Repository navigation
ci: add zizmor workflow audit - #12670
Open
oc-tmueller wants to merge 3 commits into
Open
oc-tmueller wants to merge 3 commits into
oc-tmueller wants to merge 3 commits into
Conversation
Runs zizmor over this repository's workflows and Dependabot config on every pull request, on pushes to the default branch and weekly, through owncloud/reusable-workflows' zizmor.yml. Any finding fails the check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
- dependabot-cooldown: every Dependabot entry waits 7 days before proposing an update. - excessive-permissions: the branded GUI test workflow, which used the repository default (read/write), runs with contents: read. It builds with KW_THEME_PAT and uploads an artifact, neither needs the token. - github-app: the translation App token requests only contents and pull-requests write, which opening the translations PR needs. - artipacked: checkouts do not persist credentials. The builds only run local git commands (Craft, git clang-format) on this public repo. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
GitHub still replaces a queued push, schedule or dispatch run with a newer one in the same group; only cancel-in-progress is limited to pull requests. Say so instead of claiming only pull request runs cancel. The translation App token goes back to inheriting the installation's permissions, with the github-app finding suppressed inline: the translations PR branch is rebuilt from its base, so its push can carry workflow changes and need workflows: write, and whether the App installation holds that is not visible from this repository. Asking for a permission it lacks would fail every run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
|
Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a zizmor audit of this repository's GitHub Actions workflows and Dependabot config, through the reusable
owncloud/reusable-workflows/.github/workflows/zizmor.yml(owncloud/reusable-workflows#104). It's part of an org-wide rollout. Once the repo PRs have landed,Zizmor / Zizmorbecomes a required check through owncloud/admin.masterand weekly, because online audits such as known-vulnerable actions can start failing without a code change.contents: readonly, so it also works on fork PRs.owncloud/*references may stay on@main. Everything else must be SHA-pinned.Existing findings fixed
proposing an update.
repository default (read/write), runs with contents: read. It builds
with KW_THEME_PAT and uploads an artifact, neither needs the token.
is suppressed inline (see the note below).
local git commands (Craft, git clang-format) on this public repo.
Notes
translate.ymlkeeps the token's inherited installation permissions, and the github-app finding is suppressed inline. create-pull-request rebuilds the translations branch from its base, so updating it may needworkflows: write. Which permissions the App installation holds isn't visible from here, and requesting one it lacks would fail every run. Once someone confirms the installation's permissions, the token can be narrowed (permission-contents/pull-requests: write, pluspermission-workflows: writeif needed).zizmor 1.31.1 reports no findings on this branch.
🤖 Generated with Claude Code