ci: pin third-party actions to SHAs, persist-credentials: false, seed zizmor.yml; use the shell variable in the cask sed - #30
Merged
Conversation
… zizmor.yml; use the shell variable in the cask sed
Wave 2 (zizmor) remediation.
The checkout pin's "# v6" comment was wrong -- that SHA is v7.0.1 -- which
fails the online ref-version-mismatch audit. Corrected, along with the
gh-release pin's major-only comment.
The Homebrew cask sed interpolated ${{ env.SHA256 }} directly into the run
block (template-injection). SHA256 already reaches the step through
GITHUB_ENV, so the shell variable does the same job without the expansion.
Claude-Session: https://claude.ai/code/session_019HDRKLQNv82SEBd4zGpcXf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 2 (zizmor) remediation.
Corrected a wrong pin comment.
release.yml's checkout read# v6, but3d3c42e5…is actually v7.0.1 — a mislabel, not just a major-only comment, and it fails the onlineref-version-mismatchaudit. Also correctedsoftprops/action-gh-releasefrom# v3to the exact# v3.0.3.persist-credentials: falseonrelease.yml's checkout (artipacked). The job does push, but never with this checkout's token:action-gh-releaseauthenticates through theGITHUB_TOKENenv var, and the Homebrew tap push clones a different repo withHOMEBREW_TAP_TOKENembedded in the URL. Nothing reads the persisted credential, so dropping it removes exposure without removing capability.Template injection (
help[template-injection]).release.yml:68interpolated${{ env.SHA256 }}straight into thesedin arun:block.SHA256is already exported through$GITHUB_ENVby the preceding step, so it is visible to the shell — the fix is just"${SHA256}", and the expansion never reaches the script body. Line 67 already used${VERSION}this way, so this makes the two lines consistent.One suppression added.
superfluous-actions(informational) fires onaction-gh-release, advisinggh releasein a script step instead. That swap would have to reimplement the asset upload and templated release body, which is a behavior change and out of scope for wave 2, so the step carries an inline# zizmor: ignore[superfluous-actions]with that reasoning. Worth revisiting separately. Note this repo is the first in the fleet to useaction-gh-release, so there was no existing precedent to follow.Seeded the fleet-standard root
zizmor.yml, byte-identical to the canonical copy..github/dependabot.ymlalready exists and is left alone.zizmor and actionlint are clean locally, offline and online. shellcheck debt remains (an untracked
.claude/hooks/extensions/example.sh.disabled) and is wave 3.https://claude.ai/code/session_019HDRKLQNv82SEBd4zGpcXf