ci: security: Cherry-pick all Zizmor fixes from upstream#416
Merged
Conversation
Since the previous tightening a few workflow updates have gone in and the zizmor job isn't flagging them as issues, so address this to remove potential attack vectors Signed-off-by: stevenhorsman <steven@uk.ibm.com>
The default suggestion for top-level permissions was `contents: read`, but scorecard notes anything other than empty, so try updating it and see if there are any issues. I think it's only needed if we run workflows from other repos. Signed-off-by: stevenhorsman <steven@uk.ibm.com>
This does not change the security of the analysis, this is just to work around zizmorcore/zizmor-action#43. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
As a consequence of moving away from Advanced Security for Zizmor, it now checks the entire codebase and will error out on this PR and future. To be reverted once we address all Zizmor findings in a future PR. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
This fixes that error everywhere by adding a `name:` field to all jobs that were missing it. We keep the same name as the job ID to ensure no disturbance to the required job names. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
There are 62 such warnings and addressing them would take quite a bit of time so just disable them for now. help[undocumented-permissions]: permissions without explanatory comments --> ./.github/workflows/release.yaml:71:7 | 71 | packages: write | ^^^^^^^^^^^^^^^ needs an explanatory comment 72 | id-token: write | ^^^^^^^^^^^^^^^ needs an explanatory comment 73 | attestations: write | ^^^^^^^^^^^^^^^^^^^ needs an explanatory comment | = note: audit confidence → High Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
sprt
force-pushed
the
sprt/zizmor-cherrypick
branch
from
37bed37 to
4819b28
Compare
Fix all instances of template injection by using environment variables as recommended by Zizmor, instead of directly injecting values into the commands. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
We can re-require this now that we've addressed all the issues. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
Address issues just introduced and set actionlint as a required by removing the path filter. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
sprt
force-pushed
the
sprt/zizmor-cherrypick
branch
from
b315483 to
7576ed5
Compare
`${kernel_name,,}` is bash 4.0 and not posix compliant, so doesn't
work on macos, so switch to `tr` which is more widely
supported
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
Avoid the error `ERROR: unsupported architecture: arm64` in install_go.sh on darwin Signed-off-by: stevenhorsman <steven@uk.ibm.com>
Update the two workflows that used setup-go to instead call `install_go.sh` script, which handles installing the correct version of golang Signed-off-by: stevenhorsman <steven@uk.ibm.com>
golang 1.25 has been released, so 1.23 is EoL, so we should update to ensure we don't end up with security issues Signed-off-by: stevenhorsman <steven@uk.ibm.com>
As part of the go 1.24.6 bump there are errors about the incorrect use of a errorf, so switch to the non-formatting version, or add the format string as appropriate Signed-off-by: stevenhorsman <steven@uk.ibm.com>
The Go installation step was broken because the checkout action was checking out the code in a subdirectory: https://github.com/kata-containers/kata-containers/actions/runs/18265538456/job/51999316919 Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
We can't test this PR because the workflow needs this trigger, so adding this will allow testing future PRs. Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
sprt
force-pushed
the
sprt/zizmor-cherrypick
branch
from
7576ed5 to
e4109b2
Compare
danmihai1
approved these changes
Oct 17, 2025
Downloading Go from storage.googleapis.com fails intermittently with a 403 (see error below) so we switch to go.dev as referenced at https://go.dev/dl/. /tmp/install-go-tmp.Rw5Q4thEWr ~/work/kata-containers/kata-containers /usr/bin/go [install_go.sh:85] INFO: removing go version go1.24.9 linux/amd64 [install_go.sh:94] INFO: Download go version 1.24.6 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 298 100 298 0 0 2610 0 --:--:-- --:--:-- --:--:-- 2614 [install_go.sh:97] INFO: Install go gzip: stdin: not in gzip format tar: Child returned status 1 tar: Error is not recoverable: exiting now [install_go.sh:99] ERROR: sudo tar -C /usr/local/ -xzf go1.24.6.linux-amd64.tar.gz https://github.com/kata-containers/kata-containers/actions/runs/18602801597/job/53045072109?pr=11947#step:5:17 Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
Author
|
Post-merge todo: update zizmor and actionlint as required checks in repo settings. |
danmihai1
approved these changes
Oct 21, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picking these PRs:
docs-url-alive-checkworkflow kata-containers/kata-containers#11901