ci: add Zizmor

[storopoli]

This PR integrates zizmor
for automated GitHub Actions security analysis and implements several
workflow security improvements.

zizmor Integration

New workflows that runs zizmor:

• Added .github/workflows/cron-zizmor.yml:
  • Currently configured to run daily at midnight UTC
  • Results are uploaded to the repository's Security tab in SARIF format
• Added .github/workflows/zizmor.yml that runs zizmor on every PR that fails CI if zizmor fails.

These are the suggested ways to integrate zizmor to a repository using GitHub Actions in the documentation.

CI Security Hardening

All workflows were updated with zizmor's security best practices:

• Action pinning: All GitHub Actions are now pinned to specific commit hashes instead of tags that provide mmutability and protection against supply chain attacks

  • Example: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 instead of @v5

• Permissions: Added explicit permissions blocks to all workflows

  • Implements least-privilege principle
  • Each job only requests the minimum permissions needed

• Credential persistence: Set persist-credentials: false on all actions/checkout steps

  • Prevents accidental credential leaks
  • Reduces attack surface

Dangerous Triggers Whitelist

zizmor flagged the use of pull_request_target and workflow_run
in as dangerous trigger patterns. Hence, I've added # zizmor: ignore[dangerous-triggers] annotations to whitelist these patterns.

Dependabot Enhancements

• Cooldown feature: Added cooldown.default-days: 5 to .github/dependabot.yml.

  • Enables a "cooldown" period for automated dependabot updates, which restricts dependencies to be updated only if they are more than 5 days old.
  • Good for supply chain attacks/vulnerabilities.

• Tagged hash support: Dependabot can work correctly with pinned action versions (commit hashes) and will update them accordingly by pinning a new hash (and changing the commented version accordingly as well).

Closes #5209.

[apoelstra]

• Cooldown feature: Added cooldown.default-days: 5 to .github/dependabot.yml.

I'm kinda bikeshedding here but can you change this from 5 to 60? We basically never want to update except that old versions eventually get deleted and then our CI breaks. So we might as well drag our feet for a couple months, which should shake out even accidental security vulns.

[storopoli]

• Cooldown feature: Added cooldown.default-days: 5 to .github/dependabot.yml.

I'm kinda bikeshedding here but can you change this from 5 to 60? We basically never want to update except that old versions eventually get deleted and then our CI breaks. So we might as well drag our feet for a couple months, which should shake out even accidental security vulns.

Makes total sense.
I think I might revisit 5 days at Alpen's repo and in my personal projects as well...

Ok, moved from 5 to 60 in 73e866e

EDIT: and rebased (because it is always good to rebase)

[tcharding]

ACK 25ae73c

[tcharding]

Does this mean that zimor only gives github actions attack protection until the project on PyPI gets pwned?

[storopoli]

Yes, but to be fair they do attestations: https://github.com/zizmorcore/zizmor/blob/57f910252f4931fcb3cdf5fccdb9a0174e264819/.github/workflows/release-pypi.yml#L153-L179

Which is stronger than just PGP-signing and then releasing on PyPI.
See: https://blog.trailofbits.com/2024/11/14/attestations-a-new-generation-of-signatures-on-pypi/

[tcharding]

Do we really want to run this on every PR?

[storopoli]

Do we really want to run this on every PR?

I can do a custom trigger only if the PR touches the .github/ folder...

EDIT: just saw this #5237

[storopoli]

Do we really want to run this on every PR?

I can do a custom trigger only if the PR touches the .github/ folder...

EDIT: just saw this #5237

Done in d8c8da4

[apoelstra]

ACK 25ae73c; successfully ran local tests

[tcharding]

ACK d8c8da4

[tcharding]

Cool! I didn't realize it was so easy to gate jobs on paths.

[apoelstra]

ACK d8c8da4; successfully ran local tests

[storopoli]

rebased

[storopoli]

f*** annoying rebase sorry about the spam...

[tcharding]

ACK 275c262

[apoelstra]

ACK 275c262; successfully ran local tests