[SECURITY] Fix zizmor issues + use pedantic persona#17
Merged
John McCall (lowlydba) merged 3 commits intomainfrom Apr 9, 2026
Merged
Conversation
Add a concurrency group to the PR checks workflow to deduplicate runs per pull request and cancel in-progress jobs for the same PR (uses workflow + PR number). Also update the zizmor action persona in the security checks workflow from `auditor` to `pedantic` to enable stricter pedantic scanning behavior. Signed-off-by: John McCall <john@overturemaps.org>
Signed-off-by: John McCall <john@overturemaps.org>
John McCall (lowlydba)
temporarily deployed
to
check-linked-issue-app
GitHub Actions
Inactive
Signed-off-by: John McCall <john@overturemaps.org>
John McCall (lowlydba)
temporarily deployed
to
check-linked-issue-app
GitHub Actions
Inactive
John McCall (lowlydba)
deleted the
16-task-increase-omf-security-checks-persona-for-zizmor
branch
There was a problem hiding this comment.
Pull request overview
Updates the repository’s GitHub Actions security/PR workflows to tighten zizmor checks and reduce redundant workflow runs, aligning with stricter security scanning expectations for public repos.
Changes:
- Switch zizmor from the
auditorpersona to the stricterpedanticpersona and disable Advanced Security SARIF upload in favor of PR annotations. - Add workflow-level concurrency to PR checks to cancel superseded runs for the same PR.
- Rename the security checks workflow to reflect the
pedanticposture.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/omf_sec_checks.yml | Moves zizmor to pedantic and changes reporting mode; updates workflow display name. |
| .github/workflows/omf_pr_checks.yml | Adds concurrency grouping/cancelation for PR-target runs. |
Comments suppressed due to low confidence (1)
.github/workflows/omf_sec_checks.yml:14
- The workflow header comments still state that zizmor runs with the 'auditor' persona and uploads SARIF to Advanced Security, but the workflow name now indicates 'pedantic'. Please update the top-of-file documentation to match the new persona/behavior so the security posture is accurately described.
name: OMF Security Checks
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+45
to
+46
| persona: pedantic | ||
| advanced-security: false # Use GH PR Annotations instead of uploading SARIF results for better visibility in the PR |
There was a problem hiding this comment.
With advanced-security: false, zizmor will not upload SARIF, but the job still requests security-events: write permissions. For least privilege, either drop security-events: write (and any related SARIF-upload wording) or re-enable Advanced Security upload if that's the intent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The pedantic persona is a stricter checker, and its what we want to use across the board for public repos that are held to this workflow's checks.