actions: audit workflows with zizmor, and fix what it found - #123
Merged
Merged
Conversation
Adds zizmor alongside actionlint: actionlint covers syntax, expressions and shell, zizmor covers credential persistence, cache poisoning and unpinned actions. Drops the checkout credential nothing was using, stops the release job restoring a cache that PR builds can write to, and gives dependabot a week of cooldown. The SLSA builder stays on a tag, which it requires.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| contents: write # upload multiple.intoto.jsonl to the release | ||
| # the slsa builder must be referenced by tag, not commit hash; it verifies its own ref at runtime | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 # zizmor: ignore[unpinned-uses] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds zizmor, a security scanner for GitHub Actions workflows, and fixes everything it flagged.
Why
Workflows run with real power — they can publish releases, write to the repo and read secrets. A mistake in one is a way for someone to borrow that power.
actionlintalready checks our workflows for syntax and shell mistakes, but it does not look for this.What it found
Checkouts keeping a password they did not need. Checking out the code leaves a credential on disk for the rest of the job. None of these jobs push anything, so it is now thrown away as soon as the code is fetched.
A build cache the release job could be tricked into trusting. The release job restored a cache that ordinary PR builds can write to. A poisoned entry would end up inside a published binary. The release now builds without the cache.
- uses: actions/setup-go@... with: + cache: falseDependency updates landing the moment they are published. Dependabot opened PRs as soon as a new version appeared, which is exactly when a compromised release is most likely to still be undetected. Updates now wait a week.
The one thing left as it is. The release uses SLSA's builder to sign what we publish, and that has to be referenced by tag rather than a commit hash — it checks its own reference at runtime. Marked so the scanner stops asking, with the existing comment explaining why.
How it runs
make zizmorlocally, and aworkflow security auditcheck on PRs that touch workflows and on pushes to main — the same shape as the existing typos and actionlint checks. The binary is pinned in the makefile alongside shellcheck and typos.