From 98a9c76306e5c03ae8a4d2a5225c65942654dfb6 Mon Sep 17 00:00:00 2001 From: Leitwolf11 Date: Sat, 10 Oct 2026 20:22:40 +0300 Subject: [PATCH 1/2] Add workflow, repository and dependency analysis zizmor audits the workflows themselves for what makes a workflow unsafe, and uploads what it finds to code scanning. Its first run here found one thing, 2 times: a checkout that leaves the job's token in the checked-out repository, where any later step can read it. No workflow pushes or needs the token after the checkout, so every checkout now sets persist-credentials to false, and zizmor reports nothing. OpenSSF Scorecard grades how the repository is kept: branch protection, pinned dependencies, token permissions and the like. It runs on the default branch and weekly, publishes its score and uploads its findings to code scanning. Dependency Review fails a pull request that adds or changes a dependency with a known vulnerability of high severity or worse. Dependabot watches what is already there; this holds what comes in. Every new action is pinned to a commit, each job names the permissions it needs, and no new workflow has a default permission. --- .github/workflows/ci.yml | 2 + .github/workflows/codeql.yml | 2 + .github/workflows/dependency-review.yml | 34 ++++++++++++++++ .github/workflows/scorecard.yml | 52 +++++++++++++++++++++++++ .github/workflows/zizmor.yml | 38 ++++++++++++++++++ 5 files changed, 128 insertions(+) create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .github/workflows/scorecard.yml create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8e7dcd9..e78dbb8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,6 +16,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6 - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4f18b6b..3121502 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -27,6 +27,8 @@ jobs: build_mode: manual steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 if: matrix.language == 'java-kotlin' with: diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..83ac0c5 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,34 @@ +# SPDX-FileCopyrightText: 2026 Progmasoft +# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1 + +name: Dependency Review + +# Looks at the dependencies a pull request adds or changes, and fails when +# one of them has a known vulnerability of high severity or worse. +# Dependabot watches what is already there; this holds what comes in. + +on: + pull_request: + +permissions: {} + +concurrency: + group: dependency-review-${{ github.ref }} + cancel-in-progress: true + +jobs: + review: + name: Dependency review + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Review the dependency changes + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + with: + fail-on-severity: high diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..caf2d6e --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,52 @@ +# SPDX-FileCopyrightText: 2026 Progmasoft +# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1 + +name: Scorecard + +# OpenSSF Scorecard grades how the repository itself is kept: branch +# protection, pinned dependencies, token permissions, and more. It reads the +# default branch only. Its findings are uploaded to code scanning. + +on: + branch_protection_rule: + push: + branches: + - main + schedule: + - cron: '37 5 * * 2' + +permissions: {} + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + actions: read + contents: read + id-token: write + security-events: write + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Run the analysis + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Keep the results + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: scorecard-results + path: results.sarif + retention-days: 5 + + - name: Upload to code scanning + uses: github/codeql-action/upload-sarif@7999b86c43a865dc79d8923397f35af22de63401 # v4 + with: + sarif_file: results.sarif diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..17ac559 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,38 @@ +# SPDX-FileCopyrightText: 2026 Progmasoft +# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1 + +name: Workflow Security + +# zizmor reads the workflows of this repository for what makes a workflow +# unsafe: a token that is wider than its job needs, text from a pull request +# that reaches a shell, an action that is not pinned. Its findings are +# uploaded to code scanning. + +on: + pull_request: + push: + branches: + - main + +permissions: {} + +concurrency: + group: zizmor-${{ github.ref }} + cancel-in-progress: true + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + actions: read + contents: read + security-events: write + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Audit the workflows + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 From 703c29c07a5575d9a2aae52b14a399bb77806b37 Mon Sep 17 00:00:00 2001 From: Leitwolf11 Date: Sat, 10 Oct 2026 20:26:28 +0300 Subject: [PATCH 2/2] Leave out the Scorecard workflow The owner decided against running OpenSSF Scorecard here. The workflow added by the commit before this one is removed; nothing else changes. --- .github/workflows/scorecard.yml | 52 --------------------------------- 1 file changed, 52 deletions(-) delete mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml deleted file mode 100644 index caf2d6e..0000000 --- a/.github/workflows/scorecard.yml +++ /dev/null @@ -1,52 +0,0 @@ -# SPDX-FileCopyrightText: 2026 Progmasoft -# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1 - -name: Scorecard - -# OpenSSF Scorecard grades how the repository itself is kept: branch -# protection, pinned dependencies, token permissions, and more. It reads the -# default branch only. Its findings are uploaded to code scanning. - -on: - branch_protection_rule: - push: - branches: - - main - schedule: - - cron: '37 5 * * 2' - -permissions: {} - -jobs: - analysis: - name: Scorecard analysis - runs-on: ubuntu-latest - timeout-minutes: 15 - permissions: - actions: read - contents: read - id-token: write - security-events: write - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - persist-credentials: false - - - name: Run the analysis - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 - with: - results_file: results.sarif - results_format: sarif - publish_results: true - - - name: Keep the results - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: scorecard-results - path: results.sarif - retention-days: 5 - - - name: Upload to code scanning - uses: github/codeql-action/upload-sarif@7999b86c43a865dc79d8923397f35af22de63401 # v4 - with: - sarif_file: results.sarif