From c295488abb94b05309ab6f1432dd1922b8fbff75 Mon Sep 17 00:00:00 2001 From: Jeff Huleatt <3759507+jhuleatt@users.noreply.github.com> Date: Tue, 7 Jul 2026 14:12:21 +0000 Subject: [PATCH 1/3] address zizmor checks --- .github/workflows/codeql-analysis.yml | 14 ++++-- .github/workflows/test.yml | 67 ++++++++++++++++++--------- 2 files changed, 55 insertions(+), 26 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index a1fbcb71c..3d43b20ad 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -24,6 +24,10 @@ jobs: analyze: name: Analyze runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write strategy: fail-fast: false @@ -35,11 +39,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -50,7 +56,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -64,4 +70,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a358b229f..ecbcaeaa1 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -15,31 +15,39 @@ on: schedule: - cron: 0 0 * * 1-5 +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest name: Build steps: - name: Checkout - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Setup node - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 + uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 with: node-version: '20' check-latest: false + package-manager-cache: false - name: angular build cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: ./.angular key: angular-cache + lookup-only: true - name: node_modules cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 id: node_modules_cache with: path: ./node_modules key: ${{ runner.os }}-20-${{ hashFiles('package-lock.json') }} restore-keys: | ${{ runner.os }}-20- + lookup-only: true - name: Install deps if: steps.node_modules_cache.outputs.cache-hit != 'true' run: | @@ -47,7 +55,7 @@ jobs: - name: Build run: ./tools/build.sh - name: 'Upload Artifact' - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: angularfire-${{ github.run_id }} path: dist @@ -64,25 +72,29 @@ jobs: name: Test Node ${{ matrix.node }} (${{ matrix.os }}) steps: - name: Checkout - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Setup node - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 + uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 with: node-version: ${{ matrix.node }} check-latest: true + package-manager-cache: false - name: node_modules cache id: node_modules_cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: ./node_modules key: ${{ runner.os }}-${{ matrix.node }}-${{ hashFiles('package-lock.json') }} restore-keys: | ${{ runner.os }}-${{ matrix.node }}- + lookup-only: true - name: Install deps if: steps.node_modules_cache.outputs.cache-hit != 'true' run: npm ci - name: Download Artifacts - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 with: name: angularfire-${{ github.run_id }} path: dist @@ -106,35 +118,40 @@ jobs: fail-fast: false steps: - name: Checkout - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Setup node - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 + uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 with: node-version: 20 check-latest: false + package-manager-cache: false - name: Setup java - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: distribution: 'temurin' java-version: '21' - name: node_modules cache id: node_modules_cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: ./node_modules key: ${{ runner.os }}-${{ matrix.node }}-${{ hashFiles('package-lock.json') }} restore-keys: | ${{ runner.os }}-${{ matrix.node }}- + lookup-only: true - name: Install deps if: steps.node_modules_cache.outputs.cache-hit != 'true' run: npm ci - name: Firebase emulator cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: ~/.cache/firebase/emulators key: firebase_emulators + lookup-only: true - name: Download Artifacts - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 with: name: angularfire-${{ github.run_id }} path: dist @@ -151,20 +168,24 @@ jobs: fail-fast: false steps: - name: Checkout - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Setup node - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 + uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 with: node-version: ${{ matrix.node }} check-latest: true + package-manager-cache: false - name: node_modules cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 id: node_modules_cache with: path: ./node_modules key: ${{ runner.os }}-${{ matrix.node }}-${{ hashFiles('package-lock.json') }} restore-keys: | ${{ runner.os }}-${{ matrix.node }}- + lookup-only: true - name: Install deps if: steps.node_modules_cache.outputs.cache-hit != 'true' run: npm ci @@ -177,12 +198,13 @@ jobs: npm run build:jasmine npm run test:node - name: Firebase emulator cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 + uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: ~/.cache/firebase/emulators key: firebase_emulators + lookup-only: true - name: Setup java - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: distribution: 'temurin' java-version: '21' @@ -206,13 +228,14 @@ jobs: if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'release' }} steps: - name: Setup node - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 + uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 with: node-version: '20' registry-url: 'https://registry.npmjs.org' check-latest: false + package-manager-cache: false - name: 'Download Artifacts' - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 with: name: angularfire-${{ github.run_id }} path: dist From 1700bab9d3d3e986cb0e7fd91643236c78e65a6f Mon Sep 17 00:00:00 2001 From: Jeff Huleatt <3759507+jhuleatt@users.noreply.github.com> Date: Tue, 7 Jul 2026 14:40:22 +0000 Subject: [PATCH 2/3] remove caching TAG=agy CONV=fb008099-c1ce-4ef0-a723-561dde93aeff --- .github/workflows/test.yml | 66 +------------------------------------- 1 file changed, 1 insertion(+), 65 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ecbcaeaa1..284f715e8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -32,26 +32,8 @@ jobs: with: node-version: '20' check-latest: false - package-manager-cache: false - - name: angular build cache - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 - with: - path: ./.angular - key: angular-cache - lookup-only: true - - name: node_modules cache - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 - id: node_modules_cache - with: - path: ./node_modules - key: ${{ runner.os }}-20-${{ hashFiles('package-lock.json') }} - restore-keys: | - ${{ runner.os }}-20- - lookup-only: true - name: Install deps - if: steps.node_modules_cache.outputs.cache-hit != 'true' - run: | - npm ci + run: npm ci - name: Build run: ./tools/build.sh - name: 'Upload Artifact' @@ -80,18 +62,7 @@ jobs: with: node-version: ${{ matrix.node }} check-latest: true - package-manager-cache: false - - name: node_modules cache - id: node_modules_cache - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 - with: - path: ./node_modules - key: ${{ runner.os }}-${{ matrix.node }}-${{ hashFiles('package-lock.json') }} - restore-keys: | - ${{ runner.os }}-${{ matrix.node }}- - lookup-only: true - name: Install deps - if: steps.node_modules_cache.outputs.cache-hit != 'true' run: npm ci - name: Download Artifacts uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 @@ -126,30 +97,13 @@ jobs: with: node-version: 20 check-latest: false - package-manager-cache: false - name: Setup java uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: distribution: 'temurin' java-version: '21' - - name: node_modules cache - id: node_modules_cache - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 - with: - path: ./node_modules - key: ${{ runner.os }}-${{ matrix.node }}-${{ hashFiles('package-lock.json') }} - restore-keys: | - ${{ runner.os }}-${{ matrix.node }}- - lookup-only: true - name: Install deps - if: steps.node_modules_cache.outputs.cache-hit != 'true' run: npm ci - - name: Firebase emulator cache - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 - with: - path: ~/.cache/firebase/emulators - key: firebase_emulators - lookup-only: true - name: Download Artifacts uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 with: @@ -176,18 +130,7 @@ jobs: with: node-version: ${{ matrix.node }} check-latest: true - package-manager-cache: false - - name: node_modules cache - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 - id: node_modules_cache - with: - path: ./node_modules - key: ${{ runner.os }}-${{ matrix.node }}-${{ hashFiles('package-lock.json') }} - restore-keys: | - ${{ runner.os }}-${{ matrix.node }}- - lookup-only: true - name: Install deps - if: steps.node_modules_cache.outputs.cache-hit != 'true' run: npm ci #- name: Lint # run: npm run lint @@ -197,12 +140,6 @@ jobs: run: | npm run build:jasmine npm run test:node - - name: Firebase emulator cache - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 - with: - path: ~/.cache/firebase/emulators - key: firebase_emulators - lookup-only: true - name: Setup java uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: @@ -233,7 +170,6 @@ jobs: node-version: '20' registry-url: 'https://registry.npmjs.org' check-latest: false - package-manager-cache: false - name: 'Download Artifacts' uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 with: From d79ba23057e3636d5b9df52974fab315431808ee Mon Sep 17 00:00:00 2001 From: Jeff Huleatt <3759507+jhuleatt@users.noreply.github.com> Date: Tue, 7 Jul 2026 18:57:52 +0000 Subject: [PATCH 3/3] fix SHAs and versions --- .github/workflows/codeql-analysis.yml | 8 +++---- .github/workflows/test.yml | 30 +++++++++++++-------------- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 3d43b20ad..575a25a3f 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -39,13 +39,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5 + uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -56,7 +56,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5 + uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -70,4 +70,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5 + uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 284f715e8..f92254ca3 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -24,11 +24,11 @@ jobs: name: Build steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Setup node - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' check-latest: false @@ -37,7 +37,7 @@ jobs: - name: Build run: ./tools/build.sh - name: 'Upload Artifact' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: angularfire-${{ github.run_id }} path: dist @@ -54,18 +54,18 @@ jobs: name: Test Node ${{ matrix.node }} (${{ matrix.os }}) steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Setup node - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node }} check-latest: true - name: Install deps run: npm ci - name: Download Artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: angularfire-${{ github.run_id }} path: dist @@ -89,23 +89,23 @@ jobs: fail-fast: false steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Setup node - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 20 check-latest: false - name: Setup java - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 with: distribution: 'temurin' java-version: '21' - name: Install deps run: npm ci - name: Download Artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: angularfire-${{ github.run_id }} path: dist @@ -122,11 +122,11 @@ jobs: fail-fast: false steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Setup node - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node }} check-latest: true @@ -141,7 +141,7 @@ jobs: npm run build:jasmine npm run test:node - name: Setup java - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 with: distribution: 'temurin' java-version: '21' @@ -165,13 +165,13 @@ jobs: if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'release' }} steps: - name: Setup node - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '20' registry-url: 'https://registry.npmjs.org' check-latest: false - name: 'Download Artifacts' - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: angularfire-${{ github.run_id }} path: dist