Repository navigation
feat: add reusable zizmor workflow audit - #104
Merged
Merged
Conversation
Ahead of the zizmor workflow audit, which fails on any finding: - artipacked: checkouts set persist-credentials: false. None of these jobs runs a git operation after checkout; the two that open PRs (calens, translation-sync) already set it and push through peter-evans/create-pull-request with an App token. - github-app: the calens, translation-sync and trigger-docs-build App tokens request only what they use (contents + pull-requests write to open the PR; actions write to dispatch the docs build), instead of inheriting every permission of the installation. - ref-version-mismatch: setup-php's tag is 2.40.0, without the v. - self-repository: test.yml calls the local workflows as $/... instead of ./..., which cannot be redirected by files written to the workspace at runtime. - unpinned-images, adhoc-packages, superfluous-actions: suppressed inline with the reason. The database image tags come from the caller's input, the pnpm version from the app's package.json, and the release publish step only runs on a real release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
zizmor statically audits GitHub Actions workflows, composite actions and Dependabot config: template injection, excessive permissions, persisted credentials, unpinned or impostor actions, known-vulnerable actions. Callers get a blocking check: annotations mode exits non-zero on any finding and needs only contents: read, so it also runs on fork PRs. zizmor hash-pins every `uses:` by default, which would flag every owncloud/reusable-workflows/...@main caller. Without a repository config the workflow therefore applies an org default that keeps owncloud/* ref-pinned and hash-pins everything else. This repository runs the audit on itself from test.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Narrowing the App token to contents + pull-requests write dropped the organization Members: read that requesting team reviewers needs. Ask for it only when team_reviewers is set; create-github-app-token skips an empty permission input. No caller sets team_reviewers today. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Contributor
Author
This was referenced Oct 26, 2026
This was referenced Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/workflows/zizmor.yml, a reusable zizmor audit of the calling repository's workflows, composite actions and Dependabot config. It is the base of an org-wide rollout: every public owncloud repo with workflows gets a thin caller (usage indocs/zizmor.md), and admin then makesZizmor / Zizmora required check.Depends on owncloud/admin#310 (allowlists
zizmorcore/zizmor-action). Until that merges, the wholeCIrun fails at startup ("The action zizmorcore/zizmor-action@85b2b9f… is not allowed"). A disallowed action in a called workflow rejects the entire run, not just the job. Re-run CI after #310 merges.How the workflow behaves
advanced-security: false. That needs onlycontents: read, so it also passes on fork PRs. SARIF mode would needsecurity-events: writeand reports to the Security tab instead of failing.zizmor.ymlof its own.owncloud/*may stay ref-pinned, so every...@maincaller keeps working, and everything else must be SHA-pinned, which the org allowlist enforces anyway. A repository config replaces the default rather than merging with it, as documented.test.ymlruns the audit on this repository.This repository's own findings (separate commit)
persist-credentials: falseon every checkout. None of these jobs runs git after checkout.members: readonly whenteam_reviewersis set, sincecreate-github-app-tokenskips an empty permission input. No caller sets it today.2.40.0, without av. zizmor's auto-fix would have written# master, because a stray upstream tag of that name points at the same commit.test.ymlcalls the local workflows as$/..., GitHub's self-repository syntax since July 2026. Files written to the workspace at runtime cannot redirect it the way they can./.... This PR's CI run is the proof that the syntax parses.package.json.Noticed, not changed here
acceptance.yml's federated fallback image is'"mariadb:10.6', with a stray leading quote (from test: always start mariadb service for federated tests #86).test.yml'spush:trigger namesmaster, but the default branch ismain, so merges run no CI.🤖 Generated with Claude Code