ci: zizmor workflow#13901
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # Upload the results to GitHub's code scanning dashboard. | ||
| - name: "Upload to code-scanning" | ||
| uses: github/codeql-action/upload-sarif@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2 | ||
| uses: github/codeql-action/upload-sarif@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a dedicated zizmor GitHub Actions workflow for workflow security linting, and aligns existing workflows with tighter permission defaults and clearer action pin annotations. It also enables Dependabot updates for GitHub Actions.
Changes:
- Add
.github/workflows/zizmor.ymlto run zizmor and upload security findings (SARIF). - Harden/standardize workflow permissions (e.g., explicit
permissions: {}/contents: read) and adjust ordering. - Enable Dependabot updates for
github-actionsand refresh pinned-action version comments.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/zizmor.yml |
Adds zizmor reusable-workflow invocation and SARIF upload permissions. |
.github/workflows/stale.yml |
Cleans up header comments and updates pinned-action version annotation. |
.github/workflows/scorecards.yml |
Sets explicit empty top-level permissions and updates pinned-action version annotations. |
.github/workflows/pr-review.yml |
Reorders permissions/on blocks and adjusts zizmor trigger linting ignore. |
.github/workflows/pr-review-trigger.yml |
Reorders the on: block without changing behavior. |
.github/workflows/merge.yml |
Moves top-level permissions earlier for clarity/consistency. |
.github/workflows/docs-upstream.yml |
Removes redundant permission explanation comments; updates pinned-action version annotations. |
.github/workflows/ci.yml |
Moves top-level permissions earlier; updates pinned-action version annotations. |
.github/dependabot.yml |
Adds Dependabot updates for github-actions. |
docker-agent
reviewed
Jul 6, 2026
docker-agent
left a comment
docker-agent
left a comment
Contributor
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
This PR introduces the zizmor security scanning workflow and fixes zizmor findings across existing CI workflows. Most changes are safe reorganizations (moving permissions: blocks, adding version comments, updating dependabot config). However, two issues in .github/workflows/pr-review.yml appear to be functional regressions introduced by this PR.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
docker-agent
reviewed
Jul 6, 2026
docker-agent
left a comment
docker-agent
left a comment
Contributor
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
This PR makes CI workflow hardening changes as flagged by zizmor:
- Permissions block placement: Moves top-level
permissions:blocks to appear beforeon:inci.yml,merge.yml, andpr-review.yml— this is the zizmor-preferred ordering and has no functional impact. - Version comment precision: Updates action version comments from short form (e.g.,
# v6) to full semver (e.g.,# v6.0.2) — all SHAs remain unchanged, so no actual action version changes. - scorecards.yml: Adds
permissions: {}at the workflow level; the job-level permissions (security-events: write,id-token: write) remain intact and are sufficient. - zizmor.yml (new): Delegates to
crazy-max/.githubreusable workflow pinned by SHA (46267a6e61cd56aac2fc79943df180152f4c89d6) withmin-severity: medium,min-confidence: medium, andpersona: pedantic. Permissions are correctly scoped (contents: read,security-events: write). - dependabot.yml: Adds
github-actionsecosystem with a 7-day cooldown — straightforward and correct. - Miscellaneous: Removes trailing whitespace/blank lines, removes verbose comment blocks that were redundant given the code.
No bugs or regressions introduced. All changes are mechanical improvements to workflow hygiene.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
similar to moby/buildkit#6623