chore(ci): hardening workflows using zizmor by soonum · Pull Request #2292 · zama-ai/tfhe-rs

soonum · 2025-04-25T09:05:41Z

This is part of security issues remediation campaign after having analyzed workflows using zizmor cargo tool.

This change is

IceTDrinker

Thanks that's already a huge bit you did here

Reviewed 52 of 64 files at r1, 18 of 18 files at r2, all commit messages.
Reviewable status: all files reviewed, 17 unresolved discussions (waiting on @nsarlin-zama)

.github/workflows/aws_tfhe_backward_compat_tests.yml line 131 at r2 (raw file):

          echo "PULL_REQUEST_MD_LINK=[pull-request](${PR_BASE_URL}${{ github.event.pull_request.number }}), "  >> "${GITHUB_ENV}"
        env:
          PR_BASE_URL: ${{ vars.PR_BASE_URL }}

what's vars ?

.github/workflows/benchmark_gpu.yml line 78 at r2 (raw file):

        run: |
          echo "${INPUTS_PROFILE}" | sed 's|\(.*\)[[:space:]](.*)|\1|'
          echo "profile=$?" >> "${GITHUB_OUTPUT}"

$? is the exit code ?

.github/workflows/benchmark_gpu.yml line 84 at r2 (raw file):

        run: |
          echo "${INPUTS_PROFILE}" | sed 's|.*[[:space:]](\(.*\))|\1|'
          echo "name=$?" >> "${GITHUB_OUTPUT}"

same here

.github/workflows/benchmark_gpu.yml line 99 at r2 (raw file):

      all_precisions: ${{ inputs.all_precisions }}
    secrets:
      BOT_USERNAME: ${{ secrets.BOT_USERNAME }}

this is a way to restrict secret access ?

.github/actions/gpu_setup/action.yml line 47 at r1 (raw file):

      shell: bash
      run: |
        CUDA_PATH=/usr/local/cuda-${CUDA_VERSION}

unquotted var expand

.github/workflows/approve_label.yml line 10 at r1 (raw file):

permissions: {}

what are empty permissions ?

.github/actionlint.yaml line 22 at r1 (raw file):

      # Sed is used to extract a value from a string in our case, this task cannot be
      # performed by the ${variable//search/replace} pattern.
      - 'shellcheck reported issue in this script: SC2001:.+'

let's avoid disabling lints, if there are other ways to perform the same thing let's use that, otherwise you may use python as the shell for a step

.github/workflows/benchmark_signed_integer.yml line 66 at r2 (raw file):

        run: |
          echo "OP_FLAVOR=[\"default\"]" >> "${GITHUB_ENV}"
          if [[ "${INPUTS_BENCH_TYPE}" == "both" ]]; then

missing env var setup ?

.github/workflows/benchmark_integer.yml line 66 at r2 (raw file):

        run: |
          echo "OP_FLAVOR=[\"default\"]" >> "${GITHUB_ENV}"
          if [[ "${INPUTS_BENCH_TYPE}" == "both" ]]; then

missing env var setup ?

.github/workflows/aws_tfhe_backward_compat_tests.yml line 90 at r1 (raw file):

        id: backward_compat_sha
        run: |
          SHA=$(git ls-remote ${{ env.REPO_URL }} refs/heads/"${BACKWARD_COMPAT_BRANCH}" | awk '{print $1}')

replace the ${{ env.REPO_URL }} by ${REPO_URL}, also make sure it is quoted ?

or maybe replace by the url directly ?

.github/workflows/aws_tfhe_backward_compat_tests.yml line 108 at r1 (raw file):

        with:
          persist-credentials: 'false'
          token: ${{ env.CHECKOUT_TOKEN }}

${{ secrets.CHECKOUT_TOKEN }}

?

.github/workflows/benchmark_shortint.yml line 123 at r2 (raw file):

          --database tfhe_rs \
          --hardware "hpc7a.96xlarge" \
          --project-version "${{ env.COMMIT_HASH }}" \

don't use env. when it's an env var, use the ${} expansion directly

.github/workflows/benchmark_shortint.yml line 125 at r2 (raw file):

          --project-version "${{ env.COMMIT_HASH }}" \
          --branch "${REF_NAME}" \
          --commit-date ${{ env.COMMIT_DATE }} \

here as well

.github/workflows/benchmark_shortint.yml line 126 at r2 (raw file):

          --branch "${REF_NAME}" \
          --commit-date ${{ env.COMMIT_DATE }} \
          --bench-date "${{ env.BENCH_DATE }}" \

and again

.github/workflows/benchmark_gpu_erc20.yml line 36 at r2 (raw file):

        run: |
          echo "${INPUTS_PROFILE}" | sed 's|\(.*\)[[:space:]](.*)|\1|'
          echo "profile=$?" >> "${GITHUB_OUTPUT}"

this is the exit code

.github/workflows/benchmark_gpu_erc20.yml line 42 at r2 (raw file):

        run: |
          echo "${INPUTS_PROFILE}" | sed 's|.*[[:space:]](\(.*\))|\1|'
          echo "name=$?" >> "${GITHUB_OUTPUT}"

this is the exit code

.github/workflows/benchmark_zk_pke.yml line 80 at r2 (raw file):

        if: github.event_name == 'workflow_dispatch'
        run: |
          if [[ "${INPUTS_BENCH_TYPE}" == "both" ]]; then

missing env var setup ?

soonum · 2025-04-25T16:23:10Z

.github/workflows/approve_label.yml line 10 at r1 (raw file):