Fix zizmor audits - #2276
Merged
Merged
Conversation
Most of the issues are template injection that's not actually subject to template injection. Fixes guacsec#2269 Signed-off-by: Ben Cotton <ben@kusari.dev>
Fixes guacsec#2270 Signed-off-by: Ben Cotton <ben@kusari.dev>
Fixes guacsec#2271 Signed-off-by: Ben Cotton <ben@kusari.dev>
* Don't persist credentials in checkout * Scope permissions to the necessary jobs * Ignore safe uses of `ref_name` Fixes guacsec#2272 Signed-off-by: Ben Cotton <ben@kusari.dev>
Fixes guacsec#2274 Signed-off-by: Ben Cotton <ben@kusari.dev>
lumjjb
force-pushed
the
zizmor-audits
branch
from
November 13, 2024 19:02
d88c7a7 to
57daaa6
Compare
lumjjb
approved these changes
Nov 16, 2024
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Address most of the zizmor audits (except scorecard, which has an open question with the Scorecard project)
Fixes #2269
Fixes #2270
Fixes #2271
Fixes #2272
Fixes #2274
(Opened as a single PR because several of them involve changes to the new zizmor.yml file)
PR Checklist
-sflag togit commit.make generatehas been runmake generatehas been runmake generatehas been runcollectsubprotobuf has been changed,make protohas been run