From 7e491dd797862a085edc6e63f2918d21a121b7ef Mon Sep 17 00:00:00 2001 From: b-long Date: Sat, 31 Oct 2026 21:44:31 -0400 Subject: [PATCH] fix: add zizmor & harden GitHub Actions workflows --- .github/dependabot.yml | 8 +++++ .github/workflows/build-python.yaml | 9 ++++-- .github/workflows/lint-pr-title.yaml | 7 +++-- .../workflows/platform-integration-test.yaml | 14 ++++++--- .github/workflows/release-please.yaml | 26 ++++++++++------ .github/workflows/test-suite.yaml | 31 +++++++++++++------ .github/workflows/zizmor.yaml | 27 ++++++++++++++++ .pre-commit-config.yaml | 4 +++ 8 files changed, 98 insertions(+), 28 deletions(-) create mode 100644 .github/workflows/zizmor.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index aa483de..d7df525 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,8 @@ updates: interval: "weekly" labels: - "dependencies" + cooldown: + default-days: 7 - package-ecosystem: "pip" directory: "/packages/otdf-python" @@ -13,6 +15,8 @@ updates: interval: "weekly" labels: - "dependencies" + cooldown: + default-days: 7 - package-ecosystem: "pip" directory: "/packages/otdf-python-proto" @@ -20,6 +24,8 @@ updates: interval: "weekly" labels: - "dependencies" + cooldown: + default-days: 7 - package-ecosystem: "github-actions" directory: "/" @@ -27,3 +33,5 @@ updates: interval: "weekly" labels: - "dependencies" + cooldown: + default-days: 7 diff --git a/.github/workflows/build-python.yaml b/.github/workflows/build-python.yaml index 284152d..77f7ecb 100644 --- a/.github/workflows/build-python.yaml +++ b/.github/workflows/build-python.yaml @@ -3,6 +3,9 @@ name: "Build Python Wheel" on: pull_request: +permissions: + contents: read + jobs: build: runs-on: ubuntu-22.04 @@ -10,10 +13,12 @@ jobs: wheel: ${{ steps.find_wheel.outputs.wheel_path }} steps: - name: Checkout this repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true cache-dependency-glob: "uv.lock" diff --git a/.github/workflows/lint-pr-title.yaml b/.github/workflows/lint-pr-title.yaml index a4801ac..52db47c 100644 --- a/.github/workflows/lint-pr-title.yaml +++ b/.github/workflows/lint-pr-title.yaml @@ -1,7 +1,10 @@ name: Lint PR Title on: - pull_request_target: + # pull_request_target is required so that PRs from forks can be linted. + # This is safe here: the workflow never checks out or runs PR code, and + # the token is limited to `pull-requests: read`. + pull_request_target: # zizmor: ignore[dangerous-triggers] types: - opened - edited @@ -15,7 +18,7 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: amannn/action-semantic-pull-request@v6 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/platform-integration-test.yaml b/.github/workflows/platform-integration-test.yaml index fc892ff..b3b6f82 100644 --- a/.github/workflows/platform-integration-test.yaml +++ b/.github/workflows/platform-integration-test.yaml @@ -26,7 +26,9 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Checkout this repo - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Update /etc/hosts shell: bash @@ -48,7 +50,7 @@ jobs: up -d - name: Set up go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: "1.24.x" check-latest: false @@ -102,14 +104,14 @@ jobs: shell: bash - name: Set up uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true cache-dependency-glob: "uv.lock" python-version: ${{ inputs.python_version }} - name: Download built wheel - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: python-wheel path: dist @@ -123,7 +125,9 @@ jobs: # tests below exercise the actual built artifact rather than an # editable install of the checkout. uv sync --no-install-workspace - uv pip install "${{ inputs.wheel }}" + uv pip install "${INPUTS_WHEEL}" + env: + INPUTS_WHEEL: ${{ inputs.wheel }} - name: Run all tests, minus integration tests env: diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index bde05f9..1c8c6b5 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -6,16 +6,19 @@ on: - main workflow_dispatch: -permissions: - contents: write - pull-requests: write +permissions: {} jobs: # Run full test suite before any release operations test-suite: - uses: ./.github/workflows/test-suite.yaml + permissions: + contents: read + uses: $/.github/workflows/test-suite.yaml release-please: + permissions: + contents: write + pull-requests: write runs-on: ubuntu-latest needs: test-suite if: needs.test-suite.outputs.tests_passed == 'true' @@ -23,10 +26,12 @@ jobs: releases_created: ${{ steps.release-main.outputs.releases_created }} paths_released: ${{ steps.release-main.outputs.paths_released }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # Release-please for main branch (creates stable releases) - - uses: googleapis/release-please-action@v5 + - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 id: release-main with: config-file: .release-please-config.json @@ -44,12 +49,15 @@ jobs: if: ${{ needs.release-please.outputs.releases_created == 'true' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: version: "latest" + enable-cache: false - name: Build package shell: bash @@ -68,7 +76,7 @@ jobs: # https://pypi.org/manage/project/otdf-python/settings/publishing/ - name: Publish package distributions to PyPI if: github.ref == 'refs/heads/main' - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: # repository-url: https://pypi.org/legacy/ packages-dir: dist/ diff --git a/.github/workflows/test-suite.yaml b/.github/workflows/test-suite.yaml index c2db84e..ccc333b 100644 --- a/.github/workflows/test-suite.yaml +++ b/.github/workflows/test-suite.yaml @@ -12,15 +12,20 @@ on: value: ${{ jobs.report.outputs.success }} workflow_dispatch: +permissions: + contents: read + jobs: # Step 1: Fast lint and format checks (fail fast on code style) lint-check: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true cache-dependency-glob: "uv.lock" @@ -36,10 +41,12 @@ jobs: runs-on: ubuntu-22.04 needs: lint-check steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true cache-dependency-glob: "uv.lock" @@ -57,10 +64,12 @@ jobs: wheel: ${{ steps.find_wheel.outputs.wheel_path }} steps: - name: Checkout this repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true cache-dependency-glob: "uv.lock" @@ -83,7 +92,7 @@ jobs: shell: bash - name: Upload wheel as artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: python-wheel path: dist/*.whl @@ -93,10 +102,12 @@ jobs: runs-on: ubuntu-22.04 needs: build steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 with: enable-cache: true cache-dependency-glob: "uv.lock" @@ -113,7 +124,7 @@ jobs: matrix: python3_version: ["3.10", "3.11", "3.12", "3.13", "3.14"] needs: [build, unit-tests] - uses: ./.github/workflows/platform-integration-test.yaml + uses: $/.github/workflows/platform-integration-test.yaml with: wheel: ${{ needs.build.outputs.wheel }} python_version: ${{ matrix.python3_version }} diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml new file mode 100644 index 0000000..75d8031 --- /dev/null +++ b/.github/workflows/zizmor.yaml @@ -0,0 +1,27 @@ +# Static analysis of GitHub Actions workflows with zizmor. +# See https://docs.zizmor.sh/ +name: zizmor + +on: + push: + branches: + - main + pull_request: + +permissions: {} + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + contents: read + # Required to upload SARIF results to GitHub code scanning + security-events: write + steps: + - name: Checkout this repo + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0b5f2a5..86d7cfc 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -45,3 +45,7 @@ repos: - id: conventional-pre-commit stages: [commit-msg] args: [--verbose, feat, fix, docs, style, refactor, perf, revert, build, test, chore, ci] + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: v1.31.1 + hooks: + - id: zizmor