✨ Add workflow security audit with zizmor by Copilot · Pull Request #6370 · dubzzz/fast-check

Copilot · 2025-12-15T21:15:08Z

Adds automated security auditing of GitHub Actions workflows using zizmor, which detects template injection, credential leakage, excessive permissions, and other security issues.

Workflow triggers

Path-based: Runs on PRs and pushes when .github/workflows/** changes

Implementation details

Installs zizmor via pipx (pinned to version 1.18.0 for reproducible builds)
Scans entire repository with zizmor .
Follows repository conventions: pinned action versions, minimal permissions, branch patterns, and concurrency controls
Includes cancel-in-progress: true to prevent wasting CI resources when new commits are pushed
Uses generic workflow name "Workflow Security Audit" to be tool-agnostic
Sets persist-credentials: false to prevent credential persistence through artifacts

The workflow will surface security findings for review when workflows are modified.

> [!WARNING]
>
>

Original prompt

please setup a workflow to run zizmor whenever a workflow get changed or zizmor gets updated. you can find more on zizmor here: https://github.com/zizmorcore/zizmor

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

changeset-bot · 2025-12-15T21:15:11Z

⚠️ No Changeset found

Latest commit: 6e2d74f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

dubzzz · 2025-12-15T21:22:34Z

+          # Install zizmor using pipx for isolated environment
+          # Note: We intentionally don't pin the version to ensure the scheduled
+          # runs benefit from the latest security checks and issue detection
+          pipx install zizmor


Please pin the version

@copilot Please pin the version

Pinned to version 1.18.0 in dacac35

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

Copilot

Pull request overview

This PR introduces a new GitHub Actions workflow to run zizmor, a security auditing tool for GitHub Actions workflows. The workflow is designed to run automatically when workflow files are modified, on a weekly schedule to catch new zizmor releases and newly discovered security issues, and can also be triggered manually.

Key changes:

Adds automated security auditing for GitHub Actions workflows using zizmor
Configures multiple trigger mechanisms: pull requests, pushes, scheduled runs, and manual dispatch
Pins zizmor to version 1.18.0 and installs it via pipx for isolation

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

pkg-pr-new · 2025-12-15T21:54:02Z

@fast-check/examples

@fast-check/ava

npm i https://pkg.pr.new/@fast-check/ava@6370

@fast-check/expect-type

npm i https://pkg.pr.new/@fast-check/expect-type@6370

fast-check

npm i https://pkg.pr.new/fast-check@6370

@fast-check/jest

npm i https://pkg.pr.new/@fast-check/jest@6370

@fast-check/packaged

npm i https://pkg.pr.new/@fast-check/packaged@6370

@fast-check/poisoning

npm i https://pkg.pr.new/@fast-check/poisoning@6370

@fast-check/vitest

npm i https://pkg.pr.new/@fast-check/vitest@6370

@fast-check/worker

npm i https://pkg.pr.new/@fast-check/worker@6370

commit: 6e2d74f

github-actions · 2025-12-15T21:54:07Z

👋 A preview of the new documentation is available at: http://6940837f57ee7b95774adaca--dubzzz-fast-check.netlify.app

dubzzz · 2025-12-15T21:54:52Z

+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: 'Audit GitHub Actions workflows'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: Install zizmor
+        run: |
+          # Install zizmor using pipx for isolated environment
+          pipx install zizmor==1.18.0
+


@copilot drop comments, they don't bring any value

Removed unnecessary comments in c79e1ac

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

github-actions · 2025-12-15T22:03:19Z

👋 A preview of the new documentation is available at: http://694085a657ee7b99b04adb07--dubzzz-fast-check.netlify.app

github-actions · 2025-12-15T22:13:34Z

👋 A preview of the new documentation is available at: http://6940880df7d34ab1fbfb03ab--dubzzz-fast-check.netlify.app

codecov · 2025-12-15T22:18:08Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.82%. Comparing base (b73ca90) to head (6e2d74f).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6370   +/-   ##
=======================================
  Coverage   94.82%   94.82%           
=======================================
  Files         206      206           
  Lines        5503     5503           
  Branches     1442     1442           
=======================================
  Hits         5218     5218           
  Misses        272      272           
  Partials       13       13

Flag	Coverage Δ
tests	`94.82% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2025-12-15T23:06:57Z

👋 A preview of the new documentation is available at: http://6940949000a2b3ebef0ca9b3--dubzzz-fast-check.netlify.app

dubzzz · 2025-12-16T10:24:27Z

@copilot could you fix warning[artipacked]: credential persistence through GitHub Actions artifacts
--> ./.github/workflows/zizmor.yml:31:9
|
31 | - uses: actions/checkout@8e8c483 # v6.0.1
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
|
= note: audit confidence → Low
= note: this finding has an auto-fix

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

Copilot · 2025-12-16T10:26:23Z

@copilot could you fix warning[artipacked]: credential persistence through GitHub Actions artifacts
--> ./.github/workflows/zizmor.yml:31:9
|
...

Added persist-credentials: false to the checkout action in 6e2d74f

github-actions · 2025-12-16T10:34:57Z

👋 A preview of the new documentation is available at: http://694135d1f9e783551932a675--dubzzz-fast-check.netlify.app

Initial plan

3b58af5

Copilot AI assigned Copilot and dubzzz Dec 15, 2025

Copilot started work on behalf of dubzzz December 15, 2025 21:15 View session

Copilot AI and others added 2 commits December 15, 2025 21:19

✨ Add zizmor workflow for GitHub Actions security audits

d8be5b9

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

📝 Add comment explaining intentional lack of version pinning

01658c4

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add workflow to run Zizmor on changes~~ ✨ Add zizmor workflow for GitHub Actions security audits Dec 15, 2025

Copilot AI requested a review from dubzzz December 15, 2025 21:21

Copilot finished work on behalf of dubzzz December 15, 2025 21:22

dubzzz reviewed Dec 15, 2025

View reviewed changes

Copilot started work on behalf of dubzzz December 15, 2025 21:45 View session

📌 Pin zizmor version to 1.18.0

dacac35

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

dubzzz marked this pull request as ready for review December 15, 2025 21:47

Copilot AI review requested due to automatic review settings December 15, 2025 21:47

Copilot started reviewing on behalf of dubzzz December 15, 2025 21:48 View session

Copilot AI requested a review from dubzzz December 15, 2025 21:48

Copilot finished work on behalf of dubzzz December 15, 2025 21:48

Copilot AI reviewed Dec 15, 2025

View reviewed changes

Comment thread .github/workflows/zizmor.yml

Comment thread .github/workflows/zizmor.yml

Update .github/workflows/zizmor.yml

5d76c4e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of dubzzz December 15, 2025 21:52 View session

♻️ Add concurrency controls to prevent redundant workflow runs

dc1dea1

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

dubzzz reviewed Dec 15, 2025

View reviewed changes

Copilot AI requested a review from dubzzz December 15, 2025 21:55

Copilot finished work on behalf of dubzzz December 15, 2025 21:55

Copilot started work on behalf of dubzzz December 15, 2025 21:56 View session

🔥 Remove schedule and manual triggers, clean up comments

c79e1ac

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

Copilot finished work on behalf of dubzzz December 15, 2025 21:59

dubzzz reviewed Dec 15, 2025

View reviewed changes

Comment thread .github/workflows/zizmor.yml

Comment thread .github/workflows/zizmor.yml Outdated

Update .github/workflows/zizmor.yml

f746e2b

Copilot started work on behalf of dubzzz December 15, 2025 22:00 View session

♻️ Rename workflow to use generic name instead of tool-specific

fda552c

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

Copilot AI changed the title ~~✨ Add zizmor workflow for GitHub Actions security audits~~ ✨ Add workflow security audit with zizmor Dec 15, 2025

Copilot AI requested a review from dubzzz December 15, 2025 22:03

Copilot finished work on behalf of dubzzz December 15, 2025 22:03

Merge branch 'main' into copilot/setup-zizmor-workflow-trigger

fe994fd

dubzzz approved these changes Dec 15, 2025

View reviewed changes

Merge branch 'main' into copilot/setup-zizmor-workflow-trigger

907e91c

Copilot started work on behalf of dubzzz December 16, 2025 10:25 View session

🔒 Add persist-credentials: false to prevent credential leakage

6e2d74f

Co-authored-by: dubzzz <5300235+dubzzz@users.noreply.github.com>

Copilot AI requested a review from dubzzz December 16, 2025 10:27

Copilot finished work on behalf of dubzzz December 16, 2025 10:27

dubzzz approved these changes Dec 16, 2025

View reviewed changes

dubzzz enabled auto-merge (squash) December 16, 2025 10:32

dubzzz merged commit 1d6eb8e into main Dec 16, 2025
90 of 134 checks passed

dubzzz deleted the copilot/setup-zizmor-workflow-trigger branch December 16, 2025 15:28

ghost-of-high-heart Bot mentioned this pull request Apr 3, 2026

Update fast-check to 4.6.0 wereHamster/computation#506

Merged

Conversation

Copilot AI commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Workflow triggers

Implementation details

Uh oh!

changeset-bot Bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

dubzzz Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

dubzzz Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

pkg-pr-new Bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Dec 15, 2025

Uh oh!

Uh oh!

Uh oh!

dubzzz Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Dec 15, 2025

Uh oh!

github-actions Bot commented Dec 15, 2025

Uh oh!

codecov Bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Dec 15, 2025

Uh oh!

dubzzz commented Dec 16, 2025

Uh oh!

Copilot AI commented Dec 16, 2025

Uh oh!

github-actions Bot commented Dec 16, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Dec 15, 2025 •

edited

Loading

changeset-bot Bot commented Dec 15, 2025 •

edited

Loading

pkg-pr-new Bot commented Dec 15, 2025 •

edited

Loading

codecov Bot commented Dec 15, 2025 •

edited

Loading