[READ-ONLY] Mirror of https://github.com/FoxxMD/multi-scrobbler. Scrobble plays from multiple sources to multiple clients
docs.multi-scrobbler.app
deezer
docker
jellyfin
koito
lastfm
listenbrainz
maloja
mopidy
mpris
music
music-assistant
plex
scrobble
self-hosted
spotify
subsonic
tautulli
youtube-music
ci: Harden remaining workflows using zizmor
* Pin action digests
* Remove template injection where possible
+38
-22
+5
-3
.github/workflows/docsDeploy.yml
+5
-3
.github/workflows/docsDeploy.yml
···
12
12
name: Deploy to GitHub Pages
13
13
runs-on: ubuntu-latest
14
14
steps:
15
-
- uses: actions/checkout@v4
16
-
- uses: actions/setup-node@v4
15
+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4.3.0
16
+
with:
17
+
persist-credentials: false
18
+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 #4.4.0
17
19
with:
18
20
node-version: 20
19
21
cache: npm
···
41
43
# Popular action to deploy to GitHub Pages:
42
44
# Docs: https://github.com/peaceiris/actions-gh-pages#%EF%B8%8F-docusaurus
43
45
- name: Deploy to GitHub Pages
44
-
uses: peaceiris/actions-gh-pages@v3
46
+
uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 #3.9.3
45
47
with:
46
48
github_token: ${{ secrets.GITHUB_TOKEN }}
47
49
# Build output to publish to the `gh-pages` branch:
+1
-1
.github/workflows/packagesDeleteUntagged.yml
+1
-1
.github/workflows/packagesDeleteUntagged.yml
+29
-16
.github/workflows/pr.yml
+29
-16
.github/workflows/pr.yml
···
48
48
# list all registries to push to and join all non-empty with comma
49
49
# https://unix.stackexchange.com/a/693165/116849
50
50
# https://stackoverflow.com/a/9429887/1469797
51
-
strings=("${{vars.DOCKERHUB_SLUG}}" "${{vars.GHCR_SLUG}}")
51
+
strings=("${VARS_DOCKERHUB_SLUG}" "${VARS_GHCR_SLUG}")
52
52
for i in ${!strings[@]}; do [[ -z ${strings[i]} ]] && unset strings[i]; done
53
53
joined_string=$(IFS=, ; echo "${strings[*]}")
54
54
echo "REGISTRIES_JOINED=$joined_string" >> $GITHUB_ENV
55
+
env:
56
+
VARS_DOCKERHUB_SLUG: ${{ vars.DOCKERHUB_SLUG }}
57
+
VARS_GHCR_SLUG: ${{vars.GHCR_SLUG}}
55
58
56
59
# do not use here!
57
60
# instead we can specify repo#sha in build-push-action so we only deal with foreign SHA for actually building image
···
73
76
74
77
- name: Login to Docker Hub
75
78
if: ${{ vars.DOCKERHUB_SLUG != '' }}
76
-
uses: docker/login-action@v3
79
+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
77
80
with:
78
81
username: ${{ secrets.DOCKER_USERNAME }}
79
82
password: ${{ secrets.DOCKER_PASSWORD }}
80
83
81
84
- name: Login to GitHub Container Registry
82
85
if: ${{ vars.GHCR_SLUG != '' }}
83
-
uses: docker/login-action@v3
86
+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
84
87
with:
85
88
registry: ghcr.io
86
89
username: ${{ github.repository_owner }}
···
89
92
# metadata extract for docker labels/image names is done in merge job
90
93
91
94
- name: Set up Buildx
92
-
uses: docker/setup-buildx-action@v3
95
+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #v3.11.1
93
96
94
97
# https://github.com/docker/build-push-action/issues/671#issuecomment-1619353328
95
98
# for caching
96
99
- name: Build and push by digest
97
100
id: build
98
-
uses: docker/build-push-action@v6
101
+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
99
102
with:
100
103
# specify foreign repo#sha from PR that is used to build image
101
104
context: ${{github.event.pull_request.head.repo.clone_url}}#${{github.event.pull_request.head.sha}}
···
114
117
touch "/tmp/digests/${digest#sha256:}"
115
118
116
119
- name: Upload digest
117
-
uses: actions/upload-artifact@v4
120
+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #4.6.2
118
121
with:
119
122
name: digests-${{ env.PLATFORM_PAIR }}
120
123
path: /tmp/digests/*
···
133
136
- test
134
137
steps:
135
138
- name: Download digests
136
-
uses: actions/download-artifact@v4
139
+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 #4.3.0
137
140
with:
138
141
path: /tmp/digests
139
142
pattern: digests-*
···
141
144
142
145
- name: Login to Docker Hub
143
146
if: ${{ vars.DOCKERHUB_SLUG != '' }}
144
-
uses: docker/login-action@v3
147
+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
145
148
with:
146
149
username: ${{ secrets.DOCKER_USERNAME }}
147
150
password: ${{ secrets.DOCKER_PASSWORD }}
148
151
149
152
- name: Login to GitHub Container Registry
150
153
if: ${{ vars.GHCR_SLUG != '' }}
151
-
uses: docker/login-action@v3
154
+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
152
155
with:
153
156
registry: ghcr.io
154
157
username: ${{ github.repository_owner }}
155
158
password: ${{ secrets.GITHUB_TOKEN }}
156
159
157
160
- name: Set up Docker Buildx
158
-
uses: docker/setup-buildx-action@v3
161
+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
159
162
160
163
- name: Extract metadata (tags, labels)
161
164
id: meta
162
-
uses: docker/metadata-action@v5
165
+
uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 #5.9.0
163
166
with:
164
167
images: |
165
168
${{ vars.DOCKERHUB_SLUG }}
···
180
183
working-directory: /tmp/digests
181
184
run: |
182
185
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
183
-
$(printf '${{ vars.DOCKERHUB_SLUG }}@sha256:%s ' *)
186
+
$(printf "${VARS_DOCKERHUB_SLUG}@sha256:%s " *)
187
+
env:
188
+
VARS_DOCKERHUB_SLUG: ${{ vars.DOCKERHUB_SLUG }}
184
189
185
190
- name: Create manifest list and push gchr
186
191
if: ${{ vars.GHCR_SLUG != '' }}
187
192
working-directory: /tmp/digests
188
193
run: |
189
194
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
190
-
$(printf '${{ vars.GHCR_SLUG }}@sha256:%s ' *)
195
+
$(printf "${VARS_GHCR_SLUG}@sha256:%s " *)
196
+
env:
197
+
VARS_GHCR_SLUG: ${{ vars.GHCR_SLUG }}
191
198
192
199
- name: Inspect image dockerhub
193
200
if: ${{ vars.DOCKERHUB_SLUG != '' }}
194
201
run: |
195
-
docker buildx imagetools inspect ${{ vars.DOCKERHUB_SLUG }}:${{ steps.meta.outputs.version }}
202
+
docker buildx imagetools inspect ${VARS_DOCKERHUB_SLUG}:${STEPS_META_OUTPUTS_VERSION}
203
+
env:
204
+
VARS_DOCKERHUB_SLUG: ${{ vars.DOCKERHUB_SLUG }}
205
+
STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }}
196
206
197
207
- name: Inspect image ghcr
198
208
if: ${{ vars.GHCR_SLUG != '' }}
199
209
run: |
200
-
docker buildx imagetools inspect ${{ vars.GHCR_SLUG }}:${{ steps.meta.outputs.version }}
210
+
docker buildx imagetools inspect ${VARS_GHCR_SLUG}:${STEPS_META_OUTPUTS_VERSION}
211
+
env:
212
+
VARS_GHCR_SLUG: ${{ vars.GHCR_SLUG }}
213
+
STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }}
201
214
202
215
203
216
combine-and-comment:
···
207
220
if: contains(github.event.pull_request.labels.*.name, 'safe to test')
208
221
steps:
209
222
- name: Create comment
210
-
uses: marocchino/sticky-pull-request-comment@v2
223
+
uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 #2.9.4
211
224
with:
212
225
recreate: true
213
226
header: "pr-release"
+3
-2
.github/workflows/testAndSanity.yml
+3
-2
.github/workflows/testAndSanity.yml
···
19
19
runs-on: ubuntu-latest
20
20
steps:
21
21
- name: Check out the repo
22
-
uses: actions/checkout@v4
22
+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 #v4.3.0
23
23
with:
24
24
ref: ${{ inputs.ref }}
25
+
persist-credentials: false
25
26
- name: Use Node.js
26
-
uses: actions/setup-node@v4
27
+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 #4.4.0
27
28
with:
28
29
node-version: ${{ inputs.node-version }}
29
30
cache: 'npm'