mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-06 03:57:52 +09:00
myasnikovdaniil
f0e0cec64c
## What this PR does Restores the two OpenSSF Scorecard checks that dropped the aggregate score below our target, and adds a durable gate so they cannot silently regress again. **Root cause.** 15 of 17 workflows already declare a read-only top-level token and pin their actions by SHA. Two did not — `build-main.yaml` and `ui-test.yaml` (the latter added by the in-tree console move) — and that was enough to zero out two checks: - **Token-Permissions** is scored on the weakest workflow, so a single workflow with an undeclared (default-write) top-level token drops the whole check to `0`. - **Pinned-Dependencies** counted the six tag-pinned action refs as unpinned. **Fixes** - `build-main.yaml`, `ui-test.yaml`: add a top-level read-only `permissions` block (job-level `packages: write` kept where the build cache needs it) and pin every action to the SHA already used elsewhere in the tree. - `.github/zizmor.yml` + `.github/workflows/zizmor.yml` + `.pre-commit-config.yaml`: add [zizmor](https://docs.zizmor.sh/) as a gate. It runs on the PR diff (pre-commit) and tree-wide on every workflow-touching PR, failing on any reintroduced unpinned action or missing/overly-broad permissions block. Scope is intentionally limited to the two Scorecard-relevant audits (`unpinned-uses`, `excessive-permissions`), which are clean tree-wide as of this PR; the remaining audits carry pre-existing debt and are disabled with a documented TODO to burn them down and re-enable one at a time. - `scorecard.yml`: wire an optional `SCORECARD_TOKEN` secret. The default `GITHUB_TOKEN` cannot read branch-protection settings, so the Branch-Protection check is currently scored on partial data. The token is a no-op until the secret is added by a maintainer. - `internal/fluxshardoperator/config_fuzz_test.go`: native Go fuzz targets for the shard config parsers (round-trip and range invariants, not just no-panic), giving the Scorecard Fuzzing check a real signal on a hot-path parser. **Verification** - `zizmor --offline .github/workflows/` → *No findings to report* (gate green). - `go test ./internal/fluxshardoperator/ -run '^Fuzz'` passes; a 15s live fuzz of `FuzzParsePinnedTenants` ran 10.5k execs with no crashers. Follow-ups (tracked separately, not in this PR): merge Renovate's digest-pinning PRs to lift Pinned-Dependencies further, tighten branch protection on `main` and release branches, upgrade the OpenSSF Best Practices badge, and sign releases. ### Release note ```release-note ci: pin GitHub Actions by SHA and scope workflow token permissions to restore the OpenSSF Scorecard Token-Permissions and Pinned-Dependencies checks, and add a zizmor gate (pre-commit + PR workflow) that blocks future regressions ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automated security scanning for workflow changes via a dedicated CI workflow, along with a matching pre-commit hook. * **Bug Fixes** * Hardened CI workflows with workflow-level read-only token permissions and pinned GitHub Action versions for more reliable execution. * Improved OpenSSF Scorecard configuration to better handle branch-protection checks when a token secret is available. * **Tests** * Added Go fuzz tests to ensure shard parsing/formatting remains non-panicking and preserves round-trip/contract behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->