Skip to content

chore(security): remediate workflow zizmor issues#39

Merged
dblinkhorn merged 1 commit intomainfrom
fix-zizmor-issues
Apr 28, 2025
Merged

chore(security): remediate workflow zizmor issues#39
dblinkhorn merged 1 commit intomainfrom
fix-zizmor-issues

Conversation

@dblinkhorn
Copy link
Copy Markdown
Contributor

Fixed issues flagged by zizmor linting.

build.yml

  1. "does not set persist-credentials: false" for actions/checkout (added it)
  2. "overly broad permissions" for build job (added explicit permissions)
  3. "action is not pinned to a hash" for zendesk/setup-jsonnet (changed to commit SHA)

push.yml

  1. "does not set persist-credentials" for actions/checkout

zizmor also flagged several issues for workflow definitions under /generator/vendor/github.com/. I did not address those in this PR.

Trufflehog found one false-positive: ftp://admin:password@example.com

@dblinkhorn dblinkhorn requested a review from a team as a code owner April 28, 2025 18:43
@dblinkhorn dblinkhorn merged commit 5e769dd into main Apr 28, 2025
2 checks passed
@dblinkhorn dblinkhorn deleted the fix-zizmor-issues branch April 28, 2025 21:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants