Skip to content

chore: update GitHub Actions to Node 24 versions and refactor workflow permissions for zizmor security compliance #1232

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yvonnep165 merged 2 commits into from
Aug 13, 2026
Merged

chore: update GitHub Actions to Node 24 versions and refactor workflow permissions for zizmor security compliance #1232

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5de9298
update GitHub Actions to Node 24 versions
yvonnep165 Aug 12, 2026
258b1f5
Fix zizmor findings
yvonnep165 Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ name: Continuous Integration

on: pull_request

permissions:
contents: read

jobs:
build:
runs-on: ubuntu-latest
Expand All @@ -24,10 +27,12 @@ jobs:
java-version: [8, 11, 17]

steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up JDK
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
distribution: 'zulu'
java-version: ${{ matrix.java-version }}
Expand Down
14 changes: 9 additions & 5 deletions .github/workflows/nightly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,19 +22,23 @@ on:
repository_dispatch:
types: [firebase_nightly_build]

permissions:
contents: read

jobs:
nightly:

runs-on: ubuntu-latest

steps:
- name: Checkout source for staging
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.client_payload.ref || github.ref }}
persist-credentials: false

- name: Set up JDK 8
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
distribution: 'zulu'
java-version: 8
Expand All @@ -48,14 +52,14 @@ jobs:
# Attach the packaged artifacts to the workflow output. These can be manually
# downloaded for later inspection if necessary.
- name: Archive artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: dist
path: dist

- name: Send email on failure
if: failure()
uses: firebase/firebase-admin-node/.github/actions/send-email@2e2b36a84ba28679bcb7aecdacabfec0bded2d48 # Admin Node SDK v13.6.0
uses: firebase/firebase-admin-node/.github/actions/send-email@7343f166ec71c2efee5fe0554c2fb96203faf2a5 # Admin Node SDK v14.2.0
with:
api-key: ${{ secrets.OSS_BOT_MAILGUN_KEY }}
domain: ${{ secrets.OSS_BOT_MAILGUN_DOMAIN }}
Expand All @@ -70,7 +74,7 @@ jobs:

- name: Send email on cancelled
if: cancelled()
uses: firebase/firebase-admin-node/.github/actions/send-email@2e2b36a84ba28679bcb7aecdacabfec0bded2d48 # Admin Node SDK v13.6.0
uses: firebase/firebase-admin-node/.github/actions/send-email@7343f166ec71c2efee5fe0554c2fb96203faf2a5 # Admin Node SDK v14.2.0
with:
api-key: ${{ secrets.OSS_BOT_MAILGUN_KEY }}
domain: ${{ secrets.OSS_BOT_MAILGUN_DOMAIN }}
Expand Down
18 changes: 13 additions & 5 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,9 @@ on:
types:
- firebase_build

permissions:
contents: read

jobs:
stage_release:
# To publish a release, merge a PR with the title prefix '[chore] Release ' to main
Expand All @@ -46,10 +49,12 @@ jobs:

steps:
- name: Checkout source for staging
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up JDK 8
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
distribution: 'zulu'
java-version: 8
Expand All @@ -63,7 +68,7 @@ jobs:
# Attach the packaged artifacts to the workflow output. These can be manually
# downloaded for later inspection if necessary.
- name: Archive artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: dist
path: dist
Expand All @@ -86,10 +91,13 @@ jobs:

steps:
- name: Checkout source for publish
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# Ignored since the GITHUB_TOKEN needs to be persisted for this workflow.
persist-credentials: true # zizmor: ignore[artipacked]

- name: Set up JDK 8
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
distribution: 'zulu'
java-version: 8
Expand Down
Loading