fix: fix GitHub Actions security issues pointed out by zizmor (#115)

ashishb · Jan 4, 2025 · c759923 · c759923
1 parent d7fc146
commit c759923
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/.github/workflows/check-goreleaser-config.yaml b/.github/workflows/check-goreleaser-config.yaml
@@ -40,7 +40,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.go-version }}
-          cache-dependency-path: src/gabo/go.sum
+          cache: false  # Disable caching to avoid cache poisoning
 
       - name: Install Go Releaser
         uses: goreleaser/goreleaser-action@v6

diff --git a/.github/workflows/release-binary.yaml b/.github/workflows/release-binary.yaml
@@ -35,7 +35,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: stable
-          cache-dependency-path: src/gabo/go.sum
+          cache: false  # Disable caching to avoid cache poisoning
 
       - name: Read gabo version name
         id: read-version
@@ -73,7 +73,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: stable
-          cache-dependency-path: src/gabo/go.sum
+          cache: false  # Disable caching to avoid cache poisoning
 
       # More assembly might be required: Docker logins, GPG, etc. It all depends
       # on your needs.

diff --git a/src/gabo/internal/generator/data/check-goreleaser-config.yaml b/src/gabo/internal/generator/data/check-goreleaser-config.yaml
@@ -46,6 +46,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.go-version }}
+          cache: false  # Disable caching to avoid cache poisoning
           cache-dependency-path: src/gabo/go.sum
 
       - name: Install Go Releaser