chore: add zizmor workflow to harden GitHub Actions security by Copilot · Pull Request #968 · CycloneDX/cyclonedx-python-lib

Copilot · 2026-04-25T10:46:49Z

Description

Resolves all warnings and notices surfaced by the zizmor CI audit run across dependabot.yml, python.yml, and release.yml.

dependabot.yml — Added cooldown.default-days: 7 to both pip and github-actions update entries to satisfy zizmor's insufficient-cooldown audit.
python.yml — Added persist-credentials: false to all 7 actions/checkout steps; prevents the checkout token from being stored in the local git config and potentially leaking via artifacts.
release.yml — Same persist-credentials: false fix on all 3 checkout steps. Additionally fixed a code injection via template expansion: ${{ steps.release-bot-token.outputs.app-slug }} was interpolated directly into a run script; moved to an env variable instead.

Resolves or fixes issue: none

AI Tool Disclosure

My contribution does not include any AI-generated content
My contribution includes AI-generated content, as disclosed below:
- AI Tools: GitHub Copilot
- LLMs and versions: Claude Sonnet 4
- Prompts: Fix all zizmor security findings surfaced in PR #968 across dependabot.yml, python.yml, and release.yml

Affirmation

My code follows the CONTRIBUTING.md guidelines

codacy-production · 2026-04-25T10:47:34Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-python-lib/sessions/f5512c78-6b6d-46ca-adf5-4cf6045187b0 Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>

…flow Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-python-lib/sessions/b5733fc7-3e3a-4c62-a94c-54620cce9147 Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck · 2026-04-25T11:05:14Z

did originally instruct Copilot not to fix any findsings from zizmor, so show that the workflow is usable and actually detects the things i already know.

chore: use dependabot cooldown period #965
not have git tokens persisted

workflow is running, and working as expected.
findings so far: https://github.com/CycloneDX/cyclonedx-python-lib/actions/runs/24929412066/job/73004645748?pr=968#step:3:93


 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed ./.github/dependabot.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/python.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/release.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/zizmor.yml
Warning: dependabot.yml:5: insufficient cooldown in Dependabot updates: missing cooldown configuration
Warning: dependabot.yml:19: insufficient cooldown in Dependabot updates: missing cooldown configuration
Warning: python.yml:34: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: python.yml:58: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: python.yml:82: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: python.yml:106: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: python.yml:142: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: python.yml:192: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: python.yml:270: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: release.yml:49: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: release.yml:71: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: release.yml:122: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Notice: release.yml:118: code injection via template expansion: may expand into attacker-controllable code

jkowalleck · 2026-04-25T11:06:07Z

@copilot create a new branch from here, and have all those findings from zizmor fixed.
create a new pullrequest pointing to here.

Copilot · 2026-04-25T11:06:16Z

@jkowalleck I've opened a new pull request, #969, to work on those changes. Once the pull request is ready, I'll request review from you.

jkowalleck · 2026-04-25T11:19:36Z

@copilot use the repositories own pull request template in the PR descrioption.

Copilot · 2026-04-25T11:21:24Z

@copilot use the repositories own pull request template in the PR descrioption.

I don't have a tool available to directly edit the description of PR #969 from this session. Here is the description formatted with the repository's PR template that should be applied to PR #969:

Description

Resolves all warnings and notices surfaced by the zizmor CI audit run across dependabot.yml, python.yml, and release.yml.

dependabot.yml — Added cooldown.default-days: 7 to both pip and github-actions update entries to satisfy zizmor's insufficient-cooldown check.
python.yml — Added persist-credentials: false to all 7 actions/checkout steps to prevent the checkout token from being stored in the local git config.
release.yml — Same persist-credentials: false fix on all 3 checkout steps. Fixed a code injection via template expansion by moving ${{ steps.release-bot-token.outputs.app-slug }} into an env variable instead of interpolating it directly in the run script.

Resolves or fixes issue: none

AI Tool Disclosure

My contribution does not include any AI-generated content
My contribution includes AI-generated content, as disclosed below:
- AI Tools: GitHub Copilot
- LLMs and versions: Claude Sonnet 4
- Prompts: Fix all zizmor security findings surfaced in PR #968 across dependabot.yml, python.yml, and release.yml

Affirmation

My code follows the CONTRIBUTING.md guidelines

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh pr view 969 --json number,title (http block)
- Triggering command: /usr/bin/gh gh auth status (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

webknjaz · 2026-04-25T13:37:30Z

Could just paste https://github.com/jazzband/pip-tools/blob/6be966f0c1677bdf5a49f7a8d46544f7208353b0/.github/workflows/ci.yml#L532-L538 into the main workflow 🤷‍♂️

Also, additionally integrate Zizmor into the pre-commit framework config

Initial plan

8392d36

Copilot AI assigned Copilot and jkowalleck Apr 25, 2026

Copilot AI linked an issue Apr 25, 2026 that may be closed by this pull request

chore: Harden all GitHub Workflows using Zizmor #967

Open

Copilot started work on behalf of jkowalleck April 25, 2026 10:46 View session

chore: add zizmor workflow for GitHub Actions security analysis

e114a64

Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-python-lib/sessions/f5512c78-6b6d-46ca-adf5-4cf6045187b0 Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add Zizmor to harden GitHub workflows~~ chore: add zizmor workflow to harden GitHub Actions security Apr 25, 2026

Copilot AI requested a review from jkowalleck April 25, 2026 10:52

Copilot finished work on behalf of jkowalleck April 25, 2026 10:52

Copilot started work on behalf of jkowalleck April 25, 2026 10:53 View session

Copilot finished work on behalf of jkowalleck April 25, 2026 10:54

Copilot started work on behalf of jkowalleck April 25, 2026 10:54 View session

chore: add comment explaining advanced-security: false in zizmor work…

51bc9a5

…flow Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-python-lib/sessions/b5733fc7-3e3a-4c62-a94c-54620cce9147 Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>

Copilot finished work on behalf of jkowalleck April 25, 2026 10:56

jkowalleck requested changes Apr 25, 2026

View reviewed changes

Comment thread .github/workflows/zizmor.yml Outdated

Update .github/workflows/zizmor.yml

8ad0fd2

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Copilot started work on behalf of jkowalleck April 25, 2026 11:02 View session

Copilot finished work on behalf of jkowalleck April 25, 2026 11:03

Copilot AI requested a review from jkowalleck April 25, 2026 11:03

Copilot AI mentioned this pull request Apr 25, 2026

fix: address all zizmor security findings in GitHub Actions workflows #969

Open

3 tasks

Copilot started work on behalf of jkowalleck April 25, 2026 11:19 View session

Copilot finished work on behalf of jkowalleck April 25, 2026 11:21

jkowalleck marked this pull request as ready for review April 25, 2026 11:25

jkowalleck requested a review from a team as a code owner April 25, 2026 11:25

webknjaz reviewed Apr 25, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: add zizmor workflow to harden GitHub Actions security#968

chore: add zizmor workflow to harden GitHub Actions security#968
Copilot wants to merge 4 commits intomainfrom
copilot/chore-harden-github-workflows

Copilot AI commented Apr 25, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented Apr 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

jkowalleck commented Apr 25, 2026 •

edited

Loading

Uh oh!

jkowalleck commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

jkowalleck commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

webknjaz Apr 25, 2026

Uh oh!

webknjaz Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

AI Tool Disclosure

Affirmation

Uh oh!

codacy-production Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

Uh oh!

jkowalleck commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

jkowalleck commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

AI Tool Disclosure

Affirmation

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

webknjaz Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

webknjaz Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 25, 2026 •

edited

Loading

codacy-production Bot commented Apr 25, 2026 •

edited

Loading

jkowalleck commented Apr 25, 2026 •

edited

Loading

Copilot AI commented Apr 25, 2026 •

edited

Loading