ci: add zizmor security analysis for GitHub Actions workflows#436
Merged
Conversation
Introduces a zizmor workflow that statically analyzes our Actions workflows for common security issues (template injection, excessive token scope, etc.). Findings are uploaded as SARIF so they surface in the repository's Security tab.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThis PR hardens the CI/CD pipeline through Dependabot configuration updates, explicit permission restrictions and GitHub Actions version pinning across all workflows, refactored environment variable passing in the shared CI workflow, and a new security analysis workflow using zizmor. ChangesCI/CD Security Hardening
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Addresses zizmor's own unpinned-uses findings on the new workflow by pinning actions/checkout, astral-sh/setup-uv, and github/codeql-action/upload-sarif to specific commit SHAs with version comments.
The maintained action handles uv install, zizmor invocation, and SARIF upload to GitHub Advanced Security in a single step. Drops a few third-party action references from this workflow.
- Make the zizmor workflow enforcing: switch to annotations-only mode so non-zero zizmor exit fails the check (was advisory via SARIF). - ci.common.yml: move templated inputs (package_name, queue_backend) into env vars to close template-injection findings; pin actions/checkout and actions/setup-node to SHAs; set persist-credentials: false on checkout. - ci.yml: add deny-by-default top-level permissions and explicit per-job permissions; pin fastify/github-action-merge-dependabot. - ensure-labels.yml: add deny-by-default top-level permissions and scope ensure_labels job to pull-requests: read. - publish.yml: add deny-by-default top-level permissions; pin actions/checkout, actions/setup-node, and dorny/paths-filter to SHAs; set persist-credentials: false on the detect-changes checkout; move templated steps.pr-info / steps.filter outputs into env vars to close template-injection findings.
Closes zizmor's dependabot-cooldown findings (the CI run scans the whole repo, including .github/dependabot.yml, which the local .github/workflows-only run did not). The cooldown gives recently published versions time to be vetted before Dependabot opens an update PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new
zizmor.ymlworkflow that runs zizmor — a static analysis tool for GitHub Actions — on every push tomainand on every pull request. Findings are emitted as SARIF and uploaded viagithub/codeql-action/upload-sarif, so issues surface in the repository's Security → Code scanning tab.What zizmor catches:
run:blocksGITHUB_TOKENpermissionspersist-credentials: trueonactions/checkoutwhen not neededThe workflow itself follows the patterns zizmor recommends:
permissions: {}(deny-by-default) with a narrow per-job grant ofsecurity-events: write/contents: read/actions: readfor SARIF uploadpersist-credentials: falseon the checkout stepuvx zizmorso the tool version can be pinned later via a lockfile or explicit versionTest plan
zizmorjob runs to completion and uploads a SARIF artifactCI,Ensure labels) continues to passGenerated by Claude Code
Summary by CodeRabbit