mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 18:47:04 +09:00
Myasnikov DaniilandClaude Opus 4.8
a0bd53f84d
build-main.yaml and ui-test.yaml (the latter added by the in-tree console
move) landed without following the repo's workflow conventions: no top-level
permissions block and actions referenced by moving tags. Together they zero out
two OpenSSF Scorecard checks the rest of the tree already satisfies:
- Token-Permissions: scored on the weakest workflow, so one workflow with an
undeclared (default-write) top-level token drops the whole check to 0.
- Pinned-Dependencies: the six tag-pinned action refs count as unpinned.
Fix both files (top-level read-only token; job-level packages:write kept where
needed; all action refs pinned to the SHA already used elsewhere in the tree)
and add a durable gate so it cannot recur:
- .github/zizmor.yml enables the two Scorecard-relevant audits (unpinned-uses,
excessive-permissions), clean tree-wide as of this commit. The remaining
audits carry pre-existing debt and are disabled with a TODO to burn down and
re-enable one at a time.
- .pre-commit-config.yaml runs zizmor (offline) on changed workflows.
- .github/workflows/zizmor.yml runs the same audit tree-wide on every PR that
touches a workflow, failing on any reintroduced regression.
Also wire scorecard.yml to an optional SCORECARD_TOKEN secret: the default
GITHUB_TOKEN cannot read branch-protection settings, so the Branch-Protection
check is scored on partial data. The token is a no-op until the secret is added.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
name: zizmor
|
|
|
|
# Tree-wide GitHub Actions security gate. Fails the PR when a workflow
|
|
# reintroduces an unpinned action or a missing/overly-broad permissions block
|
|
# (Scorecard's Pinned-Dependencies and Token-Permissions checks). The audit
|
|
# scope is pinned in .github/zizmor.yml; the same tool also runs on the PR diff
|
|
# via the pre-commit hook.
|
|
#
|
|
# Runs offline: the two gating audits are purely syntactic, so no GitHub token is
|
|
# needed and no data leaves the runner. Findings are surfaced in the job log and
|
|
# fail the step; the SARIF is intentionally NOT uploaded to code scanning, matching
|
|
# scorecard.yml — the public signal is the failing check, not a Security-tab alert.
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '.github/workflows/**'
|
|
- '.github/zizmor.yml'
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- '.github/workflows/**'
|
|
- '.github/zizmor.yml'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: zizmor-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
zizmor:
|
|
name: Audit workflows
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install zizmor
|
|
run: pipx install zizmor==1.26.1
|
|
|
|
- name: Audit workflows
|
|
run: zizmor --offline .github/workflows/
|