Scan workflows with zizmor - #16
Open
myabc wants to merge 1 commit into
Open
Conversation
Mirrors the zizmor-scan workflow used by openproject-octicons and primer_view_components: pull requests that touch workflow files get audited, with results uploaded to code scanning. Getting to a clean run needed two changes to the existing workflows. zizmor's blanket policy wants actions pinned to a commit hash, so every uses: now carries a SHA with the tag in a trailing comment; Dependabot updates both together. Checkout also drops its credentials, which the test workflow never needed and which changesets/action does not use either, since it pushes through the GitHub API. The scan workflow itself pins checkout to the same v7 as the rest of the repo rather than the v6 the sibling repos use, and takes the current zizmor-action release.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
Adds a dedicated GitHub Actions workflow to run zizmor on workflow/action changes and hardens existing workflows to satisfy zizmor findings (pinning uses: to commit SHAs and disabling persisted checkout credentials where not needed).
Changes:
- Introduces a
zizmor-scanworkflow that runs on PRs touching.github/workflows/**/.github/actions/**and onworkflow_dispatch, uploading findings to code scanning. - Pins GitHub Action
uses:references to commit SHAs (with tag comments) to addressunpinned-uses. - Sets
actions/checkoutpersist-credentials: falsein relevant workflows to addressartipacked.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/zizmor-scan.yml | Adds zizmor workflow-security scanning with SARIF upload on workflow/action changes. |
| .github/workflows/test.yml | Pins action versions and disables persisted checkout credentials in CI tests. |
| .github/workflows/release.yml | Pins action versions and disables persisted checkout credentials for the release workflow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the zizmor workflow-security scan used by openproject-octicons and primer_view_components: pull requests touching
.github/workflows/**or.github/actions/**are audited, findings go to code scanning, and the job can also be run by hand viaworkflow_dispatch.A verbatim copy would have landed red — zizmor 1.29 reported 6 high and 2 low findings against the workflows already in this repo, so this PR fixes those too:
unpinned-uses(6, high): everyuses:is now pinned to a commit hash with the tag in a trailing comment. Dependabot understands this form and updates the hash and the comment together.artipacked(2, low): both checkouts now setpersist-credentials: false. The test workflow never pushed anything, andchangesets/actionpushes through the GitHub API rather than the git CLI, so neither needs the credentials on disk.zizmor --offline .github/workflows/is clean locally. Three pedantic-persona findings remain unaddressed and are out of scope here, since the default persona does not report them: job-level concurrency limits, workflow-level permissions inrelease.ymlbeing broader than any single step needs, and permissions blocks without explanatory comments.Two deviations from the sibling repos, both deliberate: checkout is pinned to v7 to match the rest of this repo rather than the v6 they use, and
zizmor-actionis at the current v0.6.2 rather than v0.5.3.The
release.ymlchanges cannot be exercised by this PR — that workflow only runs on push tomain, so the credentials change is verified by the next release run.