Introduce Zizmore to audit Github actions - #1571
Open
zetter-rpf wants to merge 7 commits into
Open
Conversation
Introduces .github/zizmor.yml to grandfather in every offense zizmor currently reports (artipacked, unpinned-uses, cache-poisoning, secrets-inherit, template-injection) so future runs only flag newly introduced issues. Follow-up commits will fix the autofixable rules one at a time and shrink this list.
Adds persist-credentials: false to every actions/checkout step so the default GITHUB_TOKEN isn't persisted in the git config after checkout, applied via `zizmor --fix=unsafe-only`. Also regenerates the remaining ignore entries in .github/zizmor.yml since the fix shifted line numbers for the still-ignored findings further down each file.
Pins every `uses:` reference to its resolved commit SHA (keeping the original version tag as a trailing comment) via `zizmor --fix=unsafe-only`, so a compromised or re-tagged upstream action release can't silently change what CI runs. Also removes the now-stale unpinned-uses entries from .github/zizmor.yml.
…list
Moves attacker-influenceable `${{ }}` expressions (workflow_call inputs,
job outputs) out of deploy.yml's `run:` script bodies into `env:`
variables via `zizmor --fix=unsafe-only`, so their values are passed as
data rather than interpolated directly into the shell script.
cache-poisoning and secrets-inherit have no zizmor autofix, so their
entries in .github/zizmor.yml are left in place pending manual review.
Replaces the file:line ignore lists for cache-poisoning and secrets-inherit with rules.<id>.disable: true. The line-based ignores had to be regenerated by hand every time an earlier fix shifted line numbers in the workflows; disabling the rule avoids that churn since these two audits have no autofix and haven't been addressed yet. Trade-off: unlike the ignore-by-location form, disabling hides *all* future cache-poisoning/secrets-inherit findings anywhere in the repo, not just today's known ones. Re-enable a rule here once it's been fixed.
Adds a zizmor job to ci-cd.yml, installed via uv/uvx per zizmor's own recommended integration, so any newly introduced finding fails CI instead of only being caught by someone running zizmor locally. Existing findings stay suppressed via .github/zizmor.yml.
zetter-rpf
temporarily deployed
to
previews/1571/merge
August 5, 2026 13:50 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
These two jobs were still pinned to the ancient actions/checkout v1 tag while every other job in the repo already uses v4.4.0. Nothing in either job depended on v1-specific behavior, so bump them to match.
zetter-rpf
changed the title
zetter-rpf
marked this pull request as ready for review
August 5, 2026 14:46
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c27b750. Configure here.
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | ||
| with: | ||
| persist-credentials: false |
There was a problem hiding this comment.
Checkout credentials break version bump
High Severity
The persist-credentials: false option in the checkout step removes the git authentication token. This leads to subsequent git push commands failing due to authentication errors, which prevents the bump-version workflow from creating PRs.
Reviewed by Cursor Bugbot for commit c27b750. Configure here.
Contributor
Author
There was a problem hiding this comment.
I'll need to work around this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1695
This introduces Zizmore and autofixes many of the issues (see commits for more)
I've ignored the remaining issues that aren't autofixable. These are lower risk as we don't run actions automatically for untrusted users, but we could choose to fix them in the future.