ci: add secret and workflow scanning to security.yml - #45
Merged
Conversation
Brings security.yml to the current netresearch/.github skill-template revision
and adds the shared zizmor config.
What changes:
- adds the zizmor job (static analysis of this repo's GitHub Actions workflows)
- drops the GITLEAKS_LICENSE secret mapping: secret scanning runs on
betterleaks, which is OSS, and the org-level secret no longer exists
- adds top-level `permissions: {}` plus an explicit permission set per caller
job, so no job relies on the repository default
- narrows the triggers from [main, master] to [main] (this repo's default
branch is main)
- adds the composer-audit permissions block
`.github/zizmor.yml` exempts first-party netresearch/* reusables from the
blanket hash-pin policy — they track @main by convention — while third-party
actions stay hash-pin enforced. Without it the two new caller lines flag
themselves.
This repo is not wired into the template drift check and this change does not
wire it in: only the two files above are touched.
Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
Updates this repository’s aggregated security workflow to align with the current org template expectations, adding missing workflow static analysis and tightening permissions defaults.
Changes:
- Added a
zizmorreusable-workflow job and introduced.github/zizmor.ymlto tune action pinning policy for first-partynetresearch/*reusables. - Hardened GitHub Actions token permissions by setting top-level
permissions: {}and declaring explicit per-job permissions. - Simplified triggers to only run on the
mainbranch and removed the unusedGITLEAKS_LICENSEsecret mapping.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/zizmor.yml |
Adds zizmor configuration to exempt first-party netresearch/* reusables from hash-pin enforcement while keeping third-party actions pinned. |
.github/workflows/security.yml |
Adds the zizmor scan job, removes the unused gitleaks license secret mapping, narrows triggers to main, and makes job permissions explicit with a deny-by-default baseline. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Dependency ReviewThe following issues were found:
License Issues.github/workflows/security.yml
OpenSSF Scorecard
Scanned Files
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the secret- and workflow-scanning jobs this repo was missing.
security.ymlhere predates the current skill template, so it never receivedthe
zizmorjob added in netresearch/.github#327. This brings the file to thecurrent template revision and adds the shared
.github/zizmor.yml.What changes
GITLEAKS_LICENSEsecret mapping — secret scanning runs onbetterleaks (OSS, no licence), the reusable never read the secret, and the
org-level secret has since been deleted
permissions: {}and an explicit permission set per callerjob, so nothing relies on the repository default
[main, master]to[main]— this repo's defaultbranch is
main, verified before the changecomposer-auditpermissions block.github/zizmor.ymlexempts first-partynetresearch/*reusables from theblanket hash-pin policy (they track
@mainby convention); third-party actionsstay hash-pin enforced. Without it the two new caller lines flag themselves.
What deliberately does not change
This repo is not a template consumer (no
.github/template.yaml) and this PRdoes not make it one. Full template adoption would also overwrite
release.yml,lint.yml,harness-verify.ymlandauto-merge-deps.yml— the change classthat broke every skill release org-wide on 2026-06-18 — and would add a drift
check that goes red immediately on the template files this repo does not carry.
That is a separate decision; only the two files above are touched here.