immich

mirror of https://github.com/immich-app/immich.git synced 2025-05-24 01:12:58 -04:00

History

feat: static analysis job for gha workflows (#17688 )

* fix: set persist-credentials explicitly for checkout

https://woodruffw.github.io/zizmor/audits/#artipacked

* fix: minimize permissions scope for workflows

https://woodruffw.github.io/zizmor/audits/#excessive-permissions

* fix: remove potential template injections

https://woodruffw.github.io/zizmor/audits/#template-injection

* fix: only pass needed secrets in workflow_call

https://woodruffw.github.io/zizmor/audits/#secrets-inherit

* fix: push perm for single-arch build jobs

I hadn't realised these push to the registry too :x

* chore: fix formatting

* fix: $

* fix: retag job quoting

* feat: static analysis job for gha workflows

* chore: fix formatting

* fix: clear last zizmor checks

* fix: broken merge

---------

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>

2025-04-23 15:49:06 +00:00

build-mobile.yml

fix: various actions workflow security improvements (#17651 )

2025-04-18 15:10:27 -05:00

cache-cleanup.yml

fix: various actions workflow security improvements (#17651 )

2025-04-18 15:10:27 -05:00

cli.yml

fix: various actions workflow security improvements (#17651 )

2025-04-18 15:10:27 -05:00

codeql-analysis.yml

fix: various actions workflow security improvements (#17651 )