Add zizmor security scanning for GitHub Actions workflows - #15210
Add zizmor security scanning for GitHub Actions workflows#15210rtibbles wants to merge 2 commits into
Conversation
Offline, so a commit's result does not turn on whether a token happens to be in the environment or on what GitHub's advisory data says today. `unpinned-uses` is set to ref-pin: actions here are tag-pinned and Dependabot raises the tags. Hash-pinning them is a separate decision. The 27 findings this leaves: - Dispatch and call inputs reach `run:` blocks and `github-script` through `env:` rather than direct expansion - App tokens request only the permissions their `create-pull-request` step uses - Release and PR-label write scopes sit on the jobs needing them, not the workflow - The six deliberate `pull_request_target`/`workflow_run` triggers carry ignore directives Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016oUu1D1KJzerKoJMpR52CC
Five audits need a GitHub API token, so the offline pre-commit hook cannot run them. One of them reads GitHub's advisory database, which is why they report as code scanning alerts rather than as a merge gate. codeql.yml is renamed because it now runs more than CodeQL. Alert continuity holds: the analyses set `category` explicitly, so their identity does not derive from the file path. CodeQL's permissions move to its own job, which is what zizmor asks for once a second job exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016oUu1D1KJzerKoJMpR52CC
github-actions
Bot
added
DEV: dev-ops
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Build Artifacts
Smoke test screenshot |
|
I've read the first three subpages of the docs and the code, and I still feel confused about what the scope of the changes is supposed to be here. I get that it's a pre-commit check that will run in our actions. Beyond that, I feel less clear. Is it that we are adding this as a check so that we're not inadvertently shipping something that we've added a security vulnerability to within that PR? Is it that we're trying to automate and bundle in security-related fixes that might not be promptly handled (like, we need to bump a dependency but haven't yet), but adding this, this may auto-resolve some of them in the scope of other work? Is it preventing security vulnerabilities within our github actions themselves? Something else? |
|
It is solely about security in Github actions. We already do try to check for that with a range of different things, but zizmor is more comprehensive in some ways, but also complementary to other checks. The first commit adds it running entirely in "offline" mode as a prek/pre-commit hook - and fixes all the issues it found with our actions yml files as a result. The "offline" mode is important, as otherwise it makes authenticated calls to github without the developer's knowledge. The second commit adds running it in the github action (alongside CodeQL) in 'online' mode, so things that rely solely on known vulnerability lists and other things that require access to github to find out are still caught, but don't need to run on a developer machine. |
3 participants
Summary
References
Tool docs: https://docs.zizmor.sh/
Reviewer guidance
Linting runs the hook over the whole tree; the new Security Scan job runs the online audits on this PR.
unpinned-usesis set to ref-pin, not hash-pin, because we pin by tags--min-confidence mediumdefers 92 findingsAI usage
Used Claude Code to run zizmor over the tree, fix the 27 findings it reported, and wire up both the hook and the online job; I directed the offline/online split, folding it into the existing security workflow rather than a new one, and a self-review pass that caught a false justification in one suppression comment. Verified with prek across the branch and a zizmor run with a GitHub token.