From fe525884d0b96e0c20b04f27eab24b020c7833ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Mon, 26 Oct 2026 10:18:00 +0100 Subject: [PATCH 1/3] ci: add zizmor workflow audit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Runs zizmor over this repository's workflows and Dependabot config on every pull request, on pushes to the default branch and weekly, through owncloud/reusable-workflows' zizmor.yml. Any finding fails the check. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- .github/workflows/zizmor.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..938b3736 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,28 @@ +name: Zizmor + +on: + push: + branches: + - master + pull_request: + types: + - opened + - synchronize + - reopened + schedule: + # Weekly: online audits (known-vulnerable actions, impostor commits) can + # start failing without a code change. + - cron: '0 4 * * 1' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: zizmor-${{ github.ref }} + cancel-in-progress: true + +jobs: + zizmor: + name: Zizmor + uses: owncloud/reusable-workflows/.github/workflows/zizmor.yml@main From 7415473d5569f5d50ae229492a794f769bbc958f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Mon, 26 Oct 2026 10:18:00 +0100 Subject: [PATCH 2/3] fix(ci): resolve zizmor findings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - dependabot-cooldown: composer updates wait 7 days too, as github-actions already does. - excessive-permissions: lint-pr-title only reads the pull request. - artipacked: the l10n-lint checkout does not persist credentials. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- .github/dependabot.yml | 2 ++ .github/workflows/l10n-lint.yml | 2 ++ .github/workflows/lint-pr-title.yml | 5 +++++ 3 files changed, 9 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b90da37a..ff56268c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,8 @@ updates: day: sunday time: '22:00' timezone: Etc/UTC + cooldown: + default-days: 7 open-pull-requests-limit: 5 groups: minor-and-patch: diff --git a/.github/workflows/l10n-lint.yml b/.github/workflows/l10n-lint.yml index bea4f928..007af8b1 100644 --- a/.github/workflows/l10n-lint.yml +++ b/.github/workflows/l10n-lint.yml @@ -24,5 +24,7 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Check l10n catalogs for duplicate keys run: make test-l10n diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml index ee7e019e..c62772dd 100644 --- a/.github/workflows/lint-pr-title.yml +++ b/.github/workflows/lint-pr-title.yml @@ -7,9 +7,14 @@ on: - edited - synchronize +permissions: + contents: read + jobs: lint: runs-on: ubuntu-latest + permissions: + pull-requests: read steps: - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: From a695aaeaf2d23dec9c8ba7ef765b36c16073821d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Mon, 26 Oct 2026 13:01:31 +0100 Subject: [PATCH 3/3] fix(ci): keep scheduled zizmor runs and lint-pr-title read access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only pull request runs of the zizmor audit cancel each other now; a push to master and the weekly run share a ref and used to cancel one another. lint-pr-title's job-level permissions replace the workflow-level block, so the job lists contents: read itself. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- .github/workflows/lint-pr-title.yml | 1 + .github/workflows/zizmor.yml | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml index c62772dd..b34856c0 100644 --- a/.github/workflows/lint-pr-title.yml +++ b/.github/workflows/lint-pr-title.yml @@ -14,6 +14,7 @@ jobs: lint: runs-on: ubuntu-latest permissions: + contents: read pull-requests: read steps: - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 938b3736..7829c845 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -18,9 +18,11 @@ on: permissions: contents: read +# Only pull request runs cancel each other: a push to the default branch and +# the weekly run share a ref, and neither should cancel the other. concurrency: group: zizmor-${{ github.ref }} - cancel-in-progress: true + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: zizmor: