add missing concurrency settings --- .github/workflows/auto-close-issues.yml | 4 ++++ .github/workflows/ci-lint.yml | 4 ++++ .github/workflows/ci-test.yml | 4 ++++ .github/workflows/continuous-release.yml | 4 ++++ .github/workflows/contributors-png.yml | 4 ++++ .github/workflows/labeler.yml | 5 +++++ .github/workflows/release-workflow-v1.yml | 4 ++++ .github/workflows/release-workflow-v2.yml | 4 ++++ .github/workflows/stewards-update.yml | 4 ++++ 9 files changed, 37 insertions(+) diff --git a/.github/workflows/auto-close-issues.yml b/.github/workflows/auto-close-issues.yml index 72ac018794..938330566d 100644 --- a/.github/workflows/auto-close-issues.yml +++ b/.github/workflows/auto-close-issues.yml @@ -11,6 +11,10 @@ permissions: issues: write pull-requests: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: false + jobs: close_issues: if: github.event.pull_request.merged == true diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml index 87304ccf70..c60ccdfc6f 100644 --- a/.github/workflows/ci-lint.yml +++ b/.github/workflows/ci-lint.yml @@ -10,6 +10,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: lint: runs-on: ubuntu-latest diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml index e73a20f200..159a79f658 100644 --- a/.github/workflows/ci-test.yml +++ b/.github/workflows/ci-test.yml @@ -12,6 +12,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: test: strategy: diff --git a/.github/workflows/continuous-release.yml b/.github/workflows/continuous-release.yml index ed66423935..3bcc0bb0fd 100644 --- a/.github/workflows/continuous-release.yml +++ b/.github/workflows/continuous-release.yml @@ -13,6 +13,10 @@ permissions: pull-requests: write issues: write +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: false + jobs: publish: if: github.repository == 'processing/p5.js' diff --git a/.github/workflows/contributors-png.yml b/.github/workflows/contributors-png.yml index 4178a5e4a8..cd469cd733 100644 --- a/.github/workflows/contributors-png.yml +++ b/.github/workflows/contributors-png.yml @@ -8,6 +8,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: build: if: github.ref == 'refs/heads/main' && github.repository == 'processing/p5.js' diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index cc10da56c3..73c3b44036 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -5,6 +5,11 @@ on: permissions: contents: read issues: write + +concurrency: + group: ${{ github.workflow }}-${{ github.event.issue.number || github.ref }} + cancel-in-progress: false + jobs: triage: runs-on: ubuntu-latest diff --git a/.github/workflows/release-workflow-v1.yml b/.github/workflows/release-workflow-v1.yml index 5f3657ce0d..696519fae9 100644 --- a/.github/workflows/release-workflow-v1.yml +++ b/.github/workflows/release-workflow-v1.yml @@ -4,6 +4,10 @@ name: New p5.js v1 release permissions: contents: write +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + on: push: tags: diff --git a/.github/workflows/release-workflow-v2.yml b/.github/workflows/release-workflow-v2.yml index 11792aa01a..d72028e5b9 100644 --- a/.github/workflows/release-workflow-v2.yml +++ b/.github/workflows/release-workflow-v2.yml @@ -4,6 +4,10 @@ name: New p5.js 2.x release permissions: contents: write +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + on: push: tags: diff --git a/.github/workflows/stewards-update.yml b/.github/workflows/stewards-update.yml index 0058b73920..40b0d47e23 100644 --- a/.github/workflows/stewards-update.yml +++ b/.github/workflows/stewards-update.yml @@ -11,6 +11,10 @@ permissions: contents: write pull-requests: write +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: build: if: github.ref == 'refs/heads/main' && github.repository == 'processing/p5.js' From b49949c8ebdc7a6627d5ffd52e227cd990fa37e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 21 Sep 2026 17:26:40 +0300 Subject: [PATCH 3/6] Fix info[anonymous-definition] issues https://docs.zizmor.sh/audits/#anonymous-definition --- .github/workflows/auto-close-issues.yml | 1 + .github/workflows/ci-lint.yml | 1 + .github/workflows/ci-test.yml | 1 + .github/workflows/continuous-release.yml | 1 + .github/workflows/contributors-png.yml | 1 + .github/workflows/labeler.yml | 1 + .github/workflows/stewards-update.yml | 1 + 7 files changed, 7 insertions(+) diff --git a/.github/workflows/auto-close-issues.yml b/.github/workflows/auto-close-issues.yml index 938330566d..b7319b8b34 100644 --- a/.github/workflows/auto-close-issues.yml +++ b/.github/workflows/auto-close-issues.yml @@ -17,6 +17,7 @@ concurrency: jobs: close_issues: + name: Close linked issues if: github.event.pull_request.merged == true runs-on: ubuntu-latest steps: diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml index c60ccdfc6f..48add35a26 100644 --- a/.github/workflows/ci-lint.yml +++ b/.github/workflows/ci-lint.yml @@ -16,6 +16,7 @@ concurrency: jobs: lint: + name: Lint runs-on: ubuntu-latest steps: diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml index 159a79f658..ba9370305f 100644 --- a/.github/workflows/ci-test.yml +++ b/.github/workflows/ci-test.yml @@ -18,6 +18,7 @@ concurrency: jobs: test: + name: Test strategy: matrix: include: diff --git a/.github/workflows/continuous-release.yml b/.github/workflows/continuous-release.yml index 3bcc0bb0fd..9e1689c68a 100644 --- a/.github/workflows/continuous-release.yml +++ b/.github/workflows/continuous-release.yml @@ -19,6 +19,7 @@ concurrency: jobs: publish: + name: Publish if: github.repository == 'processing/p5.js' runs-on: ubuntu-latest steps: diff --git a/.github/workflows/contributors-png.yml b/.github/workflows/contributors-png.yml index cd469cd733..29422c6d03 100644 --- a/.github/workflows/contributors-png.yml +++ b/.github/workflows/contributors-png.yml @@ -14,6 +14,7 @@ concurrency: jobs: build: + name: Update contributors.png if: github.ref == 'refs/heads/main' && github.repository == 'processing/p5.js' runs-on: ubuntu-latest steps: diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 73c3b44036..d9d3be5168 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -12,6 +12,7 @@ concurrency: jobs: triage: + name: Triage issues runs-on: ubuntu-latest steps: - uses: github/issue-labeler@98b5412841f6c4b0b3d9c29d53c13fad16bd7de2 # v3.2 diff --git a/.github/workflows/stewards-update.yml b/.github/workflows/stewards-update.yml index 40b0d47e23..eebd512a48 100644 --- a/.github/workflows/stewards-update.yml +++ b/.github/workflows/stewards-update.yml @@ -17,6 +17,7 @@ concurrency: jobs: build: + name: Update steward table if: github.ref == 'refs/heads/main' && github.repository == 'processing/p5.js' runs-on: ubuntu-latest steps: From d18febc596e213177dfc37d6e3e10acb6b625a5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 21 Sep 2026 17:29:29 +0300 Subject: [PATCH 4/6] Fix error[cache-poisoning] warnings https://docs.zizmor.sh/audits/#cache-poisoning --- .github/workflows/continuous-release.yml | 1 + .github/workflows/release-workflow-v1.yml | 2 ++ .github/workflows/release-workflow-v2.yml | 2 ++ 3 files changed, 5 insertions(+) diff --git a/.github/workflows/continuous-release.yml b/.github/workflows/continuous-release.yml index 9e1689c68a..666992ce40 100644 --- a/.github/workflows/continuous-release.yml +++ b/.github/workflows/continuous-release.yml @@ -28,6 +28,7 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 + package-manager-cache: false - name: Install dependencies run: npm ci diff --git a/.github/workflows/release-workflow-v1.yml b/.github/workflows/release-workflow-v1.yml index 696519fae9..a69573b17b 100644 --- a/.github/workflows/release-workflow-v1.yml +++ b/.github/workflows/release-workflow-v1.yml @@ -28,6 +28,8 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 # Keep at 22 purposefully for v1 + package-manager-cache: false + - name: Check prerelease id: semver shell: bash diff --git a/.github/workflows/release-workflow-v2.yml b/.github/workflows/release-workflow-v2.yml index d72028e5b9..28486749d2 100644 --- a/.github/workflows/release-workflow-v2.yml +++ b/.github/workflows/release-workflow-v2.yml @@ -28,6 +28,8 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 + package-manager-cache: false + - name: Check prerelease id: semver shell: bash From 902067a3132ac4a2cc4f6b05d9c80c4c5d1ab284 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 21 Sep 2026 17:35:52 +0300 Subject: [PATCH 5/6] Disable secrets-outside-env https://docs.zizmor.sh/audits/#secrets-outside-env I'm not exactly sure about benefits of this rule and fixing the violations require changes in repo settings. Disabling for now, can be revisited later. --- .github/zizmor.yml | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000000..017ee9e4a8 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,4 @@ +rules: + # Temp disabled to satisfy CI. Can be revisited later. + secrets-outside-env: + disable: true From 4a4e6438690742114b044924324dc2df29957c88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= Date: Mon, 21 Sep 2026 17:36:49 +0300 Subject: [PATCH 6/6] Fix warning[artipacked] https://docs.zizmor.sh/audits/#artipacked --- .github/workflows/continuous-release.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/continuous-release.yml b/.github/workflows/continuous-release.yml index 666992ce40..2605010a55 100644 --- a/.github/workflows/continuous-release.yml +++ b/.github/workflows/continuous-release.yml @@ -25,6 +25,9 @@ jobs: steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22