Skip to content

[BUG]: zizmor currently flags maturin's generated workflow for sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} being vulnerable to a cache poisoning attack #1940

@abelaba

Description

@abelaba

Pre-submission checks

  • I am not filing a feature request. These should be filed via the feature request form instead.
  • I have checked the Troubleshooting Guide for my problem.
  • I have looked through both the open and closed issues for a duplicate report.

zizmor version

1.24.1

Expected behavior

It was reported in this issue that the error shown by zizmor for sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} could be a potential false-positive.

Actual behavior

zizmor currently reports sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} as being vulnerable to a cache poisoning attack.

Reproduction steps

  1. Generate a workflow using maturin generate-ci
  2. Run uvx zizmor on the generated workflow.

Logs

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> ./.github/workflows/build-and-release.yaml:126:9
    |
  8 | / on:
  9 | |   push:
 10 | |     branches:
 11 | |       - master
 12 | |     tags:
 13 | |       - '*'
    | |___________- generally used when publishing artifacts generated at runtime
...
126 |           uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
127 | /         with:
128 | |           target: ${{ matrix.platform.target }}
129 | |           args: --release --out dist --find-interpreter
130 | |           sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
    | |_______________________________________________________________- may enable caching here
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix

Additional context

If it helps this is the workflow I ran zizmor on, and got the error. Additionally locally I also ran pinact to pin the commit SHAs, before running zizmor on the workflow.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions