Skip to content

feat(zizmor): run zizmor against actions and workflows #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Apr 30, 2025
Merged

feat(zizmor): run zizmor against actions and workflows #20

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
de183ce
zizmor security actions
jamesc-grafana Apr 30, 2025
0825d66
update where zizmor runs depending on visibility
jamesc-grafana Apr 30, 2025
2644061
bump version
jamesc-grafana Apr 30, 2025
7bbbbb7
fix zizmor issue
jamesc-grafana Apr 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .github/workflows/dependabot-automerge.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
steps:
- name: Generate token
id: generate-token
uses: tibdex/github-app-token@v1
uses: tibdex/github-app-token@32691ba7c9e7063bd457bd8f2a5703138591fa58 # v1
continue-on-error: true
with:
app_id: ${{ secrets.DEPENDABOTREVIEWER_ID }}
Expand All @@ -40,9 +40,10 @@ jobs:
id: dependabot-metadata
uses: dependabot/[email protected]
- name: Enable auto-merge for Dependabot PRs
run: gh pr merge --auto --${{ inputs.repository-merge-method }} "$PR_URL"
run: gh pr merge --auto --${MERGE_METHOD} "$PR_URL"
env:
GITHUB_TOKEN: ${{ steps.generate-token.outputs.token || secrets.envPAT || secrets.GITHUB_TOKEN}}
MERGE_METHOD: ${{ inputs.repository-merge-method }}
- name: Approve patch updates
if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' }}
run: gh pr review $PR_URL --approve -b "**Approving** patch update"
Expand Down
19 changes: 19 additions & 0 deletions .github/workflows/self-zizmor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: zizmor GitHub Actions static analysis
on:
push:
pull_request:

jobs:
zizmor:
name: Run zizmor from current branch (self test)

permissions:
actions: read
contents: read

pull-requests: write
security-events: write

uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@5946b80e86f32bb4d208c2483c58345bbeef03d2
with:
Copy link
Member

@iainlane iainlane Apr 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to confirm, this will go straight to blocking - is that the intention?

To do "informational only", it'd be

Suggested change
with:
with:
fail-severity: never

Copy link
Contributor Author

@jamesc-grafana jamesc-grafana Apr 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The intention is that it'd be a failing test, but not "required" if there's anything that's high or above (which I think is the default). So it shouldn't immediately block, and then the "required" one would block on failure once we turn that one on

Copy link
Member

@iainlane iainlane Apr 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok - just as a note of caution: I've rolled out changes like that before, and I'd say that the notion of a required check is not super well understood. We ended up getting quite a few questions from folks asking how they could unblock their stuff, when it never was blocked, because they'd seen the ❌.

Copy link
Contributor Author

@jamesc-grafana jamesc-grafana Apr 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ahh I see, yeah, I think in this case we probably kinda want that behaviour, no technical block, but prompting folks to update their workflows with the suggestion.

codeql-enabled: false
Copy link
Member

@iainlane iainlane Apr 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's get

merged, so we use an org-wide default configuration, and then

Suggested change
uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@5946b80e86f32bb4d208c2483c58345bbeef03d2
with:
codeql-enabled: false
uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@8fa210559ab2cc62e7b12d3bb9cba19dbc862c11

to use that, and upload the results where we can.

Copy link
Member

@iainlane iainlane Apr 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK we're there 👍 I updated the suggestion with the SHA

16 changes: 5 additions & 11 deletions .github/workflows/snyk_monitor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,23 +7,17 @@ on:
required: true
jobs:
snyk_scans:

runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
with:
persist-credentials: false
- name: Run Snyk to import ${{ github.event.repository.name }} to Snyk
continue-on-error: true
uses: snyk/actions/golang@master
uses: snyk/actions/golang@4a528b5c534bb771b6e3772656a8e0e9dc902f8b # master
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
command: monitor
args: --strict-out-of-sync=false --all-projects --exclude=devenv --tags=repo=${{ github.event.repository.name }}







args: --strict-out-of-sync=false --all-projects --exclude=devenv --tags=repo=${{ github.event.repository.name }}
8 changes: 5 additions & 3 deletions trivy/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,14 +69,16 @@ runs:
- name: "Comment the Trivy diff"
env:
GITHUB_TOKEN: ${{ inputs.github-token }}
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
PR_NUMBER: ${{ github.event.pull_request.number }}
BASE_REF: ${{ github.base_ref }}
run: |
output=$(cat output.txt)
if [ "$output" == "No new vulnerabilities found." ]; then
echo "No new vulnerabilities found."
exit 0
else
comment=$(echo -e "### New vulnerabilities introduced in branch $BRANCH_NAME compared to ${{ github.base_ref }}\n\n" ; jq -r '.[] | "* \(.VulnerabilityID), Severity: \(.Severity), Package: \(.PkgName), Installed: \(.InstalledVersion), Fixed: \(.FixedVersion // "N/A")"' output.txt)
gh pr comment ${{ github.event.pull_request.number }} --body "$comment"
comment=$(echo -e "### New vulnerabilities introduced in branch $BRANCH_NAME compared to $BASE_REF\n\n" ; jq -r '.[] | "* \(.VulnerabilityID), Severity: \(.Severity), Package: \(.PkgName), Installed: \(.InstalledVersion), Fixed: \(.FixedVersion // "N/A")"' output.txt)
gh pr comment $PR_NUMBER --body "$comment"
fi
shell: bash