workflows/actionlint: run zizmor

Port of Homebrew/homebrew-core#195961. See https://github.com/woodruffw/zizmor.
Homebrew · Oct 30, 2024 · cd2757b · cd2757b
1 parent 0e24ee2
commit cd2757b
Showing 1 changed file with 28 additions and 10 deletions.
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
@@ -29,27 +29,45 @@ concurrency:
 jobs:
   workflow_syntax:
     if: github.repository_owner == 'Homebrew'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/homebrew/ubuntu22.04:master
     steps:
       - name: Set up Homebrew
         id: setup-homebrew
         uses: Homebrew/actions/setup-homebrew@master
         with:
-          core: false
+          core: true
           cask: false
           test-bot: false
 
-      - name: Set up actionlint
+      - name: Install tools
+        run: brew install actionlint shellcheck zizmor
+
+      - name: Set up GITHUB_WORKSPACE
         env:
-          HOMEBREW_REPOSITORY: ${{ steps.setup-homebrew.outputs.repository-path }}
+          HOMEBREW_TAP_REPOSITORY: ${{ steps.setup-homebrew.outputs.repository-path }}
         run: |
-          brew install actionlint shellcheck
-
           # Annotations work only relative to GITHUB_WORKSPACE
-          (shopt -s dotglob; rm -rf "${GITHUB_WORKSPACE:?}"/*; mv "${HOMEBREW_REPOSITORY:?}"/* "$GITHUB_WORKSPACE")
-          rmdir "$HOMEBREW_REPOSITORY"
-          ln -vs "$GITHUB_WORKSPACE" "$HOMEBREW_REPOSITORY"
+          (shopt -s dotglob; rm -rf "${GITHUB_WORKSPACE:?}"/*; mv "${HOMEBREW_TAP_REPOSITORY:?}"/* "$GITHUB_WORKSPACE")
+          rmdir "$HOMEBREW_TAP_REPOSITORY"
+          ln -vs "$GITHUB_WORKSPACE" "$HOMEBREW_TAP_REPOSITORY"
+
+      - run: zizmor --format sarif . >results.sarif
 
-          echo "::add-matcher::.github/actionlint-matcher.json"
+      - name: Set up actionlint
+        run: |
+          # Setting `shell: /bin/bash` prevents shellcheck from running on
+          # those steps, so let's change them to `shell: bash` for linting.
+          sed -i 's|shell: /bin/bash -x|shell: bash -x|' .github/workflows/*.y*ml
+          # The JSON matcher needs to be accessible to the container host.
+          cp "$(brew --repository)/.github/actionlint-matcher.json" "$HOME"
+          echo "::add-matcher::$HOME/actionlint-matcher.json"
 
       - run: actionlint
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor