fix(sec-160): pass org-wide app token to zizmor for action ref resolution (#4)

Author: aris1009

.github/workflows/zizmor.yml

@@ -18,13 +18,53 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Checkout
+      - name: Checkout target repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
+      # Intentionally fails loudly when the org-level variable/secret is
+      # missing (e.g. fork PRs, where GitHub withholds secrets from workflows
+      # triggered from forks). A red check on the required workflow is the
+      # desired signal: it forces a human to either mark the PR trusted or
+      # investigate why the scanner credentials are unavailable. Do NOT add
+      # an `if:` guard here to silently skip — loud failure is the contract.
+      - name: Mint scanner token (org-wide read access for action ref resolution)
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ vars.ZIZMOR_SCANNER_APP_ID }}
+          private-key: ${{ secrets.ZIZMOR_SCANNER_PRIVATE_KEY }}
+          owner: rudderlabs
+          permission-contents: read
+          permission-metadata: read
+
+      # Inject the shared zizmor config from this repo into the target repo's
+      # run context. Required because zizmor only auto-discovers config from
+      # the checked-out working tree, and injected runs check out the target
+      # repo's tree, not shared-workflows. Without this step, any config-level
+      # rule overrides we ship here (e.g. the `secrets-outside-env` ignore for
+      # the zizmor workflow itself) would never apply to injected runs.
+      - name: Checkout shared zizmor config
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: rudderlabs/shared-workflows
+          # For self-scans (PRs against shared-workflows itself), test the
+          # PR's proposed config — otherwise a PR that breaks .github/zizmor.yml
+          # would be validated against main's config and merge green. For
+          # injected runs in other repos, pin to main for stability.
+          ref: ${{ github.repository == 'rudderlabs/shared-workflows' && github.event.pull_request.head.sha || 'main' }}
+          token: ${{ steps.app-token.outputs.token }}
+          path: .zizmor-shared
+          persist-credentials: false
+          sparse-checkout: |
+            .github/zizmor.yml
+          sparse-checkout-cone-mode: false
+
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
         with:
           advanced-security: true
           min-severity: medium
+          config: .zizmor-shared/.github/zizmor.yml
+          token: ${{ steps.app-token.outputs.token }}

.github/zizmor.yml

@@ -0,0 +1,30 @@
+# zizmor configuration for shared-workflows
+# https://docs.zizmor.sh/configuration/
+
+rules:
+  # Suppress secrets-outside-env for the zizmor workflow itself.
+  #
+  # The audit is a real Severity::Medium, Confidence::High finding in zizmor
+  # v1.23.1 — it correctly notes that this job references a secret without a
+  # named GitHub Environment guarding execution. The standard mitigation is to
+  # bind the job to an `environment:` with required reviewers, but this
+  # workflow is injected by the org required-workflow ruleset into every
+  # rudderlabs repo and runs in the *target* repo's context. An
+  # `environment:` directive here would only resolve in repos that happen to
+  # define a matching environment, which none of them do, so the standard fix
+  # cannot apply.
+  #
+  # The residual risk is bounded by the App registration, not by this file:
+  # the secret is the private key of the dedicated `ZIZMOR_SCANNER` GitHub
+  # App, which is registered with `Repository: Contents: Read, Metadata: Read`
+  # only — no write access to anything, anywhere. Worst-case exfiltration is
+  # ~1 hour of read-only access to public + internal repository source code,
+  # which is the same access surface every employee already has via their
+  # personal GitHub account. The blast radius does not justify gating PRs on
+  # this finding.
+  secrets-outside-env:
+    ignore:
+      # NOTE: zizmor matches `ignore` rules on the file's basename, not its
+      # full path (see WorkflowRule matching in zizmor v1.23.1
+      # crates/zizmor/src/config/mod.rs:639). Bare basename is required.
+      - zizmor.yml