mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 10:37:21 +09:00
Myasnikov DaniilandClaude Opus 4.8
a0bd53f84d
build-main.yaml and ui-test.yaml (the latter added by the in-tree console
move) landed without following the repo's workflow conventions: no top-level
permissions block and actions referenced by moving tags. Together they zero out
two OpenSSF Scorecard checks the rest of the tree already satisfies:
- Token-Permissions: scored on the weakest workflow, so one workflow with an
undeclared (default-write) top-level token drops the whole check to 0.
- Pinned-Dependencies: the six tag-pinned action refs count as unpinned.
Fix both files (top-level read-only token; job-level packages:write kept where
needed; all action refs pinned to the SHA already used elsewhere in the tree)
and add a durable gate so it cannot recur:
- .github/zizmor.yml enables the two Scorecard-relevant audits (unpinned-uses,
excessive-permissions), clean tree-wide as of this commit. The remaining
audits carry pre-existing debt and are disabled with a TODO to burn down and
re-enable one at a time.
- .pre-commit-config.yaml runs zizmor (offline) on changed workflows.
- .github/workflows/zizmor.yml runs the same audit tree-wide on every PR that
touches a workflow, failing on any reintroduced regression.
Also wire scorecard.yml to an optional SCORECARD_TOKEN secret: the default
GITHUB_TOKEN cannot read branch-protection settings, so the Branch-Protection
check is scored on partial data. The token is a no-op until the secret is added.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
38 lines
1.6 KiB
YAML
38 lines
1.6 KiB
YAML
# zizmor configuration — https://docs.zizmor.sh/configuration/
|
|
#
|
|
# zizmor audits GitHub Actions workflows for supply-chain and permission issues.
|
|
# It runs in two places: the pre-commit hook (.pre-commit-config.yaml) for local
|
|
# and PR-diff feedback, and the dedicated gate workflow (.github/workflows/zizmor.yml)
|
|
# for a full-tree scan on every PR.
|
|
#
|
|
# Scope of the gate (deliberately narrow for now): only the two audits that map
|
|
# directly to the OpenSSF Scorecard checks this repo keeps regressing on —
|
|
# * unpinned-uses -> Scorecard "Pinned-Dependencies"
|
|
# * excessive-permissions -> Scorecard "Token-Permissions"
|
|
# Both are clean tree-wide as of this config, so the gate is green and blocks any
|
|
# new workflow that reintroduces an unpinned action or a missing permissions block
|
|
# (the exact regression the in-tree console move introduced via ui-test.yaml).
|
|
#
|
|
# The remaining audits below carry pre-existing findings (58 at time of writing).
|
|
# They are genuinely valuable — template-injection and dangerous-triggers most of
|
|
# all — but fixing them is a separate cleanup, not this hardening PR. They are
|
|
# disabled here (not ignored per-line, to avoid brittle line-number churn) with a
|
|
# TODO to burn the debt down and re-enable them one audit at a time.
|
|
#
|
|
# TODO(scorecard-hardening): burn down and re-enable, highest value first:
|
|
# template-injection, dangerous-triggers, cache-poisoning, github-app,
|
|
# adhoc-packages, artipacked.
|
|
rules:
|
|
template-injection:
|
|
disable: true
|
|
dangerous-triggers:
|
|
disable: true
|
|
cache-poisoning:
|
|
disable: true
|
|
github-app:
|
|
disable: true
|
|
adhoc-packages:
|
|
disable: true
|
|
artipacked:
|
|
disable: true
|