CI: audit with zizmor - #27931
Conversation
seberg
left a comment
seberg
left a comment
There was a problem hiding this comment.
Changes all seem nice. I would have hoped codeql or so find it also, but may it'll come.
Not sure what is with the macos jobs right now, but I guess it is unrelated?
|
They should be fixed by #27930 |
|
|
||
| # Declare default permissions as read only. | ||
| permissions: read-all | ||
| permissions: {} |
There was a problem hiding this comment.
This might cause scorecard to fail, then we should figure out what exactly is needed. See ossf/scorecard-action#1461
There was a problem hiding this comment.
Hmmm, yeah. I guess we can just try and see. Thanks Matti.
There was a problem hiding this comment.
Seems to work without those permisssions https://github.com/numpy/numpy/actions/workflows/scorecards.yml. I am not sure where we see the results of the scan?
There was a problem hiding this comment.
there is a tag in the readme: https://securityscorecards.dev/viewer/?uri=github.com/numpy/numpy
There was a problem hiding this comment.
Cool. The info there indicates it ran on the commit from merging this PR, so I guess the permissions are OK.
3 participants
I recently discovered zizmor, a tool to audit github workflows. It exposed some things we should change to make our workflows more secure. The main one, which is really not that important apparently is adding persistant-credientials: false to the checkout step. But once that was cleared, the real problems appeared: using un-escaped user-provided variables (like the branch name) to scripts.