Skip to content

ci: add shared security scanning workflow#382

Merged
trask merged 3 commits into
open-telemetry:mainfrom
opentelemetrybot:zizmor-rollout/pilot-20260715
Jul 15, 2026
Merged

ci: add shared security scanning workflow#382
trask merged 3 commits into
open-telemetry:mainfrom
opentelemetrybot:zizmor-rollout/pilot-20260715

Conversation

@opentelemetrybot

@opentelemetrybot opentelemetrybot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Tracked in open-telemetry/sig-security#293.

Adds zizmor scanning through the OpenTelemetry shared workflow.

The workflow:

  • runs the regular persona on pull requests, pushes to main, and a randomized weekly schedule;
  • uploads results to GitHub code scanning;
  • uses the shared workflow pinned to an immutable commit.

After merge

  1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
  2. Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
  3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

@trask
trask requested a review from Copilot July 15, 2026 18:05
@github-advanced-security

github-advanced-security AI commented Jul 15, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Copilot AI reviewed Jul 15, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds repository security scanning via the OpenTelemetry shared Zizmor reusable workflow, and tightens GitHub Actions checkout token handling to reduce credential persistence risk. Also introduces a Dependabot “cooldown” window to delay non-security updates.

Changes:

  • Add .github/workflows/zizmor.yml to run Zizmor and upload SARIF results via the shared workflow pinned to an immutable commit.
  • Set actions/checkout to persist-credentials: false across CI and release-dev workflows.
  • Add Dependabot cooldown.default-days: 7 for both uv and github-actions ecosystems.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
.github/workflows/zizmor.yml Adds shared Zizmor code-scanning workflow invocation with minimal permissions.
.github/workflows/release-dev.yml Disables persisted checkout credentials for the release-dev job.
.github/workflows/ci.yml Disables persisted checkout credentials across jobs and slightly hardens scenario path handling via env vars.
.github/dependabot.yml Adds a 7-day cooldown to delay non-security Dependabot version updates.

Comment thread .github/workflows/zizmor.yml
@opentelemetry-pr-dashboard opentelemetry-pr-dashboard Bot mentioned this pull request Jul 15, 2026
Open
@opentelemetrybot
opentelemetrybot marked this pull request as ready for review July 15, 2026 18:09
@opentelemetrybot
opentelemetrybot requested a review from a team as a code owner July 15, 2026 18:09
@opentelemetry-pr-dashboard

opentelemetry-pr-dashboard Bot commented Jul 15, 2026

Copy link
Copy Markdown

This PR has review comments. Review suggestions, whether from maintainers or automated reviewers, aren't always correct or required. Please evaluate each comment on its merits, then make sure each thread has a clear outcome.

For example, link to the commit if you applied a suggestion, explain why it wasn't applied, or ask a follow-up question.

Automation flags a PR for human review once every review thread has a reply or is marked as resolved.

Status across open PRs is visible on the pull request dashboard.

@opentelemetrybot
opentelemetrybot marked this pull request as draft July 15, 2026 18:14
@trask
trask requested a review from Copilot July 15, 2026 18:15
Copilot AI reviewed Jul 15, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

@opentelemetrybot
opentelemetrybot marked this pull request as ready for review July 15, 2026 18:30
@trask
trask added this pull request to the merge queue Jul 15, 2026
@trask trask mentioned this pull request Jul 15, 2026
Open
14 tasks
Merged via the queue into open-telemetry:main with commit 44864bd Jul 15, 2026
43 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@trask trask trask approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@opentelemetrybot @github-advanced-security @trask