Recommend required zizmor scans across OpenTelemetry repositories

Summary

I would like to recommend enabling required zizmor scans across OpenTelemetry repositories to continuously check GitHub Actions workflows for security issues.

zizmor is a static analysis tool for GitHub Actions workflows. It helps detect common CI/CD security problems before they are merged, including template injection, unsafe credential handling, excessive token permissions, risky workflow triggers, and ambiguous or mutable references.

Relevant links:

• zizmor project: https://github.com/zizmorcore/zizmor
• zizmor documentation: https://docs.zizmor.sh/
• Audit rules: https://docs.zizmor.sh/audits/
• GitHub Actions integration: https://docs.zizmor.sh/integrations/
• zizmor-action: https://github.com/zizmorcore/zizmor-action
• GitHub Marketplace action: https://github.com/marketplace/actions/zizmor-action

Why this is important

GitHub Actions workflows are part of the project supply chain. A small workflow mistake can expose repository credentials, allow attacker-controlled code execution, or weaken release/build integrity. Because OpenTelemetry has many repositories and many maintainers, these checks should be consistent and required by default rather than added only repo by repo.

Recent .NET repository work showed that enabling zizmor immediately found actionable hardening items:

• [Infra] Add zizmor scan workflow opentelemetry-dotnet#7331 added the zizmor scan workflow.
• [Infra] Zizmor fixes opentelemetry-dotnet#7334 fixed findings after enabling it, including replacing floating runner labels such as windows-latest and adding safer checkout settings.
• [Infra] Add zizmor scan workflow opentelemetry-dotnet-contrib#4419 added the scan workflow.
• [Infra] zizmor fixes opentelemetry-dotnet-contrib#4425 fixed findings after enabling it, including replacing floating runner labels such as windows-latest, ubuntu-latest, and macos-latest.
• [Repo] Add dependency cooldown opentelemetry-dotnet-contrib#4423 added dependency cooldown configuration.
• [Infra] Add zizmor scan workflow and address findings opentelemetry-dotnet-instrumentation#5077 adds the scan workflow and addresses findings, including safer handling of workflow inputs, disabling persisted checkout credentials where not needed, and dependency cooldown configuration.

Types of issues this can prevent

Enabling zizmor across OTel repositories can help prevent or reduce:

• Template injection in workflow run steps where attacker-controlled values are interpolated into shell commands.
• Accidental credential persistence from actions/checkout when persist-credentials is left enabled unnecessarily.
• Overly broad GITHUB_TOKEN permissions or credentials granted to jobs that do not need them.
• Risk from floating runner labels such as *-latest, where the build environment can change unexpectedly.
• Supply-chain risk from very new dependency releases by encouraging dependency cooldown configuration.
• Unsafe or ambiguous GitHub Actions references, including mutable refs and confusing commit references.
• Risky workflow patterns around pull requests, reusable workflows, secrets, and artifact handling.

Proposed implementation

I recommend implementing this centrally in open-telemetry/admin, following the same opt-out/default-required model being proposed for CodeQL:

• CodeQL default-required example: open-telemetry/admin#671
• Existing zizmor required-check proposal for .NET repos: open-telemetry/admin#672

The desired end state would be that OpenTelemetry repositories get a required zizmor code scanning check by default, with documented opt-out handling for repositories where it is not yet applicable.