ci: add zizmor workflow #13531
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
Adds a dedicated GitHub Actions workflow to run zizmor against this repository’s workflows, and updates existing workflows to align with zizmor/secure-workflow recommendations (e.g., reducing credential persistence and avoiding direct expression interpolation in shell).
Changes:
- Add a new
zizmorworkflow (reusable workflow invocation) to lint GitHub workflows for common mistakes/security issues. - Harden multiple workflows by setting
actions/checkouttopersist-credentials: false. - Adjust a few shell steps/uses lines to satisfy zizmor (e.g., use env vars for inputs; add zizmor ignore annotations where intentional).
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/zizmor.yml | New zizmor workflow to lint GitHub Actions configuration. |
| .github/workflows/windows-periodic.yml | Disable persisted checkout credentials. |
| .github/workflows/windows-periodic-trigger.yml | Add zizmor ignore for intentionally unpinned reusable workflow reference. |
| .github/workflows/windows-hyperv-periodic.yml | Disable persisted checkout credentials. |
| .github/workflows/windows-hyperv-periodic-trigger.yml | Add zizmor ignore for intentionally unpinned reusable workflow reference. |
| .github/workflows/release.yml | Disable persisted checkout credentials; use env var ref in shell. |
| .github/workflows/api-release.yml | Disable persisted checkout credentials; use env var ref in shell. |
| .github/workflows/node-e2e.yml | Disable persisted checkout credentials for both checkouts. |
| .github/workflows/nightly.yml | Disable persisted checkout credentials for both checkouts. |
| .github/workflows/links.yml | Disable persisted checkout credentials. |
| .github/workflows/images.yml | Disable persisted checkout credentials; move workflow inputs into env for shell usage. |
| .github/workflows/fuzz.yml | Disable persisted checkout credentials for go test fuzz job. |
| .github/workflows/codeql.yml | Disable persisted checkout credentials. |
| .github/workflows/ci.yml | Disable persisted checkout credentials across multiple jobs/steps. |
| .github/workflows/build-test-images.yml | Disable persisted checkout credentials; move workflow inputs into env for shell usage. |
| .github/dependabot.yml | Add a Dependabot update cooldown configuration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| with: | ||
| min-severity: medium | ||
| min-confidence: medium | ||
| persona: pedantic |
There was a problem hiding this comment.
| persona: pedantic | |
| persona: pedantic | |
| # No need to hide the result in https://github.com/ORG/REPO/security (private), | |
| # as anybody can already run zizmor locally to find vulnerabilities. | |
| advanced-security: false |
There was a problem hiding this comment.
Ah! I was wondering why I didn't see the reports; possibly because of that (?); thx! will update later.
There was a problem hiding this comment.
Looks like that's not supported; maybe something needed to be added in @crazy-max 's workflow?
Invalid workflow file: .github/workflows/zizmor.yml#L36
The workflow is not valid. .github/workflows/zizmor.yml (Line: 36, Col: 26): Invalid input, advanced-security is not defined in the referenced workflow.There was a problem hiding this comment.
removed it again (for now)
There was a problem hiding this comment.
You can have annotations in pull requests even if SARIF report results in code scanning are private: https://docs.github.com/en/code-security/concepts/code-scanning/about-code-scanning-alerts#about-alerts-in-pull-requests
There was a problem hiding this comment.
Ah, didn't notice this was not https://github.com/zizmorcore/zizmor-action ...
There was a problem hiding this comment.
| releasever=${GITHUB_REF} | ||
| releasever="${releasever#refs/tags/}" | ||
| TAGCHECK=$(git tag -v ${releasever} 2>&1 >/dev/null) || | ||
| TAGCHECK=$(git tag -v "${releasever}" 2>&1 >/dev/null) || | ||
| echo "${TAGCHECK}" | grep -q "error" && { | ||
| echo "::error::tag ${releasever} is not a signed tag. Failing release process." |
| releasever=${GITHUB_REF} | ||
| releasever="${releasever#refs/tags/}" | ||
| TAGCHECK=$(git tag -v ${releasever} 2>&1 >/dev/null) || | ||
| TAGCHECK=$(git tag -v "${releasever}" 2>&1 >/dev/null) || | ||
| echo "${TAGCHECK}" | grep -q "error" && { | ||
| echo "::error::tag ${releasever} is not a signed tag. Failing release process." |
Signed-off-by: Sebastiaan van Stijn <[email protected]>
Results of automated fixes using;
zizmor --fix=all --min-severity medium .
Signed-off-by: Sebastiaan van Stijn <[email protected]>
Signed-off-by: Sebastiaan van Stijn <[email protected]>
"read-all" is overly permissive as a default. Change it to contents: read to align with other defaults. Note that this does not actually impact the workflows, because the defaults are overwritten in the actual check. Signed-off-by: Sebastiaan van Stijn <[email protected]>
Quote values to address CoPilot review comments Signed-off-by: Sebastiaan van Stijn <[email protected]>
Signed-off-by: Sebastiaan van Stijn <[email protected]>
|
@thaJeztah Rebase? |
Add a workflow to lint GitHub workflows for common mistakes / security issues.
Similar to docker/buildx#3742