feat(ci): Zizmor CI by jvanz · Pull Request #1596 · kubewarden/adm-controller

jvanz · 2026-03-20T16:55:32Z

Description

Adds a new CI to run Zizmor linter and fix all the warning reported by it

Copilot

Pull request overview

Adds Zizmor static analysis to the CI pipeline and applies a set of GitHub Actions hardening changes (least-privilege permissions, non-persisted checkout credentials, and reduced expression interpolation in shell) to address Zizmor findings.

Changes:

Add a make zizmor target (with optional local install) and a dedicated .github/workflows/zizmor.yml workflow to run Zizmor on workflow changes.
Harden multiple workflows by setting minimal permissions and actions/checkout with persist-credentials: false.
Refactor some workflow run: scripts to use environment variables (and jq) instead of direct ${{ ... }} interpolation where applicable.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Makefile	Adds `ZIZMOR_VERSION` and a `zizmor` target to run the linter locally.
.github/workflows/zizmor.yml	New workflow to run Zizmor on `.github/**` workflow changes with minimal permissions.
.github/workflows/update-dependencies.yaml	Adds least-privilege permissions, disables persisted checkout credentials, and shifts to GitHub App token usage for Updatecli.
.github/workflows/security-audit-reactive.yml	Adds least-privilege permissions and disables persisted checkout credentials.
.github/workflows/security-audit-cron.yml	Adds least-privilege permissions and disables persisted checkout credentials.
.github/workflows/release.yml	Hardens permissions/checkout and refactors some scripting (env vars + `jq`) in release/sync steps.
.github/workflows/open-release-pr.yml	Adds minimal permissions, disables persisted checkout credentials, and keeps GitHub App token usage.
.github/workflows/fossa.yml	Switches to default `permissions: {}` + job `contents: read`, disables persisted checkout credentials.
.github/workflows/e2e-tests.yml	Adds job permissions, disables persisted checkout credentials, pins an action ref, and moves some expressions into env vars.
.github/workflows/ci.yml	Switches default permissions away from `read-all`, disables persisted checkout credentials across jobs, and moves expressions into env vars for the change-detection script.
.github/workflows/build-kwctl.yml	Adds job permissions and disables persisted checkout credentials in relevant jobs.
.github/workflows/build-containers.yml	Disables persisted checkout credentials and refactors tag propagation using env vars.
.github/workflows/attestation.yml	Refactors to use env vars for inputs/context (to reduce expression interpolation) in attestation retrieval/signing logic.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-20T17:36:49Z

+          DIGEST=$(cat $COMPONENT-$ARCH.txt)
          echo "DIGEST=${DIGEST}" >> "$GITHUB_ENV"
      - name: Find attestation digest
        run: |
          set -e
-          DIGEST=$(crane manifest ghcr.io/${{ github.repository_owner }}/${{ inputs.component }}@${{ env.DIGEST }} \
+          DIGEST=$(crane manifest ghcr.io/$REPOSITORY_OWNER/$COMPONENT@$DIGEST \
          | jq -r '.manifests[]
            | select(.annotations["vnd.docker.reference.type"] == "attestation-manifest")
            | .digest')
          if [[ -z "${DIGEST}" ]]; then


This workflow reuses the shell variable name DIGEST for multiple different values (image digest, attestation manifest digest, provenance digest, SBOM digest). It’s easy to accidentally reference the wrong one in future edits. Consider using distinct variable names per step (e.g., IMAGE_DIGEST, ATTESTATION_DIGEST, etc.) and/or quoting variable expansions when building image references to improve readability and reduce foot-guns.

I think this is a good thing to have. But I do not see the need to do that in this PR

This needs a commit with a couple of renames. I remember not understanding this well when we were reviewing the digest attestation change for v1.33.1.

Copilot · 2026-03-20T17:36:50Z

+          GIT_REF_NAME: ${{ github.ref_name }}
        run: |
-          echo TAG_NAME=$(echo ${{ github.ref_name }}) >> $GITHUB_ENV
+          echo TAG_NAME=$(echo "$GIT_REF_NAME") >> $GITHUB_ENV


The Retrieve tag name step uses echo TAG_NAME=$(echo "$GIT_REF_NAME") >> $GITHUB_ENV. The nested echo is redundant, and unquoted writes to $GITHUB_ENV can behave unexpectedly if the value ever contains characters that need escaping. Prefer writing the env var with a single, properly quoted/printf’d line.

Suggested change

echo TAG_NAME=$(echo "$GIT_REF_NAME") >> $GITHUB_ENV

printf 'TAG_NAME=%s\n' "$GIT_REF_NAME" >> "$GITHUB_ENV"

Ok, it's a good to have. But I think we can keep this for a future

viccuad

LGTM, I really like the fixes.

viccuad · 2026-03-24T11:28:05Z

+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        with:
+          advanced-security: false


If we prefer advanced-security instead of in-pr annotations, here's an example on how it looks: https://github.com/kubewarden/sbomscanner/security/code-scanning

viccuad · 2026-03-24T11:42:49Z

@@ -20,7 +20,8 @@ on:
        default: false

 # Declare default permissions as read only.


Quibble: this comment does not match now, it should be "allow read contents such as GHCR packages" (I suppose default permissions are always read-only)

Adds a new CI to run Zizmor linter. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assisted-by: Github Copilot

github-advanced-security · 2026-03-24T16:54:13Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Fix all the warnings reported by Zizmor. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assisted-by: Github copilot

codecov · 2026-03-24T17:09:12Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.50%. Comparing base (075f3fb) to head (1209bff).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1596      +/-   ##
==========================================
- Coverage   80.42%   75.50%   -4.92%     
==========================================
  Files         127      170      +43     
  Lines       16398    20889    +4491     
==========================================
+ Hits        13188    15773    +2585     
- Misses       3210     4904    +1694     
- Partials        0      212     +212

Flag	Coverage Δ
go-tests	`57.53% <ø> (?)`
rust-tests	`80.43% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

jvanz requested a review from a team as a code owner March 20, 2026 16:55

Copilot AI review requested due to automatic review settings March 20, 2026 16:55

github-project-automation Bot added this to Kubewarden Admission Controller Mar 20, 2026

github-project-automation Bot moved this to Pending review in Kubewarden Admission Controller Mar 20, 2026

jvanz force-pushed the issue1534 branch from 8b71532 to df539f5 Compare March 20, 2026 16:56

Copilot started reviewing on behalf of jvanz March 20, 2026 16:56 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

Comment thread .github/workflows/attestation.yml Outdated

Comment thread .github/workflows/attestation.yml Outdated

jvanz force-pushed the issue1534 branch from df539f5 to 144dbfc Compare March 20, 2026 17:28

jvanz requested a review from Copilot March 20, 2026 17:29

Copilot started reviewing on behalf of jvanz March 20, 2026 17:30 View session

jvanz removed this from Kubewarden Admission Controller Mar 20, 2026

Copilot AI reviewed Mar 20, 2026

View reviewed changes

jvanz force-pushed the issue1534 branch 4 times, most recently from 61515d6 to 4fc023f Compare March 20, 2026 18:58

viccuad approved these changes Mar 24, 2026

View reviewed changes

feat(ci): zizmor CI

ba47985

Adds a new CI to run Zizmor linter. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assisted-by: Github Copilot

jvanz force-pushed the issue1534 branch from 0b50731 to 0f6dfc5 Compare March 24, 2026 16:53

jvanz force-pushed the issue1534 branch from 0f6dfc5 to cb39c2c Compare March 24, 2026 16:55

fix(ci): fix zizmor warnings

1209bff

Fix all the warnings reported by Zizmor. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assisted-by: Github copilot

jvanz force-pushed the issue1534 branch from cb39c2c to 1209bff Compare March 24, 2026 17:03

viccuad approved these changes Mar 25, 2026

View reviewed changes

jvanz merged commit 2dda15b into kubewarden:main Mar 25, 2026
28 of 29 checks passed

jvanz deleted the issue1534 branch March 25, 2026 12:29

	echo TAG_NAME=$(echo "$GIT_REF_NAME") >> $GITHUB_ENV
	printf 'TAG_NAME=%s\n' "$GIT_REF_NAME" >> "$GITHUB_ENV"

		@@ -20,7 +20,8 @@ on:
		default: false

		# Declare default permissions as read only.

Conversation

jvanz commented Mar 20, 2026

Description

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

jvanz Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

viccuad Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

jvanz Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

viccuad left a comment

Choose a reason for hiding this comment

Uh oh!

viccuad Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

viccuad Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-advanced-security AI commented Mar 24, 2026

What Enabling Code Scanning Means:

Uh oh!

codecov Bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

viccuad Mar 24, 2026 •

edited

Loading

codecov Bot commented Mar 24, 2026 •

edited

Loading