From fd9c332b649390ad726085ec8e9e7c0e08574c86 Mon Sep 17 00:00:00 2001 From: Stephen Finucane Date: Tue, 19 May 2026 18:05:39 +0100 Subject: [PATCH 1/2] Fix issues highlighted by zizmor Signed-off-by: Stephen Finucane --- .github/workflows/pr.yaml | 3 +++ .github/workflows/release.yaml | 1 + 2 files changed, 4 insertions(+) diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 6bcdf604db..418446a6e9 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -7,12 +7,15 @@ on: jobs: lint: + permissions: + contents: read # for actions/checkout to fetch code runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: fetch-depth: 0 + persist-credentials: false - name: Set up Helm uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 18048fe605..56c579fdb0 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -16,6 +16,7 @@ jobs: uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: fetch-depth: 0 + persist-credentials: false - name: Configure Git run: | From c19c42b8aa2b16067a0d7c6356721aec6c5ace34 Mon Sep 17 00:00:00 2001 From: Stephen Finucane Date: Tue, 19 May 2026 17:55:25 +0100 Subject: [PATCH 2/2] Add zizmor security scanner Run zizmor on pushes to master and pull requests that modify workflow files. Results are uploaded as SARIF to GitHub's security-events API for code scanning integration. Signed-off-by: Stephen Finucane --- .github/workflows/zizmor.yaml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/workflows/zizmor.yaml diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml new file mode 100644 index 0000000000..d07c30355a --- /dev/null +++ b/.github/workflows/zizmor.yaml @@ -0,0 +1,28 @@ +name: zizmor + +on: + push: + branches: + - master + paths: + - '.github/**' + pull_request: + paths: + - '.github/**' + +permissions: {} + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + security-events: write + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3