From f93018e6825418c36cd860eb511ab51763658ac0 Mon Sep 17 00:00:00 2001 From: Nick Cooke Date: Wed, 29 Jul 2026 14:30:39 -0400 Subject: [PATCH 1/3] fix(ci): add read permissions and pin checkout actions Add the missing `permissions: contents: read` configuration to workflows and pin the `actions/checkout` step to a specific commit hash for security consistency with other Firebase repositories. --- .github/workflows/spm.yml | 5 ++++- .github/workflows/tests.yml | 10 +++++++--- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/spm.yml b/.github/workflows/spm.yml index 999851a..fa36427 100644 --- a/.github/workflows/spm.yml +++ b/.github/workflows/spm.yml @@ -1,5 +1,8 @@ name: spm +permissions: + contents: read + on: push: pull_request: @@ -8,7 +11,7 @@ jobs: swift-build-run: runs-on: macOS-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Build run: swift build - name: Run diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 9302d21..7e4fe1c 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -1,4 +1,8 @@ name: Test after code changes + +permissions: + contents: read + on: workflow_dispatch: push: @@ -29,7 +33,7 @@ jobs: steps: - name: Check out code from GitHub - uses: actions/checkout@v2 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: path: nanopb @@ -51,7 +55,7 @@ jobs: steps: - name: Check out code from GitHub - uses: actions/checkout@v2 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: path: nanopb fetch-depth: "0" @@ -73,7 +77,7 @@ jobs: steps: - name: Check out code from GitHub - uses: actions/checkout@v2 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: path: nanopb fetch-depth: "0" From b8f45c33bf624152ecd690861b6b735a3fad1164 Mon Sep 17 00:00:00 2001 From: Nick Cooke Date: Wed, 29 Jul 2026 14:30:39 -0400 Subject: [PATCH 2/3] build: remove unused poetry files and fix shellcheck warnings Remove the `extra/poetry` directory to eliminate high-severity vulnerabilities flagged in unused protobuf dependencies. Also remove the reference to it from `tools/set_version.sh` and fix existing shellcheck warnings in the script. --- extra/poetry/poetry_build.sh | 9 --------- extra/poetry/pyproject.toml | 26 -------------------------- tools/set_version.sh | 12 +++++------- 3 files changed, 5 insertions(+), 42 deletions(-) delete mode 100755 extra/poetry/poetry_build.sh delete mode 100644 extra/poetry/pyproject.toml diff --git a/extra/poetry/poetry_build.sh b/extra/poetry/poetry_build.sh deleted file mode 100755 index d428d39..0000000 --- a/extra/poetry/poetry_build.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash - -rm -rf nanopb -mkdir nanopb -cp -pr ../../generator nanopb/ -touch nanopb/__init__.py nanopb/generator/__init__.py -cp -pr ../../README.md . -sed -i -e 's/\(version =.*\)-dev.*/\1-dev'$(git rev-list HEAD --count)'"/' pyproject.toml -poetry build diff --git a/extra/poetry/pyproject.toml b/extra/poetry/pyproject.toml deleted file mode 100644 index ad3e750..0000000 --- a/extra/poetry/pyproject.toml +++ /dev/null @@ -1,26 +0,0 @@ -[tool.poetry] -name = "nanopb" -version = "0.3.9.10" -description = "Nanopb is a small code-size Protocol Buffers implementation in ansi C. It is especially suitable for use in microcontrollers, but fits any memory restricted system." -authors = ["Petteri Aimonen "] -license = "Zlib" -repository = "https://github.com/nanopb/nanopb/" -readme = "README.md" -homepage = "https://jpa.kapsi.fi/nanopb/" -documentation = "https://jpa.kapsi.fi/nanopb/docs/index.html" -keywords = ["protobuf", "protoc"] -classifiers = ["Topic :: Software Development :: Build Tools"] - -[tool.poetry.scripts] -nanopb_generator = "nanopb.generator.nanopb_generator:main_cli" -protoc-gen-nanopb = "nanopb.generator.nanopb_generator:main_plugin" - -[tool.poetry.dependencies] -python = ">=2.7" -protobuf = ">=3.6" - -[tool.poetry.dev-dependencies] - -[build-system] -requires = ["poetry>=0.12"] -build-backend = "poetry.masonry.api" diff --git a/tools/set_version.sh b/tools/set_version.sh index 6aa25eb..01576d4 100755 --- a/tools/set_version.sh +++ b/tools/set_version.sh @@ -4,13 +4,11 @@ # e.g. user@localhost:~/nanopb$ tools/set_version.sh nanopb-0.1.9-dev # It sets the version number in pb.h and generator/nanopb_generator.py. -sed -i -e 's/nanopb_version\s*=\s*"[^"]*"/nanopb_version = "'$1'"/' generator/nanopb_generator.py -sed -i -e 's/#define\s*NANOPB_VERSION\s*.*/#define NANOPB_VERSION '$1'/' pb.h -sed -i -e 's/set(\s*nanopb_VERSION_STRING\s*[^)]*)/set(nanopb_VERSION_STRING '$1')/' CMakeLists.txt +sed -i -e 's/nanopb_version\s*=\s*"[^"]*"/nanopb_version = "'"$1"'"/' generator/nanopb_generator.py +sed -i -e 's/#define\s*NANOPB_VERSION\s*.*/#define NANOPB_VERSION '"$1"'/' pb.h +sed -i -e 's/set(\s*nanopb_VERSION_STRING\s*[^)]*)/set(nanopb_VERSION_STRING '"$1"')/' CMakeLists.txt -VERSION_ONLY=$(echo $1 | sed 's/nanopb-//') +VERSION_ONLY="${1#nanopb-}" if [[ $1 != *dev ]] -then sed -i -e 's/"version":\s*"[^"]*"/"version": "'$VERSION_ONLY'"/' library.json +then sed -i -e 's/"version":\s*"[^"]*"/"version": "'"$VERSION_ONLY"'"/' library.json fi - -sed -i -e 's/version =.*/version = "'$VERSION_ONLY'"/' extra/poetry/pyproject.toml From c08d9ff7db42d03757ee3cbd35ee13f4129d74f7 Mon Sep 17 00:00:00 2001 From: Nick Cooke Date: Wed, 29 Jul 2026 15:15:25 -0400 Subject: [PATCH 3/3] style: revert shellcheck formatting in set_version.sh to minimize diff with upstream --- tools/set_version.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/set_version.sh b/tools/set_version.sh index 01576d4..0adb597 100755 --- a/tools/set_version.sh +++ b/tools/set_version.sh @@ -4,11 +4,11 @@ # e.g. user@localhost:~/nanopb$ tools/set_version.sh nanopb-0.1.9-dev # It sets the version number in pb.h and generator/nanopb_generator.py. -sed -i -e 's/nanopb_version\s*=\s*"[^"]*"/nanopb_version = "'"$1"'"/' generator/nanopb_generator.py -sed -i -e 's/#define\s*NANOPB_VERSION\s*.*/#define NANOPB_VERSION '"$1"'/' pb.h -sed -i -e 's/set(\s*nanopb_VERSION_STRING\s*[^)]*)/set(nanopb_VERSION_STRING '"$1"')/' CMakeLists.txt +sed -i -e 's/nanopb_version\s*=\s*"[^"]*"/nanopb_version = "'$1'"/' generator/nanopb_generator.py +sed -i -e 's/#define\s*NANOPB_VERSION\s*.*/#define NANOPB_VERSION '$1'/' pb.h +sed -i -e 's/set(\s*nanopb_VERSION_STRING\s*[^)]*)/set(nanopb_VERSION_STRING '$1')/' CMakeLists.txt -VERSION_ONLY="${1#nanopb-}" +VERSION_ONLY=$(echo $1 | sed 's/nanopb-//') if [[ $1 != *dev ]] -then sed -i -e 's/"version":\s*"[^"]*"/"version": "'"$VERSION_ONLY"'"/' library.json +then sed -i -e 's/"version":\s*"[^"]*"/"version": "'$VERSION_ONLY'"/' library.json fi