Add zizmor security analysis + harden workflows#179
Closed
Seldaek wants to merge 3 commits into
Closed
Conversation
- Pin actions to commit SHAs at latest releases (checkout, setup-php, upload-artifact)
- Add explicit contents: read permissions and concurrency limits
- persist-credentials: false on checkouts
- tests.yml: reference workflow env vars via cmd %VAR% syntax instead of ${{ }} to avoid template injection
- builds.yml: switch the iscc/installer/composer steps from shell: cmd to pwsh (the .exe gets a .\ prefix) so zizmor can analyze them
Compiling with iscc under pwsh fails (Inno Setup 'Invalid number of parameters' in userdata.iss), so the iscc / installer .exe / composer steps go back to shell: cmd. This leaves 3 advisory zizmor 'misfeature' findings (cmd limits its analysis) that can't be resolved without breaking the Windows build.
Member
Author
|
Reverted the |
Member
Author
|
Hmm that revert did not help fix the build.. so I'm not sure if it was already broken or not, will let you take a look first @johnstevenson as I am not very familiar here. Anyway would need to get this merged to get CI running again as I enabled some Actions restrictions at the org level. |
Member
|
I'll take a closer look. |
Member
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
zizmorGitHub Actions security-analysis workflow (pedantic, matchingcomposer/packagist) and adependabot.yml(github-actions, monthly + 7-day cooldown), and hardens the existing workflows so zizmor passes:actions/checkout,shivammathur/setup-php,actions/upload-artifact).contents: read; added concurrency limits andpersist-credentials: falseon checkouts.envvars via cmd%VAR%syntax instead of${{ env.* }}in run blocks (avoids template injection; still cmd shell).iscc/ installer.exe/composer --versionsteps fromshell: cmdtoshell: pwsh(the.exenow uses a.\prefix) so zizmor can analyze them.Verified locally with zizmor (pedantic, incl. online audits): no findings. The Windows build steps that changed shells are worth a close look in review since they couldn't be tested locally.