From c908581c5d443f2336904cb7f7dc0367e9ed16c4 Mon Sep 17 00:00:00 2001 From: Russell Keith-Magee Date: Thu, 6 Aug 2026 06:47:31 +0800 Subject: [PATCH] Add zizmor.yml and relax pins on beeware/.github actions Adds a zizmor configuration that allows references to beeware/.github actions to remain pinned to a ref (e.g. @main) rather than requiring a full commit hash, since a compromise of that repository would already grant equivalent access to this one. The existing beeware/.github action references are updated to use @main accordingly. --- .github/workflows/check-pr-template.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/zizmor.yml | 9 +++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/check-pr-template.yml b/.github/workflows/check-pr-template.yml index 0382c56..2b58897 100644 --- a/.github/workflows/check-pr-template.yml +++ b/.github/workflows/check-pr-template.yml @@ -11,4 +11,4 @@ jobs: name: Check PR template permissions: contents: read - uses: beeware/.github/.github/workflows/pr-checklist.yml@84508d17a1d29ee3b82ce2e467dcd38c4a0c6a5a # main + uses: beeware/.github/.github/workflows/pr-checklist.yml@main diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b643487..274d50f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,7 +34,7 @@ permissions: jobs: pre-commit: name: Pre-commit checks - uses: beeware/.github/.github/workflows/pre-commit-run.yml@84508d17a1d29ee3b82ce2e467dcd38c4a0c6a5a # main + uses: beeware/.github/.github/workflows/pre-commit-run.yml@main with: pre-commit-source: "--group pre-commit" diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..b834aff --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,9 @@ +rules: + unpinned-uses: + config: + # Allow BeeWare-provided actions to be unpinned. If an attacker is in a + # position to exploit those action, they're probably able to exploit + # repositories directly; and it's significantly easier for our internal + # actions to automatically be the most recent versions. + policies: + beeware/*: ref-pin