Fix some issues pointed out by zizmor. (#362)

ansible-community · Dec 14, 2024 · 3f8a02e · 3f8a02e
1 parent 26dd1ed
commit 3f8a02e
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 0 deletions.
diff --git a/.github/workflows/antsibull-docs.yml b/.github/workflows/antsibull-docs.yml
@@ -53,41 +53,47 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: antsibull-docs
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-core
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-core
           path: antsibull-core
           ref: ${{ matrix.antsibull_core_ref }}
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-docs-parser
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-docs-parser
           path: antsibull-docs-parser
           ref: ${{ matrix.antsibull_docs_parser_ref }}
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-changelog
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-changelog
           path: antsibull-changelog
           ref: ${{ matrix.antsibull_changelog_ref }}
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-docutils
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-docutils
           path: antsibull-docutils
           ref: ${{ matrix.antsibull_docutils_ref }}
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-fileutils
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-fileutils
           path: antsibull-fileutils
           ref: ${{ matrix.antsibull_fileutils_ref }}
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python }}
         uses: actions/setup-python@v5
@@ -184,36 +190,42 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: antsibull-docs
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-core
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-core
           path: antsibull-core
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-docs-parser
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-docs-parser
           path: antsibull-docs-parser
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-changelog
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-changelog
           path: antsibull-changelog
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-docutils
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-docutils
           path: antsibull-docutils
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-fileutils
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-fileutils
           path: antsibull-fileutils
+          persist-credentials: false
 
       - name: Set up Python 3.13
         uses: actions/setup-python@v5
@@ -263,36 +275,42 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: antsibull-docs
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-core
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-core
           path: antsibull-core
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-docs-parser
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-docs-parser
           path: antsibull-docs-parser
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-changelog
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-changelog
           path: antsibull-changelog
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-docutils
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-docutils
           path: antsibull-docutils
+          persist-credentials: false
 
       - name: Check out dependent project antsibull-fileutils
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-fileutils
           path: antsibull-fileutils
+          persist-credentials: false
 
       - name: Set up Python 3.13
         uses: actions/setup-python@v5

diff --git a/.github/workflows/build-css.yml b/.github/workflows/build-css.yml
@@ -26,6 +26,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Use Node.js
         uses: actions/setup-node@v4

diff --git a/.github/workflows/nox.yml b/.github/workflows/nox.yml
@@ -48,31 +48,37 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: antsibull-docs
+          persist-credentials: false
       - name: Check out dependent project antsibull-core
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-core
           path: antsibull-core
+          persist-credentials: false
       - name: Check out dependent project antsibull-docs-parser
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-docs-parser
           path: antsibull-docs-parser
+          persist-credentials: false
       - name: Check out dependent project antsibull-changelog
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-changelog
           path: antsibull-changelog
+          persist-credentials: false
       - name: Check out dependent project antsibull-docutils
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-docutils
           path: antsibull-docutils
+          persist-credentials: false
       - name: Check out dependent project antsibull-fileutils
         uses: actions/checkout@v4
         with:
           repository: ansible-community/antsibull-fileutils
           path: antsibull-fileutils
+          persist-credentials: false
       - name: Install extra packages
         if: "matrix.packages != ''"
         run: |