Myasnikov DaniilandClaude Opus 4.8 076658e70f fix(ci): avoid zizmor github-env finding on fork e2e sandbox name ...

The `Set sandbox ID` step wrote a computed value to $GITHUB_ENV, which the
zizmor github-env audit flags as high severity (write to GITHUB_ENV may allow
code execution). Set SANDBOX_NAME as a job-level env var instead — no
$GITHUB_ENV write, so the audit does not apply. Uses github.run_id, which is
unique per run; in workflow_run context GITHUB_REF is the default branch and
cannot disambiguate concurrent fork runs sharing a self-hosted host.

Refs: #3257

Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

2026-07-29 17:47:26 +05:00

..

api-review-gate.yaml

fix(ci): build api-gate detector from base tip when merge base predates it

2026-07-03 18:39:21 +03:00

backport.yaml

ci: move remaining workflows off the persistent self-hosted runner

2026-07-09 20:50:43 +02:00

build-main.yaml

Merge branch 'main' into ci/scorecard-hardening

2026-07-07 16:49:29 +05:00

changelog-generate.yaml

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

changelog-rc.yaml

fix(ci): grant rc-e2e the checks:write ceiling e2e-tag.yaml declares

2026-07-27 14:03:49 +05:00

codegen-drift.yml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

codeql.yml

chore(deps): update actions/checkout action to v6.0.3

2026-07-12 13:35:59 +00:00

cut-prerelease.yaml

ci(release): make full e2e mandatory for freshly cut rc tags

2026-07-24 18:16:08 +05:00

e2e-fork.yaml

fix(ci): avoid zizmor github-env finding on fork e2e sandbox name

2026-07-29 17:47:26 +05:00

e2e-tag.yaml

fix(ci): grant rc-e2e the checks:write ceiling e2e-tag.yaml declares

2026-07-27 14:03:49 +05:00

labels.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

nightly.yaml

refactor(ci): drop the vestigial /tmp workspace from e2e (both workflows)

2026-07-28 17:49:02 +02:00

pr-labeler.yaml

ci(labeler): map cert-manager, external-secrets and metrics-server scopes

2026-07-20 05:29:41 +03:00

pr-size.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pre-commit.yml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

promote-rc.yaml

ci(release): open the website docs PR at promote time

2026-07-24 18:16:26 +05:00

pull-requests-release.yaml

ci(release): stop finalize persisting credentials so the tag push triggers tags.yaml

2026-07-24 18:16:26 +05:00

pull-requests.yaml

fix(ci): export OCI archives for buildx calls that bypass image-tags (#3257)

2026-07-29 17:47:25 +05:00

retention.yaml

ci: pin action refs flagged by the zizmor gate (#3223)

2026-07-09 13:15:39 +05:00

scorecard.yml

chore(deps): update actions/checkout action to v6.0.3

2026-07-12 13:35:59 +00:00

stale.yaml

chore(deps): update container image & action digests

2026-07-10 05:29:23 +00:00

tags.yaml

fix(ci): grant rc-e2e the checks:write ceiling e2e-tag.yaml declares

2026-07-27 14:03:49 +05:00

ui-test.yaml

ci(actions): pin third-party GitHub Actions to commit SHAs

2026-07-07 11:28:53 +02:00

update-releasenotes.yaml

ci: move remaining workflows off the persistent self-hosted runner

2026-07-09 20:50:43 +02:00

zizmor.yml

ci: pin workflow actions, scope token permissions, add zizmor gate

2026-07-07 11:31:13 +05:00