Skip to content

Commit f509dcf

Browse files
eXpl0it3reXpl0it3r
committed
Harden our GitHub Actions workflows
1 parent 03f4d30 commit f509dcf

3 files changed

Lines changed: 35 additions & 1 deletion

File tree

‎.github/workflows/ci.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ name: CI
22

33
on: [push, pull_request, workflow_dispatch]
44

5+
permissions: {}
6+
57
concurrency:
68
group: environment-${{github.ref}}
79
cancel-in-progress: true
@@ -50,6 +52,7 @@ jobs:
5052
- name: Checkout SFML
5153
uses: actions/checkout@v7
5254
with:
55+
persist-credentials: false
5356
repository: SFML/SFML
5457
ref: ${{env.SFML_VERSION}}
5558
path: SFML
@@ -68,6 +71,7 @@ jobs:
6871
- name: Checkout CSFML
6972
uses: actions/checkout@v7
7073
with:
74+
persist-credentials: false
7175
path: CSFML
7276

7377
- name: Configure CSFML CMake
@@ -97,6 +101,8 @@ jobs:
97101

98102
- name: Checkout Code
99103
uses: actions/checkout@v7
104+
with:
105+
persist-credentials: false
100106

101107
- name: Format Code
102108
run: cmake -DCLANG_FORMAT_EXECUTABLE=clang-format-17 -P cmake/Format.cmake
@@ -124,6 +130,7 @@ jobs:
124130
- name: Checkout SFML
125131
uses: actions/checkout@v7
126132
with:
133+
persist-credentials: false
127134
repository: SFML/SFML
128135
ref: ${{env.SFML_VERSION}}
129136
path: SFML
@@ -137,6 +144,7 @@ jobs:
137144
- name: Checkout CSFML
138145
uses: actions/checkout@v7
139146
with:
147+
persist-credentials: false
140148
path: CSFML
141149

142150
- name: Configure CSFML CMake
@@ -164,6 +172,7 @@ jobs:
164172
- name: Checkout SFML
165173
uses: actions/checkout@v7
166174
with:
175+
persist-credentials: false
167176
repository: SFML/SFML
168177
ref: ${{env.SFML_VERSION}}
169178
path: SFML
@@ -177,6 +186,7 @@ jobs:
177186
- name: Checkout CSFML
178187
uses: actions/checkout@v7
179188
with:
189+
persist-credentials: false
180190
path: CSFML
181191

182192
- name: Configure CSFML

‎.github/workflows/nuget.yml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ on:
99
- "**"
1010
workflow_dispatch: {}
1111

12+
permissions: {}
13+
1214
concurrency:
1315
group: nuget-${{github.ref}}
1416
cancel-in-progress: true
@@ -25,6 +27,7 @@ jobs:
2527
- name: Checkout CSFML
2628
uses: actions/checkout@v7
2729
with:
30+
persist-credentials: false
2831
path: CSFML
2932

3033
- name: Build x86
@@ -53,6 +56,7 @@ jobs:
5356
- name: Checkout CSFML
5457
uses: actions/checkout@v7
5558
with:
59+
persist-credentials: false
5660
path: CSFML
5761

5862
- name: Build ARM64
@@ -77,6 +81,7 @@ jobs:
7781
- name: Checkout CSFML
7882
uses: actions/checkout@v7
7983
with:
84+
persist-credentials: false
8085
path: CSFML
8186

8287
- name: Build
@@ -100,6 +105,7 @@ jobs:
100105
- name: Checkout CSFML
101106
uses: actions/checkout@v7
102107
with:
108+
persist-credentials: false
103109
path: CSFML
104110

105111
- name: Install dependencies & cross compiler
@@ -129,6 +135,7 @@ jobs:
129135
- name: Checkout CSFML
130136
uses: actions/checkout@v7
131137
with:
138+
persist-credentials: false
132139
path: CSFML
133140

134141
- name: Install dependencies
@@ -159,6 +166,7 @@ jobs:
159166
- name: Checkout CSFML
160167
uses: actions/checkout@v7
161168
with:
169+
persist-credentials: false
162170
path: CSFML
163171

164172
- name: Build
@@ -182,6 +190,7 @@ jobs:
182190
- name: Checkout CSFML
183191
uses: actions/checkout@v7
184192
with:
193+
persist-credentials: false
185194
path: CSFML
186195

187196
- name: Install necessary tooling
@@ -218,6 +227,7 @@ jobs:
218227
- name: Checkout CSFML
219228
uses: actions/checkout@v7
220229
with:
230+
persist-credentials: false
221231
path: CSFML
222232
- name: Download Artifacts
223233
uses: actions/download-artifact@v8
@@ -230,7 +240,9 @@ jobs:
230240
with:
231241
dotnet-version: 10.0.x
232242
- name: Enforce SDK Version
233-
run: dotnet new globaljson --sdk-version ${{ steps.setup-dotnet.outputs.dotnet-version }} --force
243+
env:
244+
DOTNET_VERSION: ${{ steps.setup-dotnet.outputs.dotnet-version }}
245+
run: dotnet new globaljson --sdk-version "$DOTNET_VERSION" --force
234246
- name: Verify SDK Installation
235247
run: dotnet --info
236248
- name: Build NuGet Package

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ on:
99
- "**"
1010
workflow_dispatch: {}
1111

12+
permissions: {}
13+
1214
concurrency:
1315
group: release-${{github.ref}}
1416
cancel-in-progress: true
@@ -43,13 +45,15 @@ jobs:
4345
- name: Checkout SFML
4446
uses: actions/checkout@v7
4547
with:
48+
persist-credentials: false
4649
repository: SFML/SFML
4750
ref: ${{ env.SFML_VERSION }}
4851
path: SFML
4952

5053
- name: Checkout CSFML
5154
uses: actions/checkout@v7
5255
with:
56+
persist-credentials: false
5357
path: CSFML
5458

5559
- name: Build SFML
@@ -130,13 +134,15 @@ jobs:
130134
- name: Checkout SFML
131135
uses: actions/checkout@v7
132136
with:
137+
persist-credentials: false
133138
repository: SFML/SFML
134139
ref: ${{ env.SFML_VERSION }}
135140
path: SFML
136141

137142
- name: Checkout CSFML
138143
uses: actions/checkout@v7
139144
with:
145+
persist-credentials: false
140146
path: CSFML
141147

142148
- name: Build SFML
@@ -199,13 +205,15 @@ jobs:
199205
- name: Checkout SFML
200206
uses: actions/checkout@v7
201207
with:
208+
persist-credentials: false
202209
repository: SFML/SFML
203210
ref: ${{ env.SFML_VERSION }}
204211
path: SFML
205212

206213
- name: Checkout CSFML
207214
uses: actions/checkout@v7
208215
with:
216+
persist-credentials: false
209217
path: CSFML
210218

211219
- name: Build SFML
@@ -238,13 +246,15 @@ jobs:
238246
- name: Checkout SFML
239247
uses: actions/checkout@v7
240248
with:
249+
persist-credentials: false
241250
repository: SFML/SFML
242251
ref: ${{ env.SFML_VERSION }}
243252
path: SFML
244253

245254
- name: Checkout CSFML
246255
uses: actions/checkout@v7
247256
with:
257+
persist-credentials: false
248258
path: CSFML
249259

250260
- name: Build SFML
@@ -301,13 +311,15 @@ jobs:
301311
- name: Checkout SFML
302312
uses: actions/checkout@v7
303313
with:
314+
persist-credentials: false
304315
repository: SFML/SFML
305316
ref: ${{ env.SFML_VERSION }}
306317
path: SFML
307318

308319
- name: Checkout CSFML
309320
uses: actions/checkout@v7
310321
with:
322+
persist-credentials: false
311323
path: CSFML
312324
- name: Build SFML
313325
run: |

0 commit comments

Comments
 (0)