Repository navigation
ci: add zizmor workflow audit - #13232
Open
oc-tmueller wants to merge 3 commits into
Open
oc-tmueller wants to merge 3 commits into
oc-tmueller wants to merge 3 commits into
Conversation
Runs zizmor over this repository's workflows and Dependabot config on every pull request, on pushes to the default branch and weekly, through owncloud/reusable-workflows' zizmor.yml. Any finding fails the check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
- excessive-permissions: workflows without a permissions block ran with the repository default, which is read/write. They now default to contents: read; only create-github-release gets contents: write, for softprops/action-gh-release. audit-release only GETs the published release, which read covers. - cache-poisoning: the release workflow's setup-node steps opt out of package-manager caching, so a tag build cannot restore a cache that a branch build wrote. - artipacked: checkouts do not persist credentials. No job runs a git operation after checkout. - dependabot-cooldown: every ecosystem waits 7 days, as github-actions already does. - ref-version-mismatch: setup-php's tag is 2.40.0, without the v. - self-repository: local reusable workflows and actions are called as $/... instead of ./... . - Suppressed inline, with the reason on the line: the unpinned `npm install -g yarn npx` in the release workflow (pre-existing, left to the maintainers), the version-pinned gherlint install, and the softprops release step, which CI cannot exercise. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
- zizmor's template-injection auto-fix read `${{ }}` inside a shell
comment in determine-release-type as an expansion: it added an env
entry reading that job's own output, which is always empty, and
rewrote the comment to describe something no longer true. The entry
is gone and the comment describes the env indirection the later jobs
now use, with the version check as a second safeguard.
- Only pull request runs of the zizmor audit cancel each other now; a
push to master and the weekly run share a ref.
The previous commit's message is incomplete: it lists a self-repository
change this repository did not need, and omits the auto-fixed
template-injection findings (expressions in run: moved to env: in
release.yml, release-npm-packages.yml and acceptance-tests.yml) and the
cache-poisoning fix also turning off setup-go's cache in the release
jobs, so a tag build cannot restore a cache a branch build wrote.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
|
Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes. |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a zizmor audit of this repository's GitHub Actions workflows and Dependabot config, through the new reusable
owncloud/reusable-workflows/.github/workflows/zizmor.yml(owncloud/reusable-workflows#104). It's part of an org-wide rollout. Once the repo PRs have landed,Zizmor / Zizmorbecomes a required check through owncloud/admin.masterand weekly, because online audits such as known-vulnerable actions can start failing without a code change.contents: readonly, so it also works on fork PRs like this one.owncloud/*references may stay on@main. Everything else must be SHA-pinned.Existing findings fixed (separate commits)
GITHUB_TOKENis read/write, so every workflow without apermissions:block ran with write access. They now default tocontents: read.create-github-releasegetscontents: write, forsoftprops/action-gh-release.audit-releaseonly GETs the published release, whichcontents: readcovers.gh, git push, comments, SARIF) and found none.${{ }}expressions inrun:scripts were moved toenv:. This coversrelease.yml,release-npm-packages.ymlandacceptance-tests.yml. The version-token check indetermine-release-typestays as a second safeguard.package-manager-cache: false) and setup-go (cache: false) no longer cache, so a tag build cannot restore a cache that a branch build wrote. Release jobs therefore download Go modules uncached.git diff/git tag.2.40.0, without av. Thepnpm/action-setupcomment now saysv6.1.0, matching its SHA.npm install -g yarn npx --forceinrelease.yml.For the maintainers: that last install is the one item I deliberately left alone. Installing
npxglobally does nothing, since npm already ships it.yarnis unpinned in a job that holdsBUF_API_TOKEN. Pinning yarn (aspnpm@$PNPM_VERSIONalready is) or dropping the install would let that suppression go.Not exercised by this PR's CI:
release.ymlandrelease-npm-packages.ymlonly run on tags and releases.zizmor 1.31.1 reports no findings on this branch.
🤖 Generated with Claude Code