From d1fe3a335ec0da73613066fe1cb9c05bb72814cd Mon Sep 17 00:00:00 2001 From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:03:20 +0100 Subject: [PATCH 1/6] Add zizmor config ignoring all current findings Introduces zizmor for GitHub Actions security linting. All rules that currently fail are ignored for now; each will be addressed and its ignore removed in a follow-up commit. --- .github/zizmor.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 000000000..674fe1e56 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,11 @@ +rules: + artipacked: + ignore: + - ci.yml + unpinned-uses: + ignore: + - ci.yml + - close_stale_issues_and_prs.yml + unpinned-images: + ignore: + - ci.yml From 4888ee6a8378fb1c06acab47e5008ccc870b867c Mon Sep 17 00:00:00 2001 From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:03:59 +0100 Subject: [PATCH 2/6] Fix zizmor artipacked findings in ci.yml actions/checkout now sets persist-credentials: false so the checked out repo's git credentials aren't persisted for later steps (or leaked via uploaded artifacts). Neither job performs git operations after checkout, so this is safe. Applied via `zizmor --fix=unsafe-only`; removes the artipacked ignore now that it's resolved. --- .github/workflows/ci.yml | 4 ++++ .github/zizmor.yml | 3 --- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1e300c077..04bd78159 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,6 +23,8 @@ jobs: steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Set up Ruby and bundle cache @@ -97,6 +99,8 @@ jobs: steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Install test dependencies run: > diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 674fe1e56..d6ea72d0a 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -1,7 +1,4 @@ rules: - artipacked: - ignore: - - ci.yml unpinned-uses: ignore: - ci.yml From dc277623bc33ae8358628bbb5a9bd0f45a62659c Mon Sep 17 00:00:00 2001 From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:04:46 +0100 Subject: [PATCH 3/6] Fix zizmor unpinned-uses findings Pin all third-party actions (actions/checkout, ruby/setup-ruby, browser-actions/setup-firefox, actions/upload-artifact, actions/stale) to a commit SHA rather than a mutable tag, so a compromised or force-pushed tag can't silently swap in different code. Applied via `zizmor --fix=unsafe-only`; removes the unpinned-uses ignore now that it's resolved. --- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/close_stale_issues_and_prs.yml | 4 ++-- .github/zizmor.yml | 4 ---- 3 files changed, 8 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 04bd78159..a87970a91 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,13 +22,13 @@ jobs: timeout-minutes: 20 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - name: Set up Ruby and bundle cache - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: .tool-versions bundler-cache: true @@ -98,7 +98,7 @@ jobs: --health-retries=5 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false @@ -108,10 +108,10 @@ jobs: libvips - name: Set up Firefox - uses: browser-actions/setup-firefox@v1 + uses: browser-actions/setup-firefox@0bc507ddf224827e3b1af68e014d5e42ab93e795 # v1.7.2 - name: Set up Ruby and bundle cache - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: .tool-versions bundler-cache: true @@ -134,7 +134,7 @@ jobs: - name: Upload coverage artifact if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: coverage path: coverage diff --git a/.github/workflows/close_stale_issues_and_prs.yml b/.github/workflows/close_stale_issues_and_prs.yml index 959ed2a6e..f6f51eb30 100644 --- a/.github/workflows/close_stale_issues_and_prs.yml +++ b/.github/workflows/close_stale_issues_and_prs.yml @@ -12,7 +12,7 @@ jobs: stale: runs-on: ubuntu-latest steps: - - uses: actions/stale@v10 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 with: operations-per-run: 50 stale-issue-message: 'This issue is stale because it has been open for 90 days with no activity. Remove stale label or comment or this will be closed in 7 days.' @@ -22,4 +22,4 @@ jobs: days-before-issue-stale: 90 days-before-pr-stale: 30 days-before-issue-close: 7 - days-before-pr-close: 7 \ No newline at end of file + days-before-pr-close: 7 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index d6ea72d0a..0fb58c71b 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -1,8 +1,4 @@ rules: - unpinned-uses: - ignore: - - ci.yml - - close_stale_issues_and_prs.yml unpinned-images: ignore: - ci.yml From f648802930a5f714412cc0e0e2d26fbda61acb85 Mon Sep 17 00:00:00 2001 From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:07:20 +0100 Subject: [PATCH 4/6] Add zizmor CI step to lint GitHub Actions workflows Adds a dedicated job that runs zizmor against the workflow definitions on every push and PR, using the .github/zizmor.yml config to skip the one remaining finding (unpinned-images) that has no auto-fix. --- .github/workflows/ci.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a87970a91..effd8ba28 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,6 +37,25 @@ jobs: - name: Run RuboCop run: bundle exec rubocop --format progress + zizmor: + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false + + - name: Install uv + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + + - name: Run zizmor + run: uvx zizmor . + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + test: runs-on: ubuntu-latest timeout-minutes: 45 From 5e6705ed2a00b5093a65701038d95d411348a244 Mon Sep 17 00:00:00 2001 From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:13:17 +0100 Subject: [PATCH 5/6] Ignore trusted image warning Since we control this image we can trust updates to it --- .github/workflows/ci.yml | 2 +- .github/zizmor.yml | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-) delete mode 100644 .github/zizmor.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index effd8ba28..f6fc39915 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -100,7 +100,7 @@ jobs: ports: - 6379:6379 salesforce_connect: - image: 'ghcr.io/raspberrypifoundation/heroku-connect' + image: 'ghcr.io/raspberrypifoundation/heroku-connect' # zizmor: ignore[unpinned-images] credentials: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index 0fb58c71b..000000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,4 +0,0 @@ -rules: - unpinned-images: - ignore: - - ci.yml From 5c563001bdc3c1d5542b29fa1373655c0c62e72b Mon Sep 17 00:00:00 2001 From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:55:09 +0100 Subject: [PATCH 6/6] Pin zizmor version in CI Matches editor-ui's convention of pinning the zizmor package version via uvx, alongside the already SHA-pinned setup-uv action. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f6fc39915..46eeb04d0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -52,7 +52,7 @@ jobs: uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Run zizmor - run: uvx zizmor . + run: uvx "zizmor@1.29.0" . env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}