From eb75d4a0b0149cb7f3a6e9d11d13378b12493a64 Mon Sep 17 00:00:00 2001 From: Benjamin Philip Date: Mon, 6 Jul 2026 12:12:03 +0530 Subject: [PATCH 1/8] Enable Zizmor Checks --- .github/workflows/asf-allowlist-check.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index e9392df..3a95c35 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -34,8 +34,8 @@ permissions: contents: read jobs: - gha: - name: "Analyze Actions" + allowlist: + name: Check ASF Allowlist runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -45,3 +45,10 @@ jobs: # Check that actions are pinned and on the ASF allowlist. # Intentionally unpinned to always use the latest allowlist from the ASF. - uses: apache/infrastructure-actions/allowlist-check@main # zizmor: ignore[unpinned-uses] + zizmor: + name: Zizmor Checks + runs-on: ubuntu-latest + steps: + - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 + with: + advanced-security: false From f91c8bf5456da4e3983ad256800579341f9fa384 Mon Sep 17 00:00:00 2001 From: Benjamin Philip Date: Mon, 6 Jul 2026 12:27:15 +0530 Subject: [PATCH 2/8] Fix indentation --- .github/workflows/asf-allowlist-check.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index 3a95c35..1238cd5 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -45,10 +45,11 @@ jobs: # Check that actions are pinned and on the ASF allowlist. # Intentionally unpinned to always use the latest allowlist from the ASF. - uses: apache/infrastructure-actions/allowlist-check@main # zizmor: ignore[unpinned-uses] + zizmor: name: Zizmor Checks runs-on: ubuntu-latest steps: - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 - with: - advanced-security: false + with: + advanced-security: false From 9f9d75bc142276c208eb3e897e6a1b34f7d5a399 Mon Sep 17 00:00:00 2001 From: Benjamin Philip Date: Mon, 6 Jul 2026 12:37:45 +0530 Subject: [PATCH 3/8] Checkout before calling zizmor --- .github/workflows/asf-allowlist-check.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index 1238cd5..9139166 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -50,6 +50,10 @@ jobs: name: Zizmor Checks runs-on: ubuntu-latest steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 with: advanced-security: false From e93524fe49e4fbb474eb556af4e481c67e65f75d Mon Sep 17 00:00:00 2001 From: Benjamin Philip Date: Mon, 6 Jul 2026 12:58:25 +0530 Subject: [PATCH 4/8] Fix unpinned uses --- .github/workflows/docs.yml | 10 +++++----- .github/workflows/erlang-ci.yml | 20 ++++++++++---------- .github/workflows/rust-ci.yml | 6 +++--- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 4c61700..577a777 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -44,10 +44,10 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Cache Rust crates - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cargo/bin/ @@ -70,7 +70,7 @@ jobs: rebar3-version: '3.18.0' - name: Cache Hex packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/rebar3/hex/hexpm/packages key: ${{ runner.os }}-hex-${{ hashFiles(format('{0}{1}', github.workspace, '/rebar.lock')) }} @@ -81,10 +81,10 @@ jobs: run: rebar3 ex_doc - name: Upload artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: 'doc' - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 diff --git a/.github/workflows/erlang-ci.yml b/.github/workflows/erlang-ci.yml index 892c8ba..6293023 100644 --- a/.github/workflows/erlang-ci.yml +++ b/.github/workflows/erlang-ci.yml @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Erlang/OTP uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 @@ -42,7 +42,7 @@ jobs: rebar3-version: '3.18.0' - name: Cache Hex packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/rebar3/hex/hexpm/packages key: ${{ runner.os }}-hex-${{ hashFiles(format('{0}{1}', github.workspace, '/rebar.lock')) }} @@ -57,10 +57,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Cache Rust crates - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cargo/bin/ @@ -83,7 +83,7 @@ jobs: rebar3-version: '3.18.0' - name: Cache Hex packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/rebar3/hex/hexpm/packages key: ${{ runner.os }}-hex-${{ hashFiles(format('{0}{1}', github.workspace, '/rebar.lock')) }} @@ -101,7 +101,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Erlang/OTP uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 @@ -110,7 +110,7 @@ jobs: rebar3-version: '3.18.0' - name: Cache Hex packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/rebar3/hex/hexpm/packages key: ${{ runner.os }}-hex-${{ hashFiles(format('{0}{1}', github.workspace, '/rebar.lock')) }} @@ -128,10 +128,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Cache Rust crates - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cargo/bin/ @@ -154,7 +154,7 @@ jobs: rebar3-version: '3.18.0' - name: Cache Hex packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/rebar3/hex/hexpm/packages key: ${{ runner.os }}-hex-${{ hashFiles(format('{0}{1}', github.workspace, '/rebar.lock')) }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index baea72a..f855dda 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -37,7 +37,7 @@ jobs: - native/arrow_format_nif/Cargo.toml steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # v1 with: @@ -62,7 +62,7 @@ jobs: - native/arrow_format_nif/Cargo.toml steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # v1 with: @@ -87,7 +87,7 @@ jobs: - native/arrow_format_nif/Cargo.toml steps: - - uses: actions/checkout@v7.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # v1 with: From 38962d81d57e9a672d6ed2c8c2b80ab5c3aee200 Mon Sep 17 00:00:00 2001 From: Benjamin Philip Date: Mon, 6 Jul 2026 13:01:10 +0530 Subject: [PATCH 5/8] Restrict permissions --- .github/workflows/erlang-ci.yml | 3 +++ .github/workflows/rust-ci.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/erlang-ci.yml b/.github/workflows/erlang-ci.yml index 6293023..645d342 100644 --- a/.github/workflows/erlang-ci.yml +++ b/.github/workflows/erlang-ci.yml @@ -27,6 +27,9 @@ on: env: RUST_TOOLCHAIN_VERSION: stable +permissions: + contents: read + jobs: format: name: Check Formatting diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index f855dda..3ea5714 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -27,6 +27,9 @@ on: env: RUST_TOOLCHAIN_VERSION: stable +permissions: + contents: read + jobs: lint-rust: name: Lint Rust with Clippy From c1865cc21aa6e552db71d94577efc7f7c1298c42 Mon Sep 17 00:00:00 2001 From: Benjamin Philip Date: Mon, 6 Jul 2026 13:08:54 +0530 Subject: [PATCH 6/8] Do not persist credentials --- .github/workflows/docs.yml | 2 ++ .github/workflows/erlang-ci.yml | 8 ++++++++ .github/workflows/rust-ci.yml | 6 ++++++ 3 files changed, 16 insertions(+) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 577a777..df8c55f 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -45,6 +45,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Cache Rust crates uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 diff --git a/.github/workflows/erlang-ci.yml b/.github/workflows/erlang-ci.yml index 645d342..86e9086 100644 --- a/.github/workflows/erlang-ci.yml +++ b/.github/workflows/erlang-ci.yml @@ -37,6 +37,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Install Erlang/OTP uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 @@ -61,6 +63,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Cache Rust crates uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -105,6 +109,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Install Erlang/OTP uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0 @@ -132,6 +138,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Cache Rust crates uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 3ea5714..4d048ef 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -41,6 +41,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # v1 with: @@ -66,6 +68,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # v1 with: @@ -91,6 +95,8 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # v1 with: From eaddf40a46429c146cd173c2158f2df887c0154d Mon Sep 17 00:00:00 2001 From: Benjamin Philip Date: Mon, 6 Jul 2026 13:41:53 +0530 Subject: [PATCH 7/8] Add dependabot cooldown --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5bdbfb9..a1e3a8d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,6 +24,8 @@ updates: commit-message: prefix: "chore: " open-pull-requests-limit: 10 + cooldown: + default-days: 7 - package-ecosystem: "cargo" directory: "/native/arrow_format_nif" schedule: @@ -31,3 +33,5 @@ updates: commit-message: prefix: "chore: " open-pull-requests-limit: 10 + cooldown: + default-days: 7 From 3700541843c184fb55428bfbc89f7bb0b9181b11 Mon Sep 17 00:00:00 2001 From: Benjamin Philip Date: Mon, 6 Jul 2026 17:58:43 +0530 Subject: [PATCH 8/8] Rename workflow file --- .../{asf-allowlist-check.yml => github-actions-check.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{asf-allowlist-check.yml => github-actions-check.yml} (100%) diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/github-actions-check.yml similarity index 100% rename from .github/workflows/asf-allowlist-check.yml rename to .github/workflows/github-actions-check.yml