gha: pin remaining actions and apply hardening from zizmor#13597
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s GitHub Actions configuration in line with zizmor/secure-workflows guidance by tightening default permissions, reducing token persistence, and improving shell safety/quoting in workflow scripts.
Changes:
- Add
persist-credentials: falsetoactions/checkoutsteps to avoid leaving the workflow token in the git config. - Replace overly broad default workflow permissions (
read-all) withcontents: readwhile keeping job-level overrides where needed. - Apply zizmor-related adjustments (unpinned reusable workflow suppressions, quoting of shell variables/args) and add Dependabot “cooldown” to reduce update risk/noise.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/windows-periodic.yml | Disables persisted checkout credentials for improved token hygiene. |
| .github/workflows/windows-periodic-trigger.yml | Adds zizmor suppression for intentionally unpinned reusable workflow reference. |
| .github/workflows/windows-hyperv-periodic.yml | Disables persisted checkout credentials for improved token hygiene. |
| .github/workflows/windows-hyperv-periodic-trigger.yml | Adds zizmor suppression for intentionally unpinned reusable workflow reference. |
| .github/workflows/stale.yml | Tightens default permissions to contents: read while retaining required job permissions. |
| .github/workflows/scorecards.yml | Tightens default permissions to contents: read and disables persisted checkout credentials. |
| .github/workflows/release.yml | Disables persisted checkout credentials and improves shell variable usage/quoting for tag handling. |
| .github/workflows/node-e2e.yml | Disables persisted checkout credentials for both containerd and Kubernetes checkouts. |
| .github/workflows/nightly.yml | Disables persisted checkout credentials across nightly jobs. |
| .github/workflows/links.yml | Disables persisted checkout credentials for the link-check workflow. |
| .github/workflows/images.yml | Disables persisted checkout credentials and quotes shell variables/arguments used with ctr. |
| .github/workflows/fuzz.yml | Disables persisted checkout credentials for fuzzing workflow. |
| .github/workflows/codeql.yml | Disables persisted checkout credentials for CodeQL workflow checkout. |
| .github/workflows/ci.yml | Disables persisted checkout credentials across CI jobs and additional checkouts. |
| .github/workflows/build-test-images.yml | Disables persisted checkout credentials and quotes interpolated values passed to make. |
| .github/workflows/buf-breaking.yml | Pins actions by SHA and disables persisted checkout credentials for the buf breaking check. |
| .github/workflows/api-release.yml | Disables persisted checkout credentials and improves shell variable usage/quoting for tag handling. |
| .github/dependabot.yml | Adds Dependabot cooldown settings to delay updates from very recent releases. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Member
Author
|
Most |
thaJeztah
force-pushed
the
harden_actions
branch
from
June 25, 2026 09:25
c20ae47 to
f16df5c
Compare
Signed-off-by: Sebastiaan van Stijn <[email protected]>
Results of automated fixes using;
zizmor --fix=all --min-severity medium .
Signed-off-by: Sebastiaan van Stijn <[email protected]>
Signed-off-by: Sebastiaan van Stijn <[email protected]>
"read-all" is overly permissive as a default. Change it to contents: read to align with other defaults. Note that this does not actually impact the workflows, because the defaults are overwritten in the actual check. Signed-off-by: Sebastiaan van Stijn <[email protected]>
Quote values to address CoPilot review comments Signed-off-by: Sebastiaan van Stijn <[email protected]>
thaJeztah
force-pushed
the
harden_actions
branch
from
June 26, 2026 16:53
f16df5c to
0f18307
Compare
Member
Author
|
@AkihiroSuda @mxpv PTAL (I think we can ignore the Link failure for now, as it's unrelated) |
samuelkarp
approved these changes
Jun 30, 2026
chrishenzie
approved these changes
Jul 1, 2026
github-project-automation
Bot
moved this from Needs Triage
to Review In Progress
in Pull Request Review
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Jul 1, 2026
github-project-automation
Bot
moved this from Review In Progress
to Done
in Pull Request Review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
gha: buf-breaking: pin actions by sha
gha: apply zizmor fixes
Results of automated fixes using;
gha: suppress zizmor warning for intentionally un-pinned workflows
gha: remove uses of "read-all" permissions
"read-all" is overly permissive as a default. Change it to contents: read
to align with other defaults.
Note that this does not actually impact the workflows, because the defaults
are overwritten in the actual check.
gha: quote some values
Quote values to address CoPilot review comments