Repository navigation
ci: add CI/CD security analysis workflow - #2587
Merged
Merged
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
AmosHuKe
marked this pull request as ready for review
August 6, 2026 12:18
AmosHuKe
marked this pull request as draft
August 6, 2026 12:34
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s GitHub Actions setup by introducing a CI/CD security analysis workflow (zizmor) and tightening workflow permissions/action usage to reduce risk from over-privileged tokens and third-party dependencies.
Changes:
- Adds a scheduled/on-change CI/CD workflow security scan using zizmor.
- Sets workflow-level
permissions: {}across multiple workflows and updates action usage (pinned SHAs,persist-credentials: false). - Replaces the third-party sticky PR comment action with
actions/github-scriptfor coverage commenting.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/tests.yml | Disables default permissions, updates action pins/config, and tweaks coverage artifact handling. |
| .github/workflows/publish.yml | Adds concurrency and disables default permissions; keeps publish job permissions scoped. |
| .github/workflows/coverage_comment.yml | Disables default permissions and rewrites coverage PR commenting using actions/github-script. |
| .github/workflows/coverage_base.yml | Adds concurrency and disables default permissions; updates action pins. |
| .github/workflows/codeql.yml | Adds concurrency and disables default permissions; updates CodeQL action pins and checkout settings. |
| .github/workflows/cicd_security_analysis.yml | New workflow to scan .github/ for CI/CD security issues using zizmor. |
| .github/workflows/check_issues_access.yml | Adds concurrency and disables default permissions; job re-enables minimal needed permissions. |
| .github/dependabot.yaml | Adds Dependabot cooldown to delay very new GitHub Actions updates. |
| .github/config/cicd_security_analysis_zizmor_config.yaml | Adds zizmor configuration and rule toggles/ignores for CI scanning. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Code Coverage Report: Only Changed Files listed
Minimum allowed coverage is |
AlexV525
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cicd_security_analysis.yml).Replaced dangerousworkflow_runwithworkflow_callto prevent potential arbitrary code execution, credential theft, or privilege escalation in the target repository context.Minimized permissions for
coverage_comment.yml.actions/github-scriptto reduce supply-chain attacks.Warning
The
coverage_comment.ymlworkflow has not yet been tested.If it fails during execution, additional fixes will be required in a follow-up PR.
New Pull Request Checklist
mainbranch to avoid conflicts (via merge from master or rebase)CHANGELOG.mdin the corresponding package