Skip to content

COPP-8605: Deploy zizmor to open source repos #486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Lachlan Kidson (lachlankidson) wants to merge 5 commits into
base: main
Choose a base branch
from
+48 −9
Open

COPP-8605: Deploy zizmor to open source repos #486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f5e53c4
COPP-8605: Deploy zizmor to open source repos
lachlankidson Jan 15, 2026
78bb721
zizmor --fix=all .
lachlankidson Jan 15, 2026
50e809e
pinact run -fix -diff
lachlankidson Jan 15, 2026
a9d7fc7
Add permissions blocks
lachlankidson Jan 15, 2026
28d74fb
pull_request_target to pull_request
lachlankidson Jan 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/dependabot.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,13 @@ updates:
ignore:
- dependency-name: '*'
update-types: ['version-update:semver-patch']
cooldown:
default-days: 7
Comment on lines +13 to +14
Copy link
Copy Markdown
Author

@lachlankidson Lachlan Kidson (lachlankidson) Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You may want to tweak this value, 7 is the zizmor autofix default, see:

- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weekly
time: "10:00"
open-pull-requests-limit: 10
cooldown:
default-days: 7
12 changes: 8 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,18 @@ defaults:
run:
shell: bash -l {0}

permissions: {}

jobs:
build:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false

- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version-file: ".nvmrc"
registry-url: 'https://registry.npmjs.org'
Expand All @@ -41,13 +45,13 @@ jobs:
contents: write
pull-requests: read
steps:
- uses: actions/create-github-app-token@v2
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
id: app-token
with:
app-id: ${{ vars.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- name: Draft release notes
uses: release-drafter/release-drafter@v6
uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
6 changes: 4 additions & 2 deletions .github/workflows/label-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,17 @@
name: label-check

permissions: {}

on:
pull_request_target:
pull_request:
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changing from pull_request_target to pull_request may be a security improvement, but could break functionality if this workflow needs access to secrets or write permissions for external PRs. The pull_request_target trigger runs in the context of the base repository with access to secrets, while pull_request runs in the context of the fork for external PRs. Verify that this workflow doesn't require secrets or elevated permissions when triggered by external contributors.

Suggested change
pull_request:
pull_request_target:

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Author

@lachlankidson Lachlan Kidson (lachlankidson) Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is true, however please see docs.zizmor.sh/audits#dangerous-triggers and determine if this is a risk you are willing to accept. You will need to opt-out of this rule if so.

types: [opened, labeled, unlabeled, synchronize]

jobs:
label-check:
runs-on: ubuntu-latest

steps:
- uses: actions/create-github-app-token@v2
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
id: app-token
with:
app-id: ${{ vars.GH_APP_ID }}
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,22 +8,25 @@ defaults:
run:
shell: bash -l {0}

permissions: {}

jobs:
release:
runs-on: ubuntu-latest
environment: Publishing

steps:
- uses: actions/create-github-app-token@v2
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
id: app-token
with:
app-id: ${{ vars.GH_APP_ID }}
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
token: ${{ steps.app-token.outputs.token }}
fetch-depth: 0
persist-credentials: false

- name: Configure Git and checkout default branch
if: ${{ github.event_name == 'release' }}
Expand All @@ -36,7 +39,7 @@ jobs:
git checkout $DEFAULT_BRANCH
git pull origin $DEFAULT_BRANCH

- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version-file: ".nvmrc"
registry-url: 'https://registry.npmjs.org'
Expand Down
26 changes: 26 additions & 0 deletions .github/workflows/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: GitHub Actions Security Analysis with zizmor 🌈

on:
push:
branches:
- "main"
pull_request:
branches:
- "**"

permissions: {}

jobs:
zizmor:
runs-on: ubuntu-24.04-2cores-tools-public
permissions:
security-events: write
steps:
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
persist-credentials: false

- name: Run zizmor 🌈
uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0