ci: harden test.yaml and docs.yaml for zizmor - #767
Open
tyler-reitz wants to merge 1 commit into
Open
Conversation
Split out of #766 at Jeff's request, so that PR can stay focused on the release checks. This is a pre-existing, repo-wide condition rather than anything the gate introduced: the zizmor scan only runs when a workflow file changes, so it fires against whatever state the file was already in. Both workflows, since he asked for docs.yaml too: - **All 14 action references pinned to commit SHAs**, with the resolved release in a trailing comment so versions stay legible and Dependabot can still bump them. Clears `unpinned-uses`, the only mandatory audit. - **Top-level `permissions: contents: read`.** Neither workflow writes to the repo through GITHUB_TOKEN; the publish job authenticates to npm separately, now via the Google npm service. Clears `excessive-permissions`. - **`persist-credentials: false` on all four checkouts.** The token is not needed after the clone, and leaving it in .git/config exposes it to every later step. Clears `artipacked`. Result, measured with the version CI pins (1.25.2): test.yaml 8 medium, 17 high -> 0 medium, 5 high docs.yaml 2 medium, 2 high -> no findings at all CI fails on Medium or higher, so partial fixes would not have cleared it. The 5 remaining findings on test.yaml are all `cache-poisoning`, which the org scan suppresses; fixing those means restructuring how the workflow caches around the publish path and does not belong here. No functional change to any job. Verified that main's switch of the publish registry to wombat-dressing-room is preserved.
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split out of #766 at @jhuleatt's request, so that PR can stay focused on the release checks. Covers
docs.yamltoo, as he asked.This is a pre-existing, repo-wide condition rather than anything #766 introduced. The zizmor scan only runs when a workflow file changes, so it fires against whatever state the file was already in.
Changes
unpinned-uses, the only mandatory audit.permissions: contents: readon both workflows. Neither writes to the repo throughGITHUB_TOKEN; the publish job authenticates to npm separately. Clearsexcessive-permissions.persist-credentials: falseon all four checkouts. The token is not needed after the clone, and leaving it in.git/configexposes it to every later step. Clearsartipacked.Result
Measured with the version CI pins (1.25.2):
test.yamldocs.yamlCI fails on Medium or higher, so partial fixes would not clear it.
The 5 remaining findings on
test.yamlare allcache-poisoning, which the org scan suppresses. Fixing those means restructuring how the workflow caches around the publish path, which does not belong here.Notes
No functional change to any job. 32 lines across two files.
Verified that main's switch of the publish registry to
wombat-dressing-room.appspot.com(fcbfe83) is preserved, since the pinning touches that samesetup-nodeblock.🤖 Generated with Claude Code