-
[OPIK-6366] [INFRA] feat: add zizmor security scan for GitHub Actions workflows (#7546)
frostbyte_neo 发布于
2026-08-04 08:48:16 +00:00 - [OPIK-6366] [INFRA] feat: add zizmor security scan for GitHub Actions workflows
Add zizmor (Trail of Bits) as a security scanner for GitHub Actions
workflows, complementing actionlint's syntax/shell linting. Runs as a
pre-commit hook in the unified Code Quality workflow at high severity,
regular persona, offline — matching how actionlint and hadolint are wired.Rule tuning lives in .github/zizmor.yml (auto-discovered); unpinned-uses
is disabled there pending a separate SHA-pinning migration.Fixes all 63 high-severity findings on main:
- 44 template-injection: hoist ${{ }} out of run: bodies into env:
- 18 excessive-permissions: scope write grants down to the jobs that
use them; workflow defaults drop to contents: read (packages: write
passed down to reusable-workflow-call jobs to preserve GHCR pushes) - 1 dangerous-triggers: documented inline ignore on labeler.yml's
pull_request_target (safe — never executes PR-controlled code)
Document local zizmor usage in CONTRIBUTING.md.
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- test(precommit): require every hook to have a timing-table description
The zizmor hook showed a blank description in the Code Quality per-hook
timing comment because it had no entry in precommit-hook-descriptions.tsv.- Add the missing zizmor description.
- Add a coverage test in test_precommit_wrappers.sh that reads every hook
name from .pre-commit-config.yaml and asserts each resolves to a
non-empty description via precommit-hook-desc.py — so a hook added
without a TSV entry now fails CI instead of silently rendering blank. - Widen the wrapper-tests hook's files: trigger to include the TSV, the
desc resolver, and .pre-commit-config.yaml so the check reruns when a
hook is added or renamed.
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- fix(workflows): correct GitHub branding typo in commit-author name
git config user.name was "Github Actions" in three sync/commit workflows;
fixed to "GitHub Actions". Flagged by Baz on PR #7546.Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- fix(workflows): restore permissions that the least-privilege pass dropped
Two grants were reduced below what the jobs actually need:
- build-apps caller passes is_release: false, so build_apps.yml's
create-git-tag job runs and pushes a tag; contents: read made that
git push 403. A called workflow can't elevate above its caller. - select-e2e-matrix lists changed files via the PR files API under
set -euo pipefail, so a 403 is fatal for select-matrix and every job
that needs it. Four workflows lost pull-requests at the workflow
level without regaining it per-job; typescript_sdk_e2e_tests.yml
already carried it, so this restores consistency.
zizmor only audits for over-permissioning (excessive-permissions) and
comment coverage (undocumented-permissions), so neither gap was
detectable by the scanner this PR adds.Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Co-authored-by: Claude Opus 4.8 (1M context) noreply@anthropic.com
下载附件