CI: Add workflow that runs zizmor latest - #9110
Conversation
github-actions
Bot
added
the
C-trivial
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
There was a problem hiding this comment.
Looks good, nice find and thank you for the PR.
Nope, there are way too many workflows for me to fix in the time I have available.
Yep. I tried doing the same. Luckily the vulnerabilities I've seen so far all seem okay until CI is opened up. We may want to ignore the template-injection rule and others to fix the lints one by one.
arya2
added
A-devops
|
@mergify refresh |
✅ Pull request refreshed |
oxarbitrage
added
do-not-merge
|
@mergify rebase |
✅ Branch has been successfully rebased |
a219853 to
e0f10bc
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Upload SARIF file | ||
| uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0 |
Check failure
Code scanning / zizmor
GHSA-vqf5-2xx6-9wfm
|
This pull request has been removed from the queue for the following reason: Pull request #9110 has been dequeued. The pull request rule doesn't match anymore You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it. |
|
@Mergifyio requeue |
✅ The queue state of this pull request has been cleaned. It can be re-embarked automatically |
6 participants
Source: zizmorcore/zizmor@c6fef48
Motivation
This repository has many GitHub Actions workflows.
zizmoris a static analysis tool that can find many common security issues in typical GitHub Actions CI/CD setups, such as the recent Ultralytics workflow vulnerability.Follow-up Work
zizmoridentifies a bunch of problems.I'll open a separate PR to fix the ones I can see how to fix.Nope, there are way too many workflows for me to fix in the time I have available.