ci: colocate zizmor suppression rationales#263
Merged
trask merged 2 commits intoJul 22, 2026
Merged
Conversation
14 tasks
There was a problem hiding this comment.
Pull request overview
This PR remediates zizmor findings across this repository’s GitHub Actions workflows by reducing unnecessary credential persistence during actions/checkout, and by adding/adjusting zizmor ignore annotations where credentials or caching behavior is intentionally required.
Changes:
- Set
actions/checkouttopersist-credentials: falsein multiple workflows to avoid persisting the repository token in the git config. - Add a targeted zizmor ignore for
persist-credentials: truewhere branch pushes require credentials (prepare-release-branch.yml). - Restructure zizmor ignore comments for Gradle cache-related findings to be clearer and more explicit.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/release.yml | Disables persisted checkout credentials during release workflow execution. |
| .github/workflows/prepare-release-branch.yml | Disables persisted creds for prereqs; keeps creds enabled (with zizmor ignore) for the branch-push job. |
| .github/workflows/issue-management-feedback-label.yml | Disables persisted checkout credentials for the issue-label automation workflow. |
| .github/workflows/gradle-wrapper-validation.yml | Disables persisted checkout credentials while validating the wrapper. |
| .github/workflows/fossa.yml | Disables persisted checkout credentials for the FOSSA scan workflow. |
| .github/workflows/codeql.yml | Disables persisted checkout credentials; improves clarity of zizmor ignore commentary for Gradle caching. |
| .github/workflows/build.yml | Disables persisted checkout credentials; adjusts zizmor ignore commentary for Gradle caching. |
| .github/workflows/build-pull-request.yml | Disables persisted checkout credentials in PR build workflow. |
| .github/workflows/build-daily.yml | Disables persisted checkout credentials in scheduled build/publish workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
opentelemetrybot
force-pushed
the
zizmor-remediation/zero-findings-20260720
branch
from
July 22, 2026 18:07
139e868 to
204a174
Compare
opentelemetrybot
changed the title
opentelemetrybot
changed the title
opentelemetrybot
changed the title
opentelemetrybot
marked this pull request as ready for review
July 22, 2026 18:17
trask
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #260.
Moves each
cache-poisoningsuppression and its rationale inside the affected Gradle setup step:This makes the relationship clear to reviewers while keeping the directive within the YAML feature span that zizmor associates with the finding. There is no workflow behavior change.