ci: add shared security scanning workflow by opentelemetrybot · Pull Request #2251 · open-telemetry/opentelemetry-ruby

opentelemetrybot · 2026-07-15T04:28:07Z

Tracked in open-telemetry/sig-security#293.

Adds zizmor scanning through the OpenTelemetry shared workflow.

The workflow:

runs the regular persona on pull requests, pushes to main, and a randomized weekly schedule;
uploads results to GitHub code scanning;
uses the shared workflow pinned to an immutable commit.

After merge

Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

github-advanced-security · 2026-07-15T04:28:27Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Copilot

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds Zizmor security scanning via the OpenTelemetry shared workflow and adjusts existing GitHub Actions workflows to remediate Zizmor findings (token/credentials hardening and template-injection-safe variable usage).

Changes:

Added a new zizmor workflow that uploads SARIF results to GitHub code scanning using a pinned shared workflow.
Updated multiple workflows to set persist-credentials: false on checkout (and targeted exceptions) and tightened GitHub App token permissions.
Adjusted shell argument interpolation in workflows/actions to address template injection / env findings and added “zizmor” to cspell.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	Introduces Zizmor scanning via the pinned OpenTelemetry reusable workflow with restricted permissions.
.github/workflows/renovate-semconv.yml	Changes checkout credential persistence and switches branch push strategy (no longer using an app token).
.github/workflows/release-retry.yml	Disables persisted checkout credentials to reduce token exposure.
.github/workflows/release-request.yml	Disables persisted checkout credentials; tightens app token permissions.
.github/workflows/release-request-weekly.yml	Disables persisted checkout credentials; tightens app token permissions; avoids expression interpolation in shell arg.
.github/workflows/release-perform.yml	Disables persisted checkout credentials to reduce token exposure.
.github/workflows/release-hook-on-push.yml	Disables persisted checkout credentials to reduce token exposure.
.github/workflows/release-hook-on-closed.yml	Disables persisted checkout credentials; avoids expression interpolation in shell arg.
.github/workflows/fossa.yml	Disables persisted checkout credentials to reduce token exposure.
.github/workflows/conventional-commits.yml	Disables persisted checkout credentials to reduce token exposure.
.github/workflows/ci.yml	Disables persisted checkout credentials across CI jobs.
.github/workflows/ci-markdownlint.yml	Disables persisted checkout credentials to reduce token exposure.
.github/workflows/ci-markdown-link.yml	Disables persisted checkout credentials to reduce token exposure.
.github/workflows/ci-example-dice-roller.yml	Disables persisted checkout credentials to reduce token exposure.
.github/workflows/ci-build-docker.yml	Disables persisted checkout credentials to reduce token exposure.
.github/actions/test_dice_roller/action.yml	Adds Zizmor ignore annotation for `$GITHUB_ENV` usage in a composite action.
.cspell.yml	Adds “zizmor” to dictionary to avoid spellcheck failures.

Comments suppressed due to low confidence (1)

.github/workflows/renovate-semconv.yml:1

This workflow now pushes using the persisted GITHUB_TOKEN credentials (the GitHub App token step was removed). Pushes performed with GITHUB_TOKEN typically do not trigger other GitHub Actions workflows, which can change downstream automation behavior compared to using an app token. If follow-on workflows (or other automations) are expected to run on these pushes, consider reintroducing actions/create-github-app-token with explicit minimal permissions (as done in the release workflows), and use that token for git push instead of relying on persisted credentials.

name: Renovate Semantic Conventions Post-Update

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

opentelemetrybot requested review from a team, dazuma, fbogsany, kaylareopelle, mwear, robbkidd, robertlaurin and xuan-cao-swi as code owners July 15, 2026 04:28

trask mentioned this pull request Jul 15, 2026

Track organization-wide zizmor rollout open-telemetry/sig-security#293

Open

14 tasks

opentelemetrybot changed the title ~~Add shared zizmor workflow~~ ci: add shared zizmor workflow Jul 15, 2026

opentelemetrybot changed the title ~~ci: add shared zizmor workflow~~ ci: add shared security scanning workflow Jul 15, 2026

mwear approved these changes Jul 17, 2026

View reviewed changes

thompson-tomo approved these changes Jul 18, 2026

View reviewed changes

opentelemetrybot force-pushed the zizmor-rollout/ruby-20260714 branch from e8e0d48 to b0765a5 Compare July 22, 2026 15:04

ci: add shared security scanning workflow

1cc5535

opentelemetrybot force-pushed the zizmor-rollout/ruby-20260714 branch from b0765a5 to 1cc5535 Compare July 22, 2026 15:08

trask requested a review from Copilot July 22, 2026 15:12

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread .github/workflows/zizmor.yml

Comment thread .github/workflows/renovate-semconv.yml

Comment thread .github/actions/test_dice_roller/action.yml

Copilot started reviewing on behalf of trask July 22, 2026 15:44 View session

ci: preserve Renovate follow-on workflows

f902f7e

trask requested a review from Copilot July 22, 2026 15:59

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread .github/actions/test_dice_roller/action.yml Outdated

Copilot started reviewing on behalf of trask July 22, 2026 16:27 View session

ci: fix action run block syntax

7e9f663

trask requested a review from Copilot July 22, 2026 16:35

Copilot started reviewing on behalf of trask July 22, 2026 16:46 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

trask marked this pull request as draft July 22, 2026 16:53

trask requested a review from Copilot July 22, 2026 16:53

opentelemetrybot marked this pull request as ready for review July 22, 2026 16:54

Copilot started reviewing on behalf of trask July 22, 2026 17:07 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

kaylareopelle reviewed Jul 24, 2026

View reviewed changes

Comment thread .cspell.yml

Apply suggestion from @kaylareopelle

2d4b7bb

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: add shared security scanning workflow#2251

ci: add shared security scanning workflow#2251
opentelemetrybot wants to merge 4 commits into
open-telemetry:mainfrom
opentelemetrybot:zizmor-rollout/ruby-20260714

opentelemetrybot commented Jul 15, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Jul 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

opentelemetrybot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

After merge

Uh oh!

github-advanced-security AI commented Jul 15, 2026

What Enabling Code Scanning Means:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

opentelemetrybot commented Jul 15, 2026 •

edited

Loading