Merge pull request #800 from lfit/dependabot/github_actions/lfit/rele… #474
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # SPDX-FileCopyrightText: 2026 The Linux Foundation | |
| # GitHub Actions security audit using zizmor. | |
| # | |
| # This workflow delegates to the lfreleng-actions/zizmor-scan-action | |
| # composite action, which downloads a verified, attested zizmor binary, | |
| # audits this repository's workflows in SARIF mode, and writes a | |
| # findings summary. The action bundles (and pins) the zizmor version it | |
| # installs, so the ref pinned below is the version pin: Dependabot's | |
| # github-actions ecosystem bumps it as new action releases ship. | |
| # | |
| # Mode: SARIF, advisory (zizmor exits 0, so this does not block merges). | |
| # The audit job runs with contents: read; SARIF upload runs in a | |
| # separate job holding security-events: write, gated to default-branch | |
| # pushes (i.e. after merge). Pull request runs stay advisory. | |
| # | |
| # This replaces the previous self-contained implementation that fetched | |
| # its zizmor version pin from lfreleng-actions/.github at run-time; that | |
| # pin is now bundled in the action, so no local pin file or `pip` | |
| # Dependabot entry is required here. | |
| name: 'Zizmor Scan 🌈' | |
| # yamllint disable-line rule:truthy | |
| on: | |
| workflow_dispatch: {} | |
| pull_request: {} | |
| push: {} | |
| # Default to no permissions; each job grants the minimum it needs. | |
| permissions: {} | |
| concurrency: | |
| group: '${{ github.workflow }}-${{ github.ref }}' | |
| cancel-in-progress: true | |
| jobs: | |
| audit: | |
| name: 'Audit Workflows' | |
| # Skip pushes to non-default branches and tags: the SARIF upload is | |
| # gated to default-branch pushes, so those events produce no useful | |
| # output. Pull request and workflow_dispatch events still run. | |
| if: >- | |
| github.event_name != 'push' | |
| || github.ref_name == github.event.repository.default_branch | |
| runs-on: 'ubuntu-latest' | |
| timeout-minutes: 10 | |
| permissions: | |
| # Only the bare minimum for the audit itself: clone the repo | |
| # under audit. SARIF upload runs in a separate, gated job. | |
| contents: read | |
| steps: | |
| # Load the egress allow-list out-of-band and publish it as | |
| # $CONNECTION_ALLOW_LIST for the harden-runner step below to consume | |
| # in 'block' mode. The 'config' input git-fetches the allow-list | |
| # pinned to an immutable commit; the explicit path keeps the source | |
| # independent of the consuming repository's org. | |
| # yamllint disable-line rule:line-length | |
| - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1 | |
| with: | |
| # yamllint disable-line rule:line-length | |
| config: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ca8ce369a97afc64b6895266f10df9b5f5969743' # v0.6.0 | |
| # Harden the runner with the just-loaded allow-list. | |
| - name: 'Harden runner (block)' | |
| # yamllint disable-line rule:line-length | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: 'block' | |
| allowed-endpoints: > | |
| ${{ env.CONNECTION_ALLOW_LIST }} | |
| - name: 'Checkout repository under audit' | |
| # yamllint disable-line rule:line-length | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: 'Run zizmor audit' | |
| # yamllint disable-line rule:line-length | |
| uses: lfreleng-actions/zizmor-scan-action@7c402cb62001f13700324e68e841c772571a26c2 # v0.5.0 | |
| - name: 'Upload SARIF artifact' | |
| # Only needed on default-branch pushes, where the upload job | |
| # consumes it; PR and dispatch runs skip the upload entirely, so | |
| # there is no point producing the artifact for them. | |
| if: >- | |
| github.event_name == 'push' | |
| && github.ref_name == github.event.repository.default_branch | |
| # yamllint disable-line rule:line-length | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: 'zizmor-sarif' | |
| path: '${{ github.workspace }}/zizmor.sarif' | |
| retention-days: 5 | |
| if-no-files-found: 'error' | |
| upload: | |
| name: 'Publish SARIF' | |
| needs: 'audit' | |
| if: >- | |
| github.event_name == 'push' | |
| && github.ref_name == github.event.repository.default_branch | |
| runs-on: 'ubuntu-latest' | |
| timeout-minutes: 5 | |
| permissions: | |
| security-events: write # publish SARIF to code scanning | |
| actions: read # upload-sarif reads run info on private repos | |
| steps: | |
| # Load the egress allow-list out-of-band and publish it as | |
| # $CONNECTION_ALLOW_LIST for the harden-runner step below to consume | |
| # in 'block' mode. The 'config' input git-fetches the allow-list | |
| # pinned to an immutable commit; the explicit path keeps the source | |
| # independent of the consuming repository's org. | |
| # yamllint disable-line rule:line-length | |
| - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1 | |
| with: | |
| # yamllint disable-line rule:line-length | |
| config: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ca8ce369a97afc64b6895266f10df9b5f5969743' # v0.6.0 | |
| # Harden the runner with the just-loaded allow-list. | |
| - name: 'Harden runner (block)' | |
| # yamllint disable-line rule:line-length | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: 'block' | |
| allowed-endpoints: > | |
| ${{ env.CONNECTION_ALLOW_LIST }} | |
| - name: 'Download SARIF artifact' | |
| # yamllint disable-line rule:line-length | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: 'zizmor-sarif' | |
| path: '.' | |
| - name: 'Upload SARIF to code scanning' | |
| # yamllint disable-line rule:line-length | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 | |
| with: | |
| sarif_file: 'zizmor.sarif' | |
| # Category groups these results in code scanning. | |
| category: 'zizmor' | |
| continue-on-error: true |