Repository navigation
Fix findings of the workflow linters - #341
Open
ondrejmirtes wants to merge 1 commit into
Open
ondrejmirtes wants to merge 1 commit into
ondrejmirtes wants to merge 1 commit into
Conversation
actionlint, octoscan, poutine and zizmor (auditor persona) now report nothing. - Check out without persisting credentials, except in create-tag, where rickstaa/action-create-tag pushes the tag with the bot token so that the push triggers release.yml - Default every workflow to no permissions and grant each job what it uses - Add concurrency: superseded pull request runs are cancelled, pushes to 2.4.x each keep their own run, and release workflows are queued, not cancelled - Pass matrix.branch and github.ref_name to scripts through env - Name the remaining anonymous jobs - Create the release with gh release create instead of softprops/action-gh-release - Download a pinned actionlint release and verify its checksum instead of piping a script from main into bash - Allow the reviewed actions from unverified creators in .github/poutine.yml and the repository secrets used outside environments in .github/zizmor.yml - Ignore octoscan's dangerous-checkout message: every flagged ref is a fixed branch or commit, and octoscan cannot ignore findings per file Amp-Thread-ID: https://ampcode.com/threads/T-01a197a6-ea3e-77f5-80d6-1bebc3252d55
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes what the linters in
lint-workflows.ymlreport. I ran each one locally the way CI runs it: actionlint 1.7.12 with shellcheck, octoscan through the action's ownentrypoint.shwith the same inputs, poutine 1.1.4, and zizmor 1.31.1 with--persona=auditor.What changed
persist-credentials: false, except increate-tag.yml. There,rickstaa/action-create-tagpushes the tag with the persistedPHPSTAN_BOT_TOKEN, and only a tag pushed by that token, not byGITHUB_TOKEN, triggersrelease.yml. This is now explicit and commented. Every other step that writes uses its own token through the API or an input.permissions: {}, and each job is granted what it uses, with a comment. The default token was already read-only (contents,metadata,packages: read), so in practice only the unusedpackages: readis dropped.cancel-in-progress: falseinstead of cancelling.matrix.branchinapiref.ymlandgithub.ref_nameinsend-pr.ymlreach the shell throughenv.softprops/action-gh-releaseis replaced bygh release create "$TAG" --verify-tag --title "$TAG" --notes "$CHANGELOG", using the same bot token.peter-evans/create-pull-requeststays, because it commits, pushes a branch and opens the PR in one step. Its zizmorsuperfluous-actionsfinding is ignored inline.bash <(curl …/main/…).Suppressions (please review)
.github/poutine.ymlskipsgithub_action_from_unverified_creator_usedfor an explicit list of the pinned actions we use, such as setup-php, lock-threads, and the release/tag actions..github/zizmor.ymlallows the repository secrets used outside environments (secrets-outside-env). Fixing this properly means moving the secrets into dedicated environments in the repository settings first.dangerous-checkoutflags every ref that isn't made of letters and dashes only, so2.3.x,2.x, a pinned SHA andmatrix.branchall count. octoscan can only ignore findings by message, not by file, so this message is now ignored globally. zizmor and poutine still check for checkouts of untrusted code.The release workflows (
release,send-pr,create-tag, toot/tweet) can't run from a PR, so the release changes are verified only by reading the actions' sources.