ci: fix GitHub Actions security issues found by zizmor#9667
Open
vdemeester wants to merge 3 commits intotektoncd:mainfrom
Open
ci: fix GitHub Actions security issues found by zizmor#9667vdemeester wants to merge 3 commits intotektoncd:mainfrom
vdemeester wants to merge 3 commits intotektoncd:mainfrom
Conversation
- Add persist-credentials: false to all actions/checkout steps
- Fix template injection by using env vars instead of ${{ }} in run blocks
- Convert ${{ env.* }} to shell env vars in run blocks
Fixes 32 auto-fixable findings from zizmor v1.23.1 static analysis.
Remaining findings (secrets-outside-env, excessive-permissions,
secrets-inherit, template-injection in github-script) require manual
review and are tracked separately.
Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
tekton-robot
added
the
release-note-none
tekton-robot
added
the
size/M
Member
Author
|
/kind cleanup |
tekton-robot
added
the
kind/cleanup
- Integrate zizmor static analysis as a CI check on PRs and pushes - Upload results to GitHub Advanced Security for stateful triage Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
vdemeester
force-pushed
the
zizmor-fix-gha-security
branch
from
8ea561d to
1bf4a10
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
tekton-robot
added
size/L
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| --repo "${REPO}" \ | ||
| --body "Something went wrong with your \`/${COMMAND}\` command: [please check the logs](${RUN_URL})." | ||
| env: | ||
| GH_TOKEN: ${{ secrets.CHATOPS_TOKEN }} |
Check warning
Code scanning / zizmor
secrets referenced without a dedicated environment Warning
| gh api "repos/${REPO}/issues/comments/${COMMENT_ID}/reactions" \ | ||
| -f content='hooray' | ||
| env: | ||
| GH_TOKEN: ${{ secrets.CHATOPS_TOKEN }} |
Check warning
Code scanning / zizmor
secrets referenced without a dedicated environment Warning
This was referenced Mar 26, 2026
Collaborator
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: afrittoli The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
approved
This was referenced Mar 26, 2026
- Scope checks: write to job level instead of workflow level - Fix template injection in github-script by using process.env - Replace peter-evans/create-or-update-comment with gh CLI Resolves all high/low/info zizmor findings. Only secrets-outside-env (medium, requires GitHub environment setup) remains. Signed-off-by: Vincent Demeester <vdemeest@redhat.com>
vdemeester
force-pushed
the
zizmor-fix-gha-security
branch
from
62eb660 to
6d8ad06
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Fix security findings reported by zizmor v1.23.1,
a static analysis tool for GitHub Actions, and add zizmor as a CI check.
Commit 1: Auto-fix findings
persist-credentials: falseto allactions/checkoutsteps (14 instances) to preventcredential persistence (artipacked)
${{ }}inrun:blocks with shell env vars(template-injection):
${{ github.base_ref }}→${GITHUB_BASE_REF}(HIGH severity)${{ env.* }}→${VAR_NAME}(env vars are already available as shell vars)${{ needs.*.result }}and${{ steps.*.outputs.* }}→ env vars viaenv:blockCommit 2: Add zizmor CI check
zizmor.yamlworkflow that runs on pushes to main and all PRsCommit 3: Fix remaining non-secrets findings
checks: writepermission to job level instead of workflow level inci.yamlande2e-matrix-extras.yaml(excessive-permissions)github-scriptsteps by passing values throughprocess.envinstead of${{ }}expansion (template-injection)peter-evans/create-or-update-commentaction withghCLI (superfluous-actions)Results:
Remaining findings (tracked in follow-up issues):
secrets-outside-envsecrets-inheritSubmitter Checklist
As the author of this PR, please check off the items in this checklist:
/kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tepRelease Notes