Repository navigation
Add workflow and dependency analysis - #23
Merged
Merged
Conversation
added 2 commits
October 10, 2026 20:22
zizmor audits the workflows themselves for what makes a workflow unsafe, and uploads what it finds to code scanning. Its first run here found one thing, 2 times: a checkout that leaves the job's token in the checked-out repository, where any later step can read it. No workflow pushes or needs the token after the checkout, so every checkout now sets persist-credentials to false, and zizmor reports nothing. OpenSSF Scorecard grades how the repository is kept: branch protection, pinned dependencies, token permissions and the like. It runs on the default branch and weekly, publishes its score and uploads its findings to code scanning. Dependency Review fails a pull request that adds or changes a dependency with a known vulnerability of high severity or worse. Dependabot watches what is already there; this holds what comes in. Every new action is pinned to a commit, each job names the permissions it needs, and no new workflow has a default permission.
The owner decided against running OpenSSF Scorecard here. The workflow added by the commit before this one is removed; nothing else changes.
Leitwolf11
changed the title
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
Nothing looked at the workflows themselves, or at a dependency at the moment it comes in. This adds that.
zizmor.yml) audits the workflows and uploads its findings to code scanning. Run locally, it found one thing 2 times: a checkout that leaves the job's token in the checked-out repository. No workflow pushes or uses the token after the checkout, so every checkout now setspersist-credentials: false, and zizmor reports nothing.dependency-review.yml) fails a pull request that brings in a dependency with a known vulnerability of high severity or worse. Dependabot watches what is already there; this holds what comes in.Secret scanning with push protection is already enabled in the repository settings, so nothing is added for it.
An OpenSSF Scorecard workflow was part of the first commit of this branch and is removed by the second: the owner decided against it. No REUSE check is added either, for the same reason.
Every new action is pinned to a commit, each job names the permissions it needs, and the new workflows have no default permission. The existing workflows change by one line per checkout.
Verification
Not run locally: the new workflows themselves (Dependency Review needs GitHub), and zizmor's online audits, which the workflow runs with the job's token. No source file is touched.
This is a self-review by the author of the branch.