harden(zizmor): add GH_TOKEN env to fix impostor-check rate-limits - #11
Merged
Merged
Conversation
Provides authenticated GitHub API access for zizmor's impostor-commit audit. Without this, the audit hits unauthenticated REST rate limits (60/h) and emits 'fast path impostor check failed: request error while accessing GitHub API' warnings, skipping security validation of SHA- pinned action references. zizmor accepts GH_TOKEN, GITHUB_TOKEN, or ZIZMOR_GITHUB_TOKEN env vars per docs.zizmor.sh + zizmorcore/zizmor#764. The default workflow GITHUB_TOKEN has sufficient permissions (read-only API queries) so no additional secrets are needed. Impact: zizmor impostor-commit + ref-confusion audits will now have authenticated rate limits (1000/h), enabling reliable SHA-pin validation. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}to theRun zizmorstep so zizmor's impostor-commit and ref-confusion audits get authenticated GitHub REST API access (1000 req/h vs. 60 req/h unauthenticated).Problem
zizmor runs were emitting:
This silently skips the SHA-pin validation we use zizmor for. With ~6 actions per workflow x 3 workflows + pagination, the impostor-commit audit easily exceeds the 60 req/h unauthenticated rate limit.
Solution
Per zizmor docs + zizmorcore/zizmor#764, the
GH_TOKEN/GITHUB_TOKEN/ZIZMOR_GITHUB_TOKENenv vars are accepted byzizmorcore/zizmor-action. The default workflowGITHUB_TOKENis sufficient (read-only API access).Test plan
Cross-repo
This pattern will be rolled out to Q-Forge, scanner-pwa, Lumos, USK (all 4 also have zizmor.yml). dePlani + aza-backend + MRT do not currently have zizmor.yml (separate hardening pass).
🤖 Generated with Claude Code