From cc8b5938c2c86f1df300df1acd1f593a90cde54f Mon Sep 17 00:00:00 2001 From: Wjavan <219539974+Wjavan@users.noreply.github.com> Date: Fri, 13 Nov 2026 20:07:27 +0800 Subject: [PATCH 1/2] =?UTF-8?q?ci:=20=E5=A2=9E=E5=8A=A0=20workflow=20?= =?UTF-8?q?=E5=AE=89=E5=85=A8=E5=88=86=E6=9E=90=EF=BC=88zizmor=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actionlint 只查语法与表达式；zizmor 查脚本注入、权限与凭据持久化。 动作引用保持大版本标签；release.yml 的 checkout 补齐 persist-credentials: false。 self-repository 就地抑制：zizmor 建议的 $/ 写法会被 actionlint 拒绝。 --- .github/workflows/ci.yml | 3 +++ .github/workflows/release.yml | 3 ++- .github/zizmor.yml | 6 ++++++ 3 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d8cbb0b..24432ec 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -184,3 +184,6 @@ jobs: # 校验工具由镜像提供，缺失时直接失败而非跳过 command -v shellcheck >/dev/null || { echo "::error::镜像里没有 shellcheck，workflow 检查不完整"; exit 1; } "$RUNNER_TEMP/actionlint" + + - name: workflow 安全分析 + run: pipx run zizmor==1.32.0 --format github .github/workflows diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5c95e10..5742d0a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,7 +11,7 @@ concurrency: jobs: ci: - uses: ./.github/workflows/ci.yml + uses: ./.github/workflows/ci.yml # zizmor: ignore[self-repository] permissions: contents: read @@ -25,6 +25,7 @@ jobs: - uses: actions/checkout@v7 with: fetch-depth: 0 + persist-credentials: false - name: Read @version id: ver diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..f91fb48 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,6 @@ +# actions/* 用大版本标签，其余要求哈希。 +rules: + unpinned-uses: + config: + policies: + "actions/*": ref-pin From 6118324d70b8130e1ba140871df6cf7cfc051940 Mon Sep 17 00:00:00 2001 From: Wjavan <219539974+Wjavan@users.noreply.github.com> Date: Fri, 13 Nov 2026 22:59:28 +0800 Subject: [PATCH 2/2] =?UTF-8?q?Update=20=E7=BD=91=E7=9B=98=E7=9B=B4?= =?UTF-8?q?=E9=93=BE=E4=B8=8B=E8=BD=BD=E5=8A=A9=E6=89=8B.user.js?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...276\344\270\213\350\275\275\345\212\251\346\211\213.user.js" | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git "a/\347\275\221\347\233\230\347\233\264\351\223\276\344\270\213\350\275\275\345\212\251\346\211\213.user.js" "b/\347\275\221\347\233\230\347\233\264\351\223\276\344\270\213\350\275\275\345\212\251\346\211\213.user.js" index 8c1a882..5eb2a0b 100644 --- "a/\347\275\221\347\233\230\347\233\264\351\223\276\344\270\213\350\275\275\345\212\251\346\211\213.user.js" +++ "b/\347\275\221\347\233\230\347\233\264\351\223\276\344\270\213\350\275\275\345\212\251\346\211\213.user.js" @@ -1,7 +1,7 @@ // ==UserScript== // @name FerryLink // @namespace https://github.com/Wjavan/FerryLink -// @version 1.6.4 +// @version 1.6.5 // @author Wjavan // @description 支持百度/阿里/天翼/迅雷/夸克/移动/城通网盘直链下载。支持 HTTP/JSON-RPC/cURL，推送至 IDM/XDown/Aria2/NDM/Motrix/终端。基于油小猴(youxiaohou.com)的网盘直链下载助手修改。 // @copyright 2026, Wjavan (https://github.com/Wjavan)