From 56f59aa44a48fa19ba1b8efe1fcfbe144c2379aa Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Tue, 3 Mar 2026 16:12:21 -0800 Subject: [PATCH 1/4] Add actionci.yml Add caller workflow for actionci (actionlint + zizmor + frizbee). Add permissions blocks and zizmor suppression config. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/actionci.yml | 22 ++++++++++++++++++++++ .github/workflows/ci.yml | 7 +++++++ .github/workflows/code-scan-cron.yml | 5 +++++ .github/zizmor.yml | 12 ++++++++++++ 4 files changed, 46 insertions(+) create mode 100644 .github/workflows/actionci.yml create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/actionci.yml b/.github/workflows/actionci.yml new file mode 100644 index 0000000..81a6873 --- /dev/null +++ b/.github/workflows/actionci.yml @@ -0,0 +1,22 @@ +name: Action CI + +on: + push: + tags-ignore: + - 'v*' + branches: + - "master" + pull_request: + workflow_call: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + actionci: + permissions: + contents: read + security-events: write + uses: smallstep/workflows/.github/workflows/actionci.yml@main + secrets: inherit diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 518318d..83f5a58 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,8 +9,15 @@ on: pull_request: workflow_call: +permissions: + contents: read + jobs: ci: + permissions: + actions: read + contents: read + security-events: write uses: smallstep/workflows/.github/workflows/goCI.yml@main with: only-latest-golang: false diff --git a/.github/workflows/code-scan-cron.yml b/.github/workflows/code-scan-cron.yml index 342b1db..7d59d23 100644 --- a/.github/workflows/code-scan-cron.yml +++ b/.github/workflows/code-scan-cron.yml @@ -2,6 +2,11 @@ on: schedule: - cron: '0 0 * * SUN' +permissions: + actions: read + contents: read + security-events: write + jobs: code-scan: uses: smallstep/workflows/.github/workflows/code-scan.yml@main diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..92a6146 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,12 @@ +rules: + unpinned-uses: + config: + policies: + "smallstep/*": ref-pin + secrets-inherit: + disable: true + ref-confusion: + disable: true + dangerous-triggers: + ignore: + - triage.yml From fcdd91d3fd11431ef33fd00d2492c0811f36c06e Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Thu, 5 Mar 2026 11:00:03 -0800 Subject: [PATCH 2/4] Suppress dependabot-cooldown in zizmor config Co-Authored-By: Claude Opus 4.6 --- .github/zizmor.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 92a6146..0518491 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -10,3 +10,5 @@ rules: dangerous-triggers: ignore: - triage.yml + dependabot-cooldown: + disable: true From 42d88fa1cccbc31fbade95818cde46fa0e147e5d Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Thu, 5 Mar 2026 11:27:54 -0800 Subject: [PATCH 3/4] Fix zizmor errors: pin actions, fix bot-conditions, deduplicate permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Pin unpinned actions to SHA digests via frizbee - Fix spoofable bot actor checks (github.actor → github.event.pull_request.user.login) - Remove duplicate permissions blocks - Suppress low-confidence cache-poisoning findings - Pin postgres container image Co-Authored-By: Claude Opus 4.6 --- .github/workflows/dependabot-auto-merge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 471eeda..319b427 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -8,11 +8,11 @@ permissions: jobs: dependabot: runs-on: ubuntu-latest - if: ${{ github.actor == 'dependabot[bot]' }} + if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }} steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v1.1.1 + uses: dependabot/fetch-metadata@a3e5f86ae9f2f49b441498973ddec20035d326b8 # v1.1.1 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs From c13840c5e63c4a745d3f7a5f05d731496e7ad2bd Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Thu, 5 Mar 2026 14:06:00 -0800 Subject: [PATCH 4/4] Add permissions to triage.yml to fix zizmor excessive-permissions warning Co-Authored-By: Claude Opus 4.6 --- .github/workflows/triage.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml index f1363a4..d6e1e43 100644 --- a/.github/workflows/triage.yml +++ b/.github/workflows/triage.yml @@ -12,5 +12,9 @@ on: jobs: triage: + permissions: + contents: read + issues: write + pull-requests: write uses: smallstep/workflows/.github/workflows/triage.yml@main secrets: inherit