Pre-submission checks
zizmor version
1.24.1
Expected behavior
It was reported in this issue that the error shown by zizmor for sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} could be a potential false-positive.
Actual behavior
zizmor currently reports sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} as being vulnerable to a cache poisoning attack.
Reproduction steps
- Generate a workflow using
maturin generate-ci
- Run
uvx zizmor on the generated workflow.
Logs
error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
--> ./.github/workflows/build-and-release.yaml:126:9
|
8 | / on:
9 | | push:
10 | | branches:
11 | | - master
12 | | tags:
13 | | - '*'
| |___________- generally used when publishing artifacts generated at runtime
...
126 | uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
127 | / with:
128 | | target: ${{ matrix.platform.target }}
129 | | args: --release --out dist --find-interpreter
130 | | sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
| |_______________________________________________________________- may enable caching here
|
= note: audit confidence → Low
= note: this finding has an auto-fix
Additional context
If it helps this is the workflow I ran zizmor on, and got the error. Additionally locally I also ran pinact to pin the commit SHAs, before running zizmor on the workflow.
Pre-submission checks
zizmor version
1.24.1
Expected behavior
It was reported in this issue that the error shown by
zizmorforsccache: ${{ !startsWith(github.ref, 'refs/tags/') }}could be a potential false-positive.Actual behavior
zizmorcurrently reportssccache: ${{ !startsWith(github.ref, 'refs/tags/') }}as being vulnerable to a cache poisoning attack.Reproduction steps
maturin generate-ciuvx zizmoron the generated workflow.Logs
Additional context
If it helps this is the workflow I ran
zizmoron, and got the error. Additionally locally I also ranpinactto pin the commit SHAs, before runningzizmoron the workflow.