From d1d3fc9c843e194602e300c8dd098846689748bc Mon Sep 17 00:00:00 2001 From: Saul Beck Date: Tue, 18 Aug 2026 09:46:20 +0100 Subject: [PATCH 1/2] CI: Address zizmor warnings and bump deps --- .github/workflows/nifi_migrate_pr.yaml | 14 ++++++++++---- .github/workflows/nifi_migrate_release.yaml | 18 +++++++++++++----- .github/workflows/pre_commit.yaml | 8 ++++++-- 3 files changed, 29 insertions(+), 11 deletions(-) diff --git a/.github/workflows/nifi_migrate_pr.yaml b/.github/workflows/nifi_migrate_pr.yaml index fcab4fc..fdce254 100644 --- a/.github/workflows/nifi_migrate_pr.yaml +++ b/.github/workflows/nifi_migrate_pr.yaml @@ -14,11 +14,15 @@ on: env: RUST_VERSION: 1.87.0 +permissions: {} + jobs: # This job is always run to ensure we don't miss any new upstream advisories cargo-deny: name: Run cargo-deny runs-on: ubuntu-latest + permissions: + contents: read # Prevent sudden announcement of a new advisory from failing CI continue-on-error: ${{ matrix.checks == 'advisories' }} strategy: @@ -28,12 +32,12 @@ jobs: - bans licenses sources steps: - name: Checkout Repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run cargo-deny - uses: EmbarkStudios/cargo-deny-action@f2ba7abc2abebaf185c833c3961145a3c275caad # v2.0.13 + uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 with: command: check ${{ matrix.checks }} @@ -41,6 +45,8 @@ jobs: name: Build nifi-migrate needs: - cargo-deny + permissions: + contents: read strategy: fail-fast: false matrix: @@ -52,11 +58,11 @@ jobs: runs-on: ${{ matrix.targets.os }} steps: - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 with: toolchain: ${{ env.RUST_VERSION }} targets: ${{ matrix.targets.target }} diff --git a/.github/workflows/nifi_migrate_release.yaml b/.github/workflows/nifi_migrate_release.yaml index 1032cb3..5392485 100644 --- a/.github/workflows/nifi_migrate_release.yaml +++ b/.github/workflows/nifi_migrate_release.yaml @@ -11,13 +11,17 @@ on: env: RUST_VERSION: 1.87.0 +permissions: {} + jobs: create-release: name: Create Draft Release runs-on: ubuntu-latest + permissions: + contents: write # required to create the draft release steps: - name: Create Draft Release - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: draft: true @@ -25,6 +29,8 @@ jobs: name: Build nifi-migrate needs: - create-release + permissions: + contents: write # required to upload release assets strategy: fail-fast: false matrix: @@ -36,11 +42,11 @@ jobs: runs-on: ${{ matrix.targets.os }} steps: - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 + - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1 with: toolchain: ${{ env.RUST_VERSION }} targets: ${{ matrix.targets.target }} @@ -57,7 +63,7 @@ jobs: run: mv target/${{ matrix.targets.target }}/release/nifi-migrate.exe nifi-migrate-${{ matrix.targets.target }}.exe - name: Upload Artifact to Release - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: draft: true files: nifi-migrate-${{ matrix.targets.target }}${{ runner.os == 'Windows' && '.exe' || '' }} @@ -67,8 +73,10 @@ jobs: needs: - build runs-on: ubuntu-latest + permissions: + contents: write # required to publish the release steps: - name: Publish Release - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: draft: false diff --git a/.github/workflows/pre_commit.yaml b/.github/workflows/pre_commit.yaml index f63c36f..c4c9f9e 100644 --- a/.github/workflows/pre_commit.yaml +++ b/.github/workflows/pre_commit.yaml @@ -9,14 +9,18 @@ on: env: RUST_TOOLCHAIN_VERSION: "1.87.0" +permissions: {} + jobs: pre-commit: runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 - - uses: stackabletech/actions/run-pre-commit@9a70678a34ec4e4f6927d0f8842b74aa857a9577 # v0.10.2 + - uses: stackabletech/actions/run-pre-commit@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5 with: rust: ${{ env.RUST_TOOLCHAIN_VERSION }} From ae9c13732da44b437480ac797430aa4fd8da87b6 Mon Sep 17 00:00:00 2001 From: Saul Beck Date: Thu, 27 Aug 2026 09:24:26 +0100 Subject: [PATCH 2/2] Bump anyhow due to advisory --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index baf78d3..95badbd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -54,9 +54,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.100" +version = "1.0.104" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61" +checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470" [[package]] name = "clap"