Add zizmor GitHub Actions audit gate - #1
Draft
peaceful-james wants to merge 2 commits into
Draft
Conversation
zizmor is a static analyzer for GitHub Actions workflows. This adds it as a merge gate and fixes the three findings it reported here. The fixes: - Pin both actions to hashes. Unpinned tags are mutable, so `@v6` can silently become different code. Both SHAs were verified against the GitHub API; `v6` currently resolves to the same commit as `v6.1.0`. - Set persist-credentials: false on the checkout. Nothing here does a git remote operation after checkout, so leaving the token in .git/config only widens what a compromised step can reach. Dependabot's github-actions ecosystem is added in the same change. Hash pins without an updater trade a floating-tag problem for a silently-stale-pin problem, so the two belong together. Updates are grouped into one weekly PR with a 7-day cooldown, so a yanked or compromised release is not picked up the moment it is published. The gate runs at --min-severity=high. main is kept at zero high-severity findings, so a red check means the finding comes from that PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The first run logged "zizmor is running in offline mode by default". Without a token zizmor skips the online audits — the known-vulnerable-action and stale-ref lookups — and still reports green, so the gate was quietly weaker than it looked. Passing github.token turns them on. contents: read is sufficient. Verified this repo is still clean with the online audits enabled. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 0 of the org-wide zizmor rollout.
lazy-hookwas picked as the smoke test: one workflow, three findings, public, and nothing here can break a deploy.What zizmor found
unpinned-uses—actions/checkout@v6ci.yml:17unpinned-uses—devcontainers/ci@v0.3ci.yml:19artipacked— checkout persists credentialsci.yml:16All three are fixed. The repo is now at zero findings across workflows, actions, and Dependabot collectors.
Verification
actions/checkout@v6.1.0→d23441a…,devcontainers/ci@v0.3.1900000450→513af61….v6currently resolves to the same commit asv6.1.0, so the pin is faithful to what was running.persist-credentials: falseis safe here —grepfinds nogit fetch/push/pull/cloneanywhere in the repo, andscripts/check.shonly runsbunandmixinside the dev container. (This is the flag that made it unsafe inJump, wherefetch-sha.shdoes a post-checkoutgit fetch origin.)The gate
Runs on every PR and on pushes to
main, at--min-severity=high.mainis kept at zero high-severity findings, so a red check means the finding came from that PR.lazy-hookhas no branch protection, so this is not a required check — the red X is the signal. Adding a ruleset would be a separate decision.Dependabot
The
github-actionsecosystem is included in this PR rather than split out. Hash pins with no updater trade a floating-tag problem for a silently-stale-pin problem — that objection is what closedJump-App/Jump#23417, and it applies the moment pins land. Updates are grouped into one weekly PR with a 7-day cooldown.For the larger repos the Dependabot block will land as its own PR ahead of the pins; bundling it here is only reasonable because this diff is nine lines.
🤖 Generated with Claude Code