Skip to content

Commit f0c3711

Browse files
EmmanuelBerkowiczEmmanuelBerkowicz
authored
Merge branch 'zizmorcore:main' into main
2 parents e3bdefb + d47ec59 commit f0c3711

File tree

75 files changed

+3424
-277
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+3424
-277
lines changed

‎.github/ISSUE_TEMPLATE/bug-report.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ body:
1010
value: |
1111
Thank you for taking the time to fill out this bug report!
1212
13-
Please read the following parts of this template carefully.
13+
Please read the following parts of this template **very carefully**.
1414
Invalid or incomplete submissions take longer to triage,
1515
and may be given a lower priority or closed outright
1616
if not actionable.
@@ -27,9 +27,10 @@ body:
2727
the feature request form instead.
2828
required: true
2929
- label: >-
30-
I have looked through the
31-
[open issues](https://github.com/zizmorcore/zizmor/issues?q=is%3Aissue+is%3Aopen+)
32-
for a duplicate report.
30+
I have looked through both the
31+
[open](https://github.com/zizmorcore/zizmor/issues?q=is%3Aissue+is%3Aopen+)
32+
and [closed](https://github.com/zizmorcore/zizmor/issues?q=is%3Aissue%20state%3Aclosed)
33+
issues for a duplicate report.
3334
required: true
3435
3536
- type: input

‎.github/ISSUE_TEMPLATE/feature-request.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ body:
1010
value: |
1111
Thanks for making a `zizmor` feature request!
1212
13-
Please read the following parts of this form carefully.
13+
Please read the following parts of this form **very carefully**.
1414
Invalid or incomplete submissions take longer to triage,
1515
and may be given a lower priority or closed outright
1616
if not actionable.
@@ -26,7 +26,10 @@ body:
2626
These must be filed via the bug report template.
2727
required: true
2828
- label: >-
29-
I have looked through the open issues for a duplicate request.
29+
I have looked through both the
30+
[open](https://github.com/zizmorcore/zizmor/issues?q=is%3Aissue+is%3Aopen+)
31+
and [closed](https://github.com/zizmorcore/zizmor/issues?q=is%3Aissue%20state%3Aclosed)
32+
issues for a duplicate request.
3033
required: true
3134
3235
- type: textarea

‎.github/workflows/benchmark-base.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# benchmark-base.yml: submit benchmarks to Bencher.
2+
#
3+
# This workflow provides baseline results, via the main branch.
4+
5+
name: Benchmark baseline
6+
7+
on:
8+
push:
9+
branches: [main]
10+
11+
permissions: {}
12+
13+
jobs:
14+
benchmark_base_branch:
15+
name: Continuous Benchmarking with Bencher
16+
runs-on: ubuntu-latest
17+
18+
permissions:
19+
checks: write
20+
21+
environment:
22+
name: bencher
23+
url: https://bencher.dev/console/projects/zizmor
24+
25+
steps:
26+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
with:
28+
persist-credentials: false
29+
30+
- name: Set up Bencher
31+
uses: bencherdev/bencher@f89d454e74a32a81b2eab29fe0afdb2316617342 # v0.5.3
32+
33+
- name: Installer hyperfine
34+
run: |
35+
sudo apt-get remove --purge man-db
36+
sudo apt install -y hyperfine
37+
38+
- uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
39+
40+
- uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
41+
42+
# TODO: use actions/cache to cache the plan phase here.
43+
- name: Run benchmarks
44+
run: make bench
45+
46+
- name: Upload benchmark results
47+
# Take each result file in bench/results/*.json and use
48+
# `bencher run` to upload it.
49+
run: |
50+
for file in bench/results/*.json; do
51+
bencher run \
52+
--project zizmor \
53+
--token "${BENCHER_API_TOKEN}" \
54+
--branch main \
55+
--testbed ubuntu-latest \
56+
--err \
57+
--adapter shell_hyperfine \
58+
--github-actions "${GITHUB_TOKEN}" \
59+
--file "${file}"
60+
done
61+
env:
62+
BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
63+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/benchmark-pr-1p.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# benchmark-pr-1p.yml: submit benchmarks to Bencher.
2+
#
3+
# This workflow covers "first party" pull requests specifically,
4+
# i.e. those created from branches within the same repository.
5+
6+
name: Benchmark PRs (first-party)
7+
8+
on:
9+
pull_request:
10+
types: [opened, reopened, edited, synchronize]
11+
12+
permissions: {}
13+
14+
concurrency:
15+
group: "benchmark-pr-1p-${{ github.event.pull_request.number }}"
16+
cancel-in-progress: true
17+
18+
jobs:
19+
benchmark-pr-1p:
20+
name: Continuous Benchmarking PRs with Bencher
21+
runs-on: ubuntu-latest
22+
if: >-
23+
${{
24+
github.event_name == 'pull_request'
25+
&& github.event.pull_request.head.repo.full_name == github.repository
26+
&& !contains(github.event.pull_request.labels.*.name, 'no-benchmark')
27+
}}
28+
29+
permissions:
30+
pull-requests: write
31+
32+
environment:
33+
name: bencher
34+
url: https://bencher.dev/console/projects/zizmor
35+
36+
steps:
37+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
38+
with:
39+
persist-credentials: false
40+
41+
- name: Set up Bencher
42+
uses: bencherdev/bencher@f89d454e74a32a81b2eab29fe0afdb2316617342 # v0.5.3
43+
44+
- name: Installer hyperfine
45+
run: |
46+
sudo apt-get remove --purge man-db
47+
sudo apt install -y hyperfine
48+
49+
- uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
50+
51+
- uses: astral-sh/setup-uv@7edac99f961f18b581bbd960d59d049f04c0002f # v6.4.1
52+
53+
# TODO: use actions/cache to cache the plan phase here.
54+
- name: Run benchmarks
55+
run: make bench
56+
57+
- name: Upload benchmark results
58+
# Take each result file in bench/results/*.json and use
59+
# `bencher run` to upload it.
60+
run: |
61+
for file in bench/results/*.json; do
62+
bencher run \
63+
--project zizmor \
64+
--token "${BENCHER_API_TOKEN}" \
65+
--branch "${GITHUB_HEAD_REF}" \
66+
--start-point "${GITHUB_BASE_REF}" \
67+
--start-point-hash "${PULL_REQUEST_BASE_SHA}" \
68+
--start-point-clone-thresholds \
69+
--start-point-reset \
70+
--testbed ubuntu-latest \
71+
--err \
72+
--adapter shell_hyperfine \
73+
--github-actions "${GITHUB_TOKEN}" \
74+
--file "${file}"
75+
done
76+
env:
77+
BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
78+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
79+
PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}

‎.github/workflows/release-binaries.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ jobs:
3535
- name: Rust toolchain and target information
3636
run: |
3737
rustup show
38+
shell: bash
3839

3940
- name: Install Rust target for ${{ matrix.target }}
4041
run: rustup target add "${TARGET}"

‎.github/workflows/release-docker.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ on:
44
workflow_dispatch:
55
inputs:
66
version:
7-
description: 'The version of zizmor to build against'
7+
description: "The version of zizmor to build against"
88
required: true
99

1010
latest:
11-
description: 'Whether to tag the image as latest'
11+
description: "Whether to tag the image as latest"
1212
required: false
1313
default: true
1414
type: boolean
@@ -83,6 +83,7 @@ jobs:
8383
touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
8484
env:
8585
DIGEST: ${{ steps.build.outputs.digest }}
86+
shell: bash
8687

8788
- name: Upload digest
8889
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

‎Makefile‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,8 @@ crates/zizmor/data/codeql-injection-sinks.json: support/codeql-injection-sinks.p
4444
.PHONY: pinact
4545
pinact:
4646
pinact run --update --verify
47+
48+
49+
.PHONY: bench
50+
bench:
51+
uv run bench/benchmark.py

‎README.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,13 +84,18 @@ Trail of Bits
8484
Tenki Cloud
8585
</a>
8686
</td>
87+
<td align="center" valign="top">
88+
<a href="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/ariccio">
89+
Alexander Riccio
90+
</a>
91+
</td>
8792
</tr>
8893
</tbody>
8994
</table>
9095
<!-- @@end-sponsors@@ -->
9196

92-
Is your name missing above? Consider becoming one of our sponsors through
93-
one of the following:
97+
Want to see your name or logo above? Consider becoming a sponsor
98+
through one of the following:
9499

95100
- [GitHub Sponsors](https://github.com/sponsors/woodruffw) (preferred)
96101
- [thanks.dev](https://thanks.dev/u/gh/woodruffw)

‎bench/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
results/

0 commit comments

Comments
 (0)