ci: add zizmor config exempting first-party reusables - #766
Conversation
zizmor's default unpinned-uses policy is blanket hash-pin, which flags every netresearch/* reusable referenced @main — including the scanner jobs added in this PR. First-party reusables track @main by policy so fixes propagate to all consumers, so they are exempted to ref-pin here. Third-party actions remain hash-pin enforced. Byte-identical to the shared template config (netresearch/.github#329). Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
Dependency ReviewThe following issues were found:
License Issues.github/workflows/zizmor.yml
OpenSSF Scorecard
Scanned Files
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #766 +/- ##
==========================================
+ Coverage 87.69% 87.70% +0.01%
==========================================
Files 90 90
Lines 12057 12057
==========================================
+ Hits 10573 10575 +2
+ Misses 1194 1193 -1
+ Partials 290 289 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds a repository-local zizmor configuration to align GitHub Actions auditing with Netresearch’s pinning policy: first-party netresearch/* reusable workflows may track @main (ref-pin), while all other actions remain required to use full commit SHA pins (hash-pin). This supports keeping the template drift check green for this template consumer.
Changes:
- Add
.github/zizmor.ymlto configure zizmor’sunpinned-usesrule policies. - Exempt
netresearch/*from SHA pinning while keeping third-party actions SHA-pinned.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Syncs the standalone zizmor caller workflow that the go templates ship (netresearch/.github#327). The file was missing in this repo, which is what the template drift check reports. Report-only: the reusable runs in SARIF mode and uploads to code scanning; it never fails CI. Minimal permissions (contents: read + security-events: write). Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Syncs netresearch/.github#330. Secret scanning runs on betterleaks, which is OSS and needs no license; the reusable declares GITLEAKS_LICENSE only for backwards compatibility and never reads it. Passing the secret was dead plumbing that widened the exposure surface for no benefit. Keeps this file byte-identical to the template, which the drift check enforces. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Syncs the template changes from netresearch/.github#330.
Secret scanning runs on betterleaks, which is OSS and needs no license.
The shared reusable declares
GITLEAKS_LICENSEonly for backwardscompatibility and never reads it, so forwarding a repo secret into it was
dead plumbing that widened the secret exposure surface for no benefit.
This file is kept byte-identical to the template, so the diff carries two
template edits:
secrets: GITLEAKS_LICENSEmappinggitleaks + dependency review + composer audit and never mentioned the
zizmorscan added in [Upstream #139] Email global vs per job configuration #327The file was byte-identical to the previous template revision beforehand, so
no repo-specific drift was touched. Required to keep
check-template-driftgreen.
Note on naming: the job and the reusable keep the
gitleaksname forbackwards compatibility with existing callers; the scan itself is betterleaks.