Hardening github actions

[j178]

• Pin action to commits
• Add zizmor action
• Set persist-credentials: false for actions/checkout

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.05%. Comparing base (9c2cf54) to head (4a7e87a).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #947   +/-   ##
=======================================
  Coverage   90.05%   90.05%           
=======================================
  Files          65       65           
  Lines       12036    12036           
=======================================
  Hits        10839    10839           
  Misses       1197     1197           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[potiuk]

Nice! Thanks for being responsive.

[potiuk]

One other small comment. We use "octopin" from the eclipse foundation (and with monorepo support of prek it is nicely separate in a separate .pre-commit.yaml - see https://github.com/apache/airflow/blob/main/dev/.pre-commit-config.yaml - to nicely keep hash-commits updaed for our actions with comments about the version used. Also recommended.

[github-actions]

📦 Cargo Bloat Comparison

Binary size change: +0.00% (16.1 MiB → 16.1 MiB)

Expand for cargo-bloat output

PR Branch Results

 File  .text     Size          Crate Name
 0.6%   1.4% 101.1KiB          prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.5%   1.1%  85.8KiB           prek prek::builtin::pre_commit_hooks::Implemented::run::{{closure}}
 0.5%   1.0%  76.8KiB           prek prek::languages::<impl prek::config::Language>::run::{{closure}}
 0.4%   0.9%  69.5KiB           prek prek::run::{{closure}}
 0.4%   0.8%  58.4KiB           prek prek::archive::unpack::{{closure}}
 0.2%   0.5%  40.9KiB regex_automata regex_automata::meta::strategy::new
 0.2%   0.5%  40.1KiB          prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.2%   0.5%  38.5KiB           prek prek::identify::by_extension::{{closure}}
 0.2%   0.5%  35.8KiB           prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.2%   0.4%  32.9KiB           prek prek::workspace::Workspace::discover
 0.2%   0.4%  32.0KiB           prek prek::cli::run::run::run::{{closure}}
 0.2%   0.4%  31.9KiB           prek prek::languages::node::installer::NodeInstaller::install::{{closure}}
 0.2%   0.4%  31.8KiB             h2 h2::proto::connection::DynConnection<B>::recv_frame
 0.2%   0.4%  31.7KiB             h2 h2::proto::connection::Connection<T,P,B>::poll
 0.2%   0.4%  26.2KiB     hyper_util hyper_util::client::legacy::client::Client<C,B>::send_request::{{closure}}
 0.2%   0.3%  25.8KiB     hyper_util hyper_util::client::legacy::client::Client<C,B>::connect_to::{{closure}}::{{closure}}::{{closure}}
 0.2%   0.3%  25.2KiB        globset globset::GlobSetBuilder::build
 0.2%   0.3%  24.9KiB           prek prek::main
 0.1%   0.3%  24.4KiB           prek prek::languages::golang::installer::GoInstaller::install::{{closure}}
 0.1%   0.3%  23.7KiB          hyper hyper::proto::h1::dispatch::Dispatcher<D,Bs,I,T>::poll_loop
39.7%  87.5%   6.4MiB                And 10105 smaller methods. Use -n N to show more.
45.4% 100.0%   7.3MiB                .text section size, the file size is 16.1MiB

Base Branch Results

 File  .text     Size          Crate Name
 0.6%   1.4% 101.1KiB          prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.5%   1.1%  85.8KiB           prek prek::builtin::pre_commit_hooks::Implemented::run::{{closure}}
 0.5%   1.0%  76.8KiB           prek prek::languages::<impl prek::config::Language>::run::{{closure}}
 0.4%   0.9%  69.5KiB           prek prek::run::{{closure}}
 0.4%   0.8%  58.4KiB           prek prek::archive::unpack::{{closure}}
 0.2%   0.5%  40.9KiB regex_automata regex_automata::meta::strategy::new
 0.2%   0.5%  40.1KiB          prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.2%   0.5%  38.5KiB           prek prek::identify::by_extension::{{closure}}
 0.2%   0.5%  35.8KiB           prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.2%   0.4%  32.9KiB           prek prek::workspace::Workspace::discover
 0.2%   0.4%  32.0KiB           prek prek::cli::run::run::run::{{closure}}
 0.2%   0.4%  31.9KiB           prek prek::languages::node::installer::NodeInstaller::install::{{closure}}
 0.2%   0.4%  31.8KiB             h2 h2::proto::connection::DynConnection<B>::recv_frame
 0.2%   0.4%  31.7KiB             h2 h2::proto::connection::Connection<T,P,B>::poll
 0.2%   0.4%  26.2KiB     hyper_util hyper_util::client::legacy::client::Client<C,B>::send_request::{{closure}}
 0.2%   0.3%  25.8KiB     hyper_util hyper_util::client::legacy::client::Client<C,B>::connect_to::{{closure}}::{{closure}}::{{closure}}
 0.2%   0.3%  25.2KiB        globset globset::GlobSetBuilder::build
 0.2%   0.3%  24.9KiB           prek prek::main
 0.1%   0.3%  24.4KiB           prek prek::languages::golang::installer::GoInstaller::install::{{closure}}
 0.1%   0.3%  23.7KiB          hyper hyper::proto::h1::dispatch::Dispatcher<D,Bs,I,T>::poll_loop
39.7%  87.5%   6.4MiB                And 10105 smaller methods. Use -n N to show more.
45.4% 100.0%   7.3MiB                .text section size, the file size is 16.1MiB

[lmmx]

Great work here @j178 👏

You can also enforce SHA pinning as repo policy now (you may already have)

Enforce SHA pinning

To proactively limit the impact of a compromised dependency, GitHub recommends that workflows pin dependency versions to a specific commit SHA. This will prevent malicious code added to a new or updated branch or tag from being automatically used. Administrators can now enforce the use of SHA pinning through the allowed actions policy. A new checkbox appears under each radio selection, except when actions are disabled at the enterprise, organization, or repository level. The policy will check for a full commit SHA, and any workflow that attempts to use an action that isn’t pinned will fail.

via GitHub Actions policy now supports blocking and SHA pinning actions (August 15, 2025)

[ulgens]

This seems to be misleading. zizmor is run via its own action and currently there is no clear path to run it locally.

[j178]

Yeah, this comment should be updated.

[ulgens]

Coming from j178/prek-action#55, was there a reason to prefer a new workflow over the git hook?

[j178]

zizmor action supports GitHub advanced security and add inline annotations to changes, so I would prefer using zizmor action.

[ulgens]

Got it. With this setup, what should one do to run it locally?

[j178]

I'll just let CI checks it :)

[ulgens]

Fair enough 😄