feat(ci): add zizmor static analysis for Actions/workflows - #5016
Open
dgershman wants to merge 1 commit into
Open
feat(ci): add zizmor static analysis for Actions/workflows#5016dgershman wants to merge 1 commit into
dgershman wants to merge 1 commit into
Conversation
✅ Deploy Preview for zarf-docs canceled.
|
Integrate zizmor (https://github.com/zizmorcore/zizmor) as a static-analysis scan for GitHub Actions and workflows, addressing #4849. New `.github/workflows/scan-zizmor.yml` follows the existing `scan-*.yml` convention: it runs on pull_request, merge_group, push to main, and weekly (Mon 04:27 UTC). It uploads SARIF to the code-scanning dashboard on push and schedule (skipped on pull_request, since forked-PR tokens cannot write security events — mirroring scorecard.yaml), giving a deterministic source of truth for new findings. The scan is advisory for now (`continue-on-error`): the repo has a backlog of existing findings — several in release-critical workflows — that will be remediated in severity-ordered follow-up PRs, per the maintainer's guidance on #4849 ("once the current findings are remediated then I think CI makes a good case"). Once the backlog is cleared, dropping `continue-on-error` turns this into a merge gate. Also remediates the one genuinely attacker-controllable finding so it does not reach the dashboard backlog: `test-import.yaml` interpolated `github.event.pull_request.head.repo.full_name` (a forked-PR repo name) directly into a `run:` block. Moved it into the existing `env:` block as `HEAD_REPO` and reference it as a shell variable — the same indirection the file already uses for `COMMIT_SHA`. Behavior is unchanged. zizmor is pinned to v1.26.1 (run via `pipx run`), mirroring how scan-lint.yml pins golangci-lint by version. Crow-Session: 7E0394B6-437C-46EA-9755-1C9F01CF7E72 Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Danny Gershman <danny.gershman@gmail.com>
dgershman
force-pushed
the
feature/zarf-4849-static-analysis-actions
branch
from
June 29, 2026 16:30
286b76e to
cf5baaa
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4849
What
Integrates zizmor as static analysis for GitHub Actions and workflows, giving the project a deterministic source of truth for new supply-chain/CI findings — both on change and on a periodic schedule, as the issue requested.
.github/workflows/scan-zizmor.yml(new)scan-*.ymlconvention: triggers onpull_request,merge_group,pushtomain, and a weekly schedule (Mon 04:27 UTC, clear of the CodeQL/Scorecard slots).push/schedule. Upload is skipped onpull_requestbecause forked-PR tokens are read-only and cannot write security events — the same reasonscorecard.yamlavoidspull_request. The dashboard stays current via push-to-main and the weekly run.pipx run), mirroring howscan-lint.ymlpins golangci-lint by version. No new third-party action is introduced — it reuses theactions/checkoutandgithub/codeql-action/upload-sarifSHAs already in the repo.continue-on-error): see below.test-import.yaml(fix)Remediates the one genuinely attacker-controllable finding so it doesn't land in the dashboard backlog: the workflow interpolated
github.event.pull_request.head.repo.full_name(a forked-PR repo name) directly into arun:block (template-injection, High/High). Moved it into the existingenv:block asHEAD_REPOand referenced it as a shell variable — the exact indirection the file already uses forCOMMIT_SHA. Behavior is unchanged.Why advisory first
The maintainer asked to remediate findings highest-severity-first across multiple PRs, and noted: "once the current findings are remediated then I think CI makes a good case."
A baseline run (zizmor v1.26.1,
.github/) surfaces 12 remaining High findings after this PR's fix — several in release-critical workflows:template-injectioninputs.*/github.actorinnightly-eks.yml,nightly-release.yaml,release.yml,packages/action.yaml— safe env-indirection fixesgithub-apprelease-please.yml,release.yml—create-github-app-tokenw/o scopedpermission-*; the second scopes a cross-repohomebrew-taptoken used by GoReleaser (only verifiable at release time)cache-poisoningsetup-gocaching in release/publish workflows(plus ~38 Medium and 1 Low, mostly
artipacked/excessive-permissions).Rather than land a large, release-risky diff in one go, this PR establishes the scanner + dashboard now and does not block merges. The remaining findings are visible in code scanning and will be remediated in severity-ordered follow-up PRs, each with reasoning about impact. Once the backlog is cleared, dropping
continue-on-errorfrom the run step turns this into a merge gate.Verification
Run locally with the same pinned version:
scan-zizmor.ymlis itself clean under zizmor (setspersist-credentials: false).test-import.yamlno longer reportstemplate-injection; thego.modreplace directive expands to the identical string.