Skip to content

Introduce Zizmore to audit Github actions #1571

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zetter-rpf wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Introduce Zizmore to audit Github actions #1571

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
58d32f9
Add zizmor config ignoring existing GitHub Actions findings
zetter-rpf Aug 5, 2026
6562bda
Fix zizmor artipacked findings and drop them from the ignore list
zetter-rpf Aug 5, 2026
4366163
Fix zizmor unpinned-uses findings and drop them from the ignore list
zetter-rpf Aug 5, 2026
f78cd6f
Fix zizmor template-injection findings and drop them from the ignore …
zetter-rpf Aug 5, 2026
3a0a804
Simplify zizmor config to disable remaining rules outright
zetter-rpf Aug 5, 2026
599a260
Run zizmor in CI to catch new GitHub Actions findings
zetter-rpf Aug 5, 2026
c27b750
Bump actions/checkout to v4 in the test and test-cypress jobs
zetter-rpf Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/bump-version.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false

@cursor cursor Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checkout credentials break version bump

High Severity

The persist-credentials: false option in the checkout step removes the git authentication token. This leads to subsequent git push commands failing due to authentication errors, which prevents the bump-version workflow from creating PRs.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit c27b750. Configure here.

@zetter-rpf zetter-rpf Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll need to work around this.


- name: Cache dependencies
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: "yarn"
Expand Down
43 changes: 34 additions & 9 deletions .github/workflows/ci-cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,38 @@ permissions:
packages: read

jobs:
zizmor:
name: zizmor
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false

- name: Install uv
uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2

- name: Run zizmor
run: uvx "zizmor@1.29.0" --format=github .
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Comment thread
zetter-rpf marked this conversation as resolved.

lint:
runs-on: ubuntu-latest
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false

- name: Check for SCSS changes
uses: dorny/paths-filter@v3
uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
id: changes
with:
filters: |
Expand All @@ -36,7 +57,7 @@ jobs:
- 'package.json'

- name: Cache dependencies
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: "yarn"
Expand All @@ -61,10 +82,12 @@ jobs:
NPM_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- name: Checkout
uses: actions/checkout@v1
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false

- name: Cache dependencies
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: "yarn"
Expand Down Expand Up @@ -101,10 +124,12 @@ jobs:
REACT_APP_SCRATCH_FRAME_URL: "http://localhost:3014"
steps:
- name: Checkout
uses: actions/checkout@v1
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false

- name: Cache dependencies
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: "yarn"
Expand All @@ -119,7 +144,7 @@ jobs:
run: yarn build:all

- name: Cypress run
uses: cypress-io/github-action@v7
uses: cypress-io/github-action@fa4a118725a8f001170d49631ea89e5d66fee626 # v7.4.1
with:
install: false
start: |
Expand All @@ -130,7 +155,7 @@ jobs:
browser: chrome

- name: Archive cypress artifacts
uses: actions/upload-artifact@v4.6.0
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
if: failure()
with:
name: cypress-artifacts
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/close_stale_issues_and_prs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
stale:
runs-on: ubuntu-latest
steps:
- uses: actions/stale@v10
- uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
with:
stale-issue-message: 'This issue is stale because it has been open for 90 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
stale-pr-message: 'This PR is stale because it has been open for 30 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
Expand All @@ -22,4 +22,4 @@ jobs:
days-before-issue-stale: 90
days-before-pr-stale: 30
days-before-issue-close: 7
days-before-pr-close: 7
days-before-pr-close: 7
36 changes: 24 additions & 12 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,19 +92,25 @@ jobs:
- id: setup-environment
run: |
safe_ref_name="${GITHUB_REF_NAME//[![:alnum:].]/_}"
deploy_dir=${{inputs.prefix}}/$safe_ref_name
public_url=${{inputs.base_url}}/$deploy_dir
assets_url=${{inputs.assets_url}}/$deploy_dir
html_renderer_url=${{inputs.html_renderer_url}}/$deploy_dir
deploy_dir=${INPUTS_PREFIX}/$safe_ref_name
public_url=${INPUTS_BASE_URL}/$deploy_dir
assets_url=${INPUTS_ASSETS_URL}/$deploy_dir
html_renderer_url=${INPUTS_HTML_RENDERER_URL}/$deploy_dir
echo "deploy_dir=$deploy_dir" >> $GITHUB_OUTPUT
echo "public_url=$public_url" >> $GITHUB_OUTPUT
echo "assets_url=$assets_url" >> $GITHUB_OUTPUT
echo "html_renderer_url=$html_renderer_url" >> $GITHUB_OUTPUT
if [ "${{inputs.react_app_base_url}}" = "unspecified" ] ; then
if [ "${INPUTS_REACT_APP_BASE_URL}" = "unspecified" ] ; then
echo "react_app_base_url=$deploy_dir" >> $GITHUB_OUTPUT
else
echo "react_app_base_url=${{inputs.react_app_base_url}}" >> $GITHUB_OUTPUT
echo "react_app_base_url=${INPUTS_REACT_APP_BASE_URL}" >> $GITHUB_OUTPUT
fi
env:
INPUTS_PREFIX: ${{inputs.prefix}}
INPUTS_BASE_URL: ${{inputs.base_url}}
INPUTS_ASSETS_URL: ${{inputs.assets_url}}
INPUTS_HTML_RENDERER_URL: ${{inputs.html_renderer_url}}
INPUTS_REACT_APP_BASE_URL: ${{inputs.react_app_base_url}}

build-deploy:
runs-on: ubuntu-latest
Expand All @@ -119,14 +125,18 @@ jobs:
steps:
- name: Check deployment path
run: |
echo "Deploying to '${{ needs.setup-environment.outputs.deploy_dir }}' -- job will fail if this is empty!"
[ -n "${{ needs.setup-environment.outputs.deploy_dir }}" ]
echo "Deploying to '${NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR}' -- job will fail if this is empty!"
[ -n "${NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR}" ]
env:
NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR: ${{ needs.setup-environment.outputs.deploy_dir }}

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false

- name: Cache dependencies
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: "yarn"
Expand Down Expand Up @@ -158,12 +168,13 @@ jobs:
- name: Deploy site to S3 bucket
if: env.AWS_SECRET_ACCESS_KEY != ''
run: |
aws s3 sync ./build/ s3://${{ secrets.AWS_S3_BUCKET }}/${{ needs.setup-environment.outputs.deploy_dir }} --endpoint ${{ secrets.AWS_ENDPOINT }} --progress-frequency 5
aws s3 sync ./build/ s3://${{ secrets.AWS_S3_BUCKET }}/${NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR} --endpoint ${{ secrets.AWS_ENDPOINT }} --progress-frequency 5
aws s3 sync ./build/chunks/ s3://${{ secrets.AWS_S3_BUCKET }}/chunks/ --endpoint ${{ secrets.AWS_ENDPOINT }} --exclude "*" --include "fetch-worker*" --include "mediapipe/**" --progress-frequency 5
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_REGION: ${{ secrets.AWS_REGION }}
NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR: ${{ needs.setup-environment.outputs.deploy_dir }}

- name: Update latest version file
if: env.AWS_SECRET_ACCESS_KEY != '' && github.ref_type == 'tag'
Expand All @@ -174,11 +185,12 @@ jobs:
fi

# Use no-cache so latest_version is revalidated after tag deploys.
echo -n "${{ needs.setup-environment.outputs.deploy_dir }}" | aws s3 cp - s3://${{ secrets.AWS_S3_BUCKET }}/latest_version --endpoint ${{ secrets.AWS_ENDPOINT }} --content-type "text/plain" --cache-control "no-cache"
echo -n "${NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR}" | aws s3 cp - s3://${{ secrets.AWS_S3_BUCKET }}/latest_version --endpoint ${{ secrets.AWS_ENDPOINT }} --content-type "text/plain" --cache-control "no-cache"
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_REGION: ${{ secrets.AWS_REGION }}
NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR: ${{ needs.setup-environment.outputs.deploy_dir }}

- name: Purge Cloudflare cache
if: env.HAS_CLOUDFLARE_SECRETS == 'true'
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/dispatch-learner-experience-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
fetch-depth: 1
persist-credentials: false

- name: Trigger learner-experience integration tests
env:
Expand Down
5 changes: 5 additions & 0 deletions .github/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
rules:
cache-poisoning:
disable: true
secrets-inherit:
disable: true
Loading