From 8f21544a028053de38504ff3304bd4bf11666861 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 14:23:05 -0700 Subject: [PATCH 1/2] ci: bare pin comments, zizmor-action v0.6.0, and the findings it surfaces Move the release.yml zizmor ignore to its own line so Dependabot can maintain the bare version comment natively (same restructure as basecamp-sdk#458), and bump zizmor-action v0.5.2 -> v0.6.0 so the audit runs a zizmor that associates standalone ignore comments (v0.5.2 resolves a 1.23-era zizmor that does not). The newer zizmor surfaces real issues, fixed here rather than ignored: - create-github-app-token uses gain permission-contents scoping (write for the skills sync push; read for the seed templates' private-module access), with an annotated ignore for the seed templates' deliberate owner-wide default that ships disabled until seeded repos scope repositories: to their private modules - seed trivy-action was pinned to e368e328, a commit no tag points at; repin to ed142fd0 (v0.36.0), the SHA the rest of the fleet uses - seed compound pin comments get the same standalone-ignore restructure --- .github/workflows/release.yml | 4 +++- .github/workflows/test.yml | 2 +- seed/.github/workflows/release.yml | 18 ++++++++++++------ seed/.github/workflows/security.yml | 8 +++++--- seed/.github/workflows/test.yml | 21 ++++++++++++++------- 5 files changed, 35 insertions(+), 18 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fd52716..b821df2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,7 +31,8 @@ jobs: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: go-version-file: go.mod @@ -230,6 +231,7 @@ jobs: private-key: ${{ secrets.SKILLS_APP_PRIVATE_KEY }} owner: basecamp repositories: skills + permission-contents: write - name: Sync skills if: steps.check.outputs.ready == 'true' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index cbe95f6..086d9dc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -70,7 +70,7 @@ jobs: uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11 - name: Run zizmor - uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 + uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 with: advanced-security: false diff --git a/seed/.github/workflows/release.yml b/seed/.github/workflows/release.yml index 90b2f31..f329615 100644 --- a/seed/.github/workflows/release.yml +++ b/seed/.github/workflows/release.yml @@ -44,11 +44,13 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in pre-release tests; environment protection would block test gate before release approval - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read # repositories: ,homebrew-tap - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: go-version-file: 'go.mod' @@ -66,7 +68,8 @@ jobs: - name: Cache BATS id: cache-bats - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] -- static cache key (bats-1.11.0) is not attacker-controllable + uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + # zizmor: ignore[cache-poisoning] -- static cache key (bats-1.11.0) is not attacker-controllable with: path: /usr/local/libexec/bats-core key: bats-1.11.0 @@ -147,11 +150,13 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read # repositories: ,homebrew-tap - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: go-version-file: 'go.mod' @@ -371,7 +376,8 @@ jobs: with: app-id: ${{ vars.SKILLS_APP_ID }} private-key: ${{ secrets.SKILLS_APP_PRIVATE_KEY }} - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read repositories: skills - name: Sync skills to distribution repo diff --git a/seed/.github/workflows/security.yml b/seed/.github/workflows/security.yml index e5af8f0..0b86e1d 100644 --- a/seed/.github/workflows/security.yml +++ b/seed/.github/workflows/security.yml @@ -49,7 +49,7 @@ jobs: persist-credentials: false - name: Run Trivy vulnerability scanner (filesystem) - uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: scan-type: 'fs' scan-ref: '.' @@ -87,7 +87,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI security scans; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read - name: Set up Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 @@ -147,7 +148,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI security scans; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read - name: Set up Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 diff --git a/seed/.github/workflows/test.yml b/seed/.github/workflows/test.yml index b234cc3..7c5441b 100644 --- a/seed/.github/workflows/test.yml +++ b/seed/.github/workflows/test.yml @@ -31,7 +31,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read # repositories: - name: Set up Go @@ -78,7 +79,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read - name: Set up Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 @@ -113,7 +115,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read - name: Set up Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 @@ -153,7 +156,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read - name: Set up Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 @@ -189,7 +193,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read - name: Set up Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 @@ -239,7 +244,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read - name: Set up Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 @@ -297,7 +303,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in CI; environment protection would block PR-triggered runs - owner: basecamp + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules + permission-contents: read - name: Check for benchmark-relevant changes id: filter From da79000ed144ef9b32873b756e17f0222b3370ee Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 14:27:13 -0700 Subject: [PATCH 2/2] =?UTF-8?q?ci:=20correct=20seed=20token=20scopes=20?= =?UTF-8?q?=E2=80=94=20publishing=20tokens=20need=20contents=20write?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review feedback (Codex): the Homebrew tap token pushes the formula and the skills token pushes skill files; both need permission-contents: write, not read. The skills token is already scoped via repositories: so its owner line needs no github-app ignore. --- seed/.github/workflows/release.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/seed/.github/workflows/release.yml b/seed/.github/workflows/release.yml index f329615..ed95970 100644 --- a/seed/.github/workflows/release.yml +++ b/seed/.github/workflows/release.yml @@ -44,8 +44,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] -- private module token needed in pre-release tests; environment protection would block test gate before release approval - owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules - permission-contents: read + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules and tap + permission-contents: write # repositories: ,homebrew-tap - name: Set up Go @@ -150,8 +150,8 @@ jobs: with: app-id: ${{ vars.RELEASE_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules - permission-contents: read + owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules and tap + permission-contents: write # repositories: ,homebrew-tap - name: Set up Go @@ -376,8 +376,8 @@ jobs: with: app-id: ${{ vars.SKILLS_APP_ID }} private-key: ${{ secrets.SKILLS_APP_PRIVATE_KEY }} - owner: basecamp # zizmor: ignore[github-app] -- template ships disabled (RELEASE_CLIENT_ID unset); seeded repos must scope repositories: to their private modules - permission-contents: read + owner: basecamp + permission-contents: write repositories: skills - name: Sync skills to distribution repo