[Infra] Add zizmor scan workflow#4419
Conversation
Add a workflow that scans the repository with zizmor.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4419 +/- ##
==========================================
- Coverage 76.18% 75.94% -0.24%
==========================================
Files 455 455
Lines 18334 18334
==========================================
- Hits 13968 13924 -44
- Misses 4366 4410 +44 Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Add more indentation.
|
No, I forgot to add the PR trigger... 🤦 |
There was a problem hiding this comment.
Pull request overview
Adds an infrastructure/security workflow to scan this repository’s GitHub Actions workflows using zizmor, with a repository-level zizmor configuration file to tune rule behavior.
Changes:
- Added
.github/workflows/zizmor.ymlto run zizmor on pushes tomain, on a daily schedule, and via manual dispatch. - Added
.github/zizmor.ymlto configure zizmor rules (currently disablingsecrets-outside-env).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/zizmor.yml | Adds zizmor rule configuration (disables secrets-outside-env). |
| .github/workflows/zizmor.yml | New workflow to run zizmor scanning with SARIF/code-scanning permissions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Grammar do good.
- Add more branches for pushes. - Remove CRON.
Mistakenly missed.
Rename job and add a timeout.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Kielek
left a comment
Kielek
left a comment
There was a problem hiding this comment.
As I understand, when merged and all issues solved, we can include it into PR as mandatory step?
Yep, that's the idea. I'll start working on addressing the findings once it's merged as follow-ups. I imagine there will be quite a few trivia-ish ones (like naming all steps) or explicitly configuring actions/checkout inputs. 🤞 there's nothing serious to address. We can also debate suppressions vs. fixes were neccessary. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- Add concurrency. - Document permissions.
| - name: Checkout code | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| filter: 'tree:0' |
There was a problem hiding this comment.
More efficient fetch. I forget the exact details, but it's something we used at my old job and I added to my own personal repos, and it's got copy-pasted from there. You can find it in existing workflows in this repo as well.
| with: | ||
| filter: 'tree:0' | ||
| persist-credentials: false | ||
| show-progress: false |
There was a problem hiding this comment.
Reduces noise in CI logs.
Changes
Add a workflow that scans the repository with zizmor for vulnerabilities in GitHub Actions workflows.
Merge requirement checklist
Unit tests added/updatedAppropriateCHANGELOG.mdfiles updated for non-trivial changesChanges in public API reviewed (if applicable)