Skip to content

Commit 04299fc

Browse files
githubnemogithubnemo
authored
Add zizmor for CI (security) linting (huggingface#2288)
To add a bit of a safety net to our CI jobs it might make sense to add a CI security linting tool such as zizmor. The linting run should be green at the moment since I fixed all reported issues: - setting persist-credentials: false in all checkout runs - changing template substitutions to environment variable substitutions I added an ignore rule for dangerous-triggers to ignore the upload_pr_to_documentation workflow as our actions are configured to only run such steps on approval which should already have seen at least maintainer eyes and the zizmor run.
1 parent 201db68 commit 04299fc

13 files changed

+76
-8
lines changed

‎.github/workflows/build_docker_images.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ jobs:
2323
uses: docker/setup-buildx-action@v1
2424
- name: Check out code
2525
uses: actions/checkout@v3
26+
with:
27+
persist-credentials: false
2628
- name: Login to DockerHub
2729
uses: docker/login-action@v2
2830
with:
@@ -54,6 +56,8 @@ jobs:
5456
uses: docker/setup-buildx-action@v1
5557
- name: Check out code
5658
uses: actions/checkout@v3
59+
with:
60+
persist-credentials: false
5761
- name: Login to DockerHub
5862
uses: docker/login-action@v1
5963
with:
@@ -85,6 +89,8 @@ jobs:
8589
uses: docker/setup-buildx-action@v1
8690
- name: Check out code
8791
uses: actions/checkout@v3
92+
with:
93+
persist-credentials: false
8894
- name: Login to DockerHub
8995
uses: docker/login-action@v1
9096
with:
@@ -116,6 +122,8 @@ jobs:
116122
uses: docker/setup-buildx-action@v1
117123
- name: Check out code
118124
uses: actions/checkout@v3
125+
with:
126+
persist-credentials: false
119127
- name: Login to DockerHub
120128
uses: docker/login-action@v1
121129
with:
@@ -147,6 +155,8 @@ jobs:
147155
uses: docker/setup-buildx-action@v1
148156
- name: Check out code
149157
uses: actions/checkout@v3
158+
with:
159+
persist-credentials: false
150160
- name: Login to DockerHub
151161
uses: docker/login-action@v1
152162
with:

‎.github/workflows/integrations_tests.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ jobs:
1919
with:
2020
ref: ${{ github.event.inputs.branch }}
2121
repository: ${{ github.event.pull_request.head.repo.full_name }}
22+
persist-credentials: false
2223
- name: Set up Python
2324
uses: actions/setup-python@v4
2425
with:
@@ -27,8 +28,8 @@ jobs:
2728
cache-dependency-path: "setup.py"
2829
- name: print environment variables
2930
run: |
30-
echo "env.CI_BRANCH = ${{ env.CI_BRANCH }}"
31-
echo "env.CI_SHA = ${{ env.CI_SHA }}"
31+
echo "env.CI_BRANCH = ${CI_BRANCH}"
32+
echo "env.CI_SHA = ${CI_SHA}"
3233
- name: Install dependencies
3334
run: |
3435
python -m pip install --upgrade pip
@@ -55,6 +56,7 @@ jobs:
5556
with:
5657
ref: ${{ github.event.inputs.branch }}
5758
repository: ${{ github.event.pull_request.head.repo.full_name }}
59+
persist-credentials: false
5860
- name: Set up Python
5961
uses: actions/setup-python@v4
6062
with:
@@ -63,13 +65,13 @@ jobs:
6365
cache-dependency-path: "setup.py"
6466
- name: print environment variables
6567
run: |
66-
echo "env.CI_BRANCH = ${{ env.CI_BRANCH }}"
67-
echo "env.CI_SHA = ${{ env.CI_SHA }}"
68+
echo "env.CI_BRANCH = ${CI_BRANCH}"
69+
echo "env.CI_SHA = ${CI_SHA}"
6870
- name: Install dependencies
6971
run: |
7072
python -m pip install --upgrade pip
7173
python -m pip install .[test]
72-
74+
7375
if [ "${{ matrix.diffusers-version }}" == "main" ]; then
7476
pip install -U git+https://github.com/huggingface/diffusers.git
7577
else

‎.github/workflows/nightly-bnb.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ jobs:
3333
shell: bash
3434
steps:
3535
- uses: actions/checkout@v3
36+
with:
37+
persist-credentials: false
3638
- name: Pip install
3739
run: |
3840
source activate peft
@@ -156,6 +158,8 @@ jobs:
156158
shell: bash
157159
steps:
158160
- uses: actions/checkout@v3
161+
with:
162+
persist-credentials: false
159163
- name: Pip install
160164
run: |
161165
source activate peft

‎.github/workflows/nightly.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ jobs:
3030
shell: bash
3131
steps:
3232
- uses: actions/checkout@v3
33+
with:
34+
persist-credentials: false
3335
- name: Pip install
3436
run: |
3537
source activate peft
@@ -78,6 +80,8 @@ jobs:
7880
shell: bash
7981
steps:
8082
- uses: actions/checkout@v3
83+
with:
84+
persist-credentials: false
8185
- name: Pip install
8286
run: |
8387
source activate peft

‎.github/workflows/stale.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1717
steps:
1818
- uses: actions/checkout@v3
19+
with:
20+
persist-credentials: false
1921

2022
- name: Setup Python
2123
uses: actions/setup-python@v4

‎.github/workflows/test-docker-build.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ jobs:
1414
steps:
1515
- name: Check out code
1616
uses: actions/checkout@v3
17+
with:
18+
persist-credentials: false
1719
- name: Get changed files
1820
id: changed-files
1921
uses: tj-actions/changed-files@1c8e6069583811afb28f97afeaf8e7da80c6be5c #v42
@@ -26,7 +28,7 @@ jobs:
2628
env:
2729
ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
2830
run: |
29-
echo "matrix=${{ steps.changed-files.outputs.all_changed_files}}" >> $GITHUB_OUTPUT
31+
echo "matrix=${ALL_CHANGED_FILES}" >> $GITHUB_OUTPUT
3032
build_modified_files:
3133
needs: get_changed_files
3234
name: Build Docker images on modified files
@@ -51,6 +53,8 @@ jobs:
5153
uses: docker/setup-buildx-action@v1
5254
- name: Check out code
5355
uses: actions/checkout@v3
56+
with:
57+
persist-credentials: false
5458
- name: Build Docker image
5559
uses: docker/build-push-action@v4
5660
with:

‎.github/workflows/tests-main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ jobs:
1111
runs-on: ubuntu-latest
1212
steps:
1313
- uses: actions/checkout@v3
14+
with:
15+
persist-credentials: false
1416
- name: Set up Python 3.11
1517
uses: actions/setup-python@v4
1618
with:

‎.github/workflows/tests.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- uses: actions/checkout@v3
17+
with:
18+
persist-credentials: false
1719
- name: Set up Python
1820
uses: actions/setup-python@v4
1921
with:
@@ -39,6 +41,8 @@ jobs:
3941
runs-on: ${{ matrix.os }}
4042
steps:
4143
- uses: actions/checkout@v3
44+
with:
45+
persist-credentials: false
4246
- name: Set up Python ${{ matrix.python-version }}
4347
uses: actions/setup-python@v4
4448
with:

‎.github/workflows/torch_compile_tests.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ jobs:
2525
PEFT_DEBUG_WITH_TORCH_COMPILE: 1
2626
CUDA_VISIBLE_DEVICES: "0"
2727
TEST_TYPE: "single_gpu_huggingface/peft-gpu-bnb-latest:latest"
28+
USE_PYTORCH_NIGHTLY: "${{ github.event.inputs.pytorch_nightly }}"
2829
container:
2930
image: "huggingface/peft-gpu-bnb-latest:latest"
3031
options: --gpus all --shm-size "16gb" --ipc host -v /mnt/cache/.cache/huggingface:/mnt/cache/
@@ -36,13 +37,14 @@ jobs:
3637
with:
3738
ref: ${{ github.event.inputs.branch }}
3839
repository: ${{ github.event.pull_request.head.repo.full_name }}
40+
persist-credentials: false
3941
- name: Pip install
4042
run: |
4143
source activate peft
4244
pip install -e . --no-deps
4345
pip install pytest-cov pytest-reportlog parameterized datasets scipy einops
4446
pip install "pytest>=7.2.0,<8.0.0" # see: https://github.com/huggingface/transformers/blob/ce4fff0be7f6464d713f7ac3e0bbaafbc6959ae5/setup.py#L148C6-L148C26
45-
if [ "${{ github.event.inputs.pytorch_nightly }}" = "true" ]; then
47+
if [ "${USE_PYTORCH_NIGHTLY}" = "true" ]; then
4648
python -m pip install --upgrade --pre torch --index-url https://download.pytorch.org/whl/nightly/cpu
4749
fi
4850
- name: Test compile with pytest

‎.github/workflows/trufflehog.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,6 @@ jobs:
1111
uses: actions/checkout@v4
1212
with:
1313
fetch-depth: 0
14+
persist-credentials: false
1415
- name: Secret Scanning
1516
uses: trufflesecurity/trufflehog@main

0 commit comments

Comments
 (0)