Merge pull request #27 from MiraGeoscience/DEVOPS-799

DEVOPS-799: add workflow for zizmor and apply recommendations

Author: sebhmg

.github/workflows/issue_to_jira.yml

@@ -1,13 +1,20 @@
 name: Create JIRA issue
+permissions:
+  contents: read
+  issues: write
 
 on:
   issues:
     types: [opened]
 
 jobs:
   call-workflow-create-jira-issue:
+    if: startsWith(github.repository, 'MiraGeoscience/')  # run on the Mira repo only
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
-    secrets: inherit
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
     with:
       project-key: 'GEOPY'
       components: '[{"name": "grid-apps"}]'

.github/workflows/pr_add_jira_summary.yml

@@ -1,10 +1,20 @@
 name: Add JIRA issue summary
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
+permissions:
+  contents: read
+  pull-requests: write
 
 jobs:
   call-workflow-add-jira-issue-summary:
+    if: startsWith(github.event.pull_request.head.repo.full_name, 'MiraGeoscience/')  # run if PR originates from the Mira repo only
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
-    secrets: inherit
+    permissions:
+      contents: read
+      pull-requests: write
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}

.github/workflows/python_analysis.yml

@@ -1,5 +1,7 @@
 name: Python analysis
-
+permissions:
+  contents: read
+  pull-requests: read
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
@@ -25,18 +27,27 @@ jobs:
   call-workflow-static-analysis:
     name: Static analysis
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@main
+    permissions:
+      contents: read
+      pull-requests: read
     with:
       package-manager: 'conda'
       app-name: 'grid_apps'
       python-version: '3.10'
   call-workflow-pre-commmit:
     name: Pre-Commit
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-pre_commit.yml@main
+    permissions:
+      contents: read
+      pull-requests: read
     with:
       app-name: 'grid_apps'
   call-workflow-pytest:
     name: Pytest
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@main
+    permissions:
+      contents: read
+      pull-requests: read
     with:
       package-manager: 'conda'
       python-versions: '["3.10", "3.11", "3.12"]'

.github/workflows/python_deploy_dev.yml

@@ -1,5 +1,8 @@
 name: Deploy python package in development
 
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -13,6 +16,9 @@ jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
+    permissions:
+      contents: read
+      id-token: write
     with:
       package-name: 'grid-apps'
       python-version: '3.10'
@@ -25,6 +31,8 @@ jobs:
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory)
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
+    permissions:
+      contents: read
     with:
       package-manager: 'poetry'
       package-name: 'grid-apps'

.github/workflows/python_deploy_prod.yml

@@ -1,5 +1,8 @@
 name: Deploy python package in production
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]
@@ -28,6 +31,9 @@ jobs:
     name: Publish production Conda package on JFrog Artifactory
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@main
+    permissions:
+      contents: read
+      id-token: write
     with:
       virtual-repo-names: '["geology-noremote-conda-prod", "geophysics-noremote-conda-prod"]'
       release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
@@ -38,6 +44,9 @@ jobs:
     name: Publish production PyPI package (JFrog Artifactory)
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@main
+    permissions:
+      contents: read
+      id-token: write
     with:
       package-name: 'grid-apps'
       virtual-repo-names: '["geology-pypi-prod", "geophysics-pypi-prod"]'

.github/workflows/zizmor-security.yml

@@ -0,0 +1,26 @@
+name: Zizmor analysis
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+  push:
+    branches:
+      - main
+      - develop
+      - feature/**
+      - hotfix/**
+      - release/**
+
+jobs:
+  call-workflow-zizmor:
+    name: Zizmor analysis
+    permissions:
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-security.yml@main