Skip to content

Commit 6af32ef

Browse files
olblakolblak
authored
feat: add zizmor blogpost (#2755)
* feat: add zizmor blogpost Signed-off-by: Olblak <me@olblak.com> * fix(blogpost): add empty space around list Signed-off-by: Olblak <me@olblak.com> * chore: minor improvement Signed-off-by: Olblak <me@olblak.com> * chore: highlight links Signed-off-by: Olblak <me@olblak.com> * fix: add missing values file Signed-off-by: Olblak <me@olblak.com> * fix: facepalm Signed-off-by: Olblak <me@olblak.com> * chore: show picture Signed-off-by: Olblak <me@olblak.com> * fix: remove empty space Signed-off-by: Olblak <me@olblak.com> --------- Signed-off-by: Olblak <me@olblak.com>
1 parent 48ce350 commit 6af32ef

File tree

3 files changed

+94
-0
lines changed

3 files changed

+94
-0
lines changed

‎content/en/blog/2026/zizmor.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
title: "Securing GitHub Actions Workflows with Zizmor, Scaling Using Updatecli"
3+
date: 2026-03-13T00:00:00+00:00
4+
draft: false
5+
weight: 50
6+
images: [""]
7+
contributors: ["olblak"]
8+
---
9+
10+
Recent [**incidents**](https://awesomeagents.ai/news/hackerbot-claw-trivy-github-actions-compromise/) have shown that weak GitHub Actions workflows can lead to repository compromise.
11+
A great tool to prevent this is [**Zizmor**](https://github.com/zizmorcore/zizmor), a static analysis tool for GitHub Actions.
12+
13+
As the Zizmor project states:
14+
15+
---
16+
Zizmor can find many common security issues in typical GitHub Actions CI/CD setups, including:
17+
18+
- Template injection vulnerabilities, leading to attacker-controlled code execution
19+
- Accidental credential persistence and leakage
20+
- Excessive permission scopes and credential grants to runners
21+
- Impostor commits and confusable `git` references
22+
- ...[**and much more**](https://docs.zizmor.sh/audits/)!
23+
24+
---
25+
26+
After testing it for a few days, I found it very easy to adopt: add a workflow, run it, and quickly get actionable findings.
27+
Like most security tools, it can produce some noise (findings with low exploitability), but the overall value is excellent.
28+
29+
The next challenge is scale: enabling Zizmor across all repositories in a GitHub organization.
30+
31+
To solve that, I created an [**Updatecli policy**](https://www.updatecli.io/docs/core/shareandreuse/) that detects repositories without a Zizmor workflow and automatically opens a pull request.
32+
33+
In short, an Updatecli policy is a collection of manifests distributed via an OCI registry (for example, `ghcr.io`).
34+
When Updatecli runs a policy, it downloads those manifests to a temporary local directory and applies them.
35+
36+
To test it, create a `values.yaml` file with parameters targeting your GitHub organization:
37+
38+
```yaml
39+
scm:
40+
enabled: true
41+
kind: githubsearch
42+
# search accepts an advanced GitHub search query
43+
# Use https://github.com/search/advanced to craft one
44+
search: |
45+
org:updatecli
46+
fork:true
47+
is:public
48+
archived:false
49+
# branch accepts a regex to filter detected branches
50+
branch: "^main$"
51+
email: <email used to create commits>
52+
# 0 means no limit
53+
limit: 1
54+
```
55+
56+
```bash
57+
export UPDATECLI_GITHUB_TOKEN=xxxx
58+
export UPDATECLI_GITHUB_USERNAME=yyy
59+
60+
# Show a diff of the policy
61+
updatecli pipeline diff --values values.yaml ghcr.io/updatecli/policies/zizmor/githubaction/scaffold:0.5.3
62+
63+
# Apply the policy
64+
updatecli pipeline apply --values values.yaml ghcr.io/updatecli/policies/zizmor/githubaction/scaffold:0.5.3
65+
66+
# Show the policy
67+
updatecli manifest show --values values.yaml ghcr.io/updatecli/policies/zizmor/githubaction/scaffold:0.5.3
68+
```
69+
70+
Updatecli then opens pull requests, such as this one:
71+
[**kubewarden/sbomscanner#927**](https://github.com/kubewarden/sbomscanner/pull/927)
72+
73+
The source code for this policy is available at:
74+
[**updatecli/policies**](https://github.com/updatecli/policies/tree/main/updatecli/policies/zizmor/githubaction/scaffold)
75+
76+
This approach is flexible enough for different repository types and can be run in CI to ensure every new repository gets a PR enabling Zizmor.
77+
That is what we do [**here**](https://github.com/updatecli/.github/blob/main/updatecli-compose.yaml).
78+
79+
Now it is time to review all my GitHub repositories.
80+
81+
<p align="center">
82+
<img style="max-height:600px;" src="/images/blog/2026/03/diagram.png" alt="show Updatecli automate update"/>
83+
</p>
84+
85+
## Links
86+
87+
- [**Hackerbot Claw trivy github actions compromise**](https://awesomeagents.ai/news/hackerbot-claw-trivy-github-actions-compromise/)
88+
- [**Zizmor**](https://github.com/zizmorcore/zizmor)
89+
- [**kubewarden/sbomscanner pull request**](https://github.com/kubewarden/sbomscanner/pull/927)
90+
- [**updatecli/policies** source](https://github.com/updatecli/policies/tree/main/updatecli/policies/zizmor/githubaction/scaffold)
91+
- [**Zizmor audits** documentation](https://docs.zizmor.sh/audits/)
92+
- [**Updatecli policy** documentation](https://www.updatecli.io/docs/core/shareandreuse/)

‎static/images/blog/2026/03/diagram.png‎

1.02 MB
Loading

‎updatecli-compose.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ policies:
22
- name: Local Updatecli Website Policies
33
config:
44
- updatecli/updatecli.d/
5+
values:
6+
- updatecli/values.d/scm.yaml
57
- name: Handle Nodejs version in githubaction
68
policy: ghcr.io/updatecli/policies/nodejs/githubaction:0.10.0@sha256:66b180d6fc9bd157472b9adb564c4bfc5a9ce19d72faaa9ddd3e90b70f328d0e
79
values:

0 commit comments

Comments
 (0)