Restrict default-branch-pr-guard workflow to minimum required permissions and apply Zizmor fixes - #401
Merged
DougReeder merged 2 commits intoJul 7, 2026
Conversation
…ions What: sets the permissions of the default-branch-pr-guard workflow to none. Why: to increase its security and in preparation to globally restrict permissions for all Hubs Foundation workflows. Note: part of Hubs-Foundation/.github#13
|
Thank you for the pull request. ROADMAP STATUS: This pull request isn't currently on any roadmap. Updates will be conveyed here as its place on/off a roadmap changes. You can view the roadmaps here: Roadmaps Google Drive folder. For more information on how the roadmaps work, see our roadmaps policy on GitHub. |
Exairnous
added
the
Roadmap: Programming
62 tasks
Member
Author
|
Updated the description. |
…uard workflow What: replaces direct use of the GitHub variables in the shell execution with indirect usage via shell variables. Why: According to Zizmor, this prevents code injection via template expansion. Essentially, this should ensure an attacker can't manipulate data in GitHub to achieve remote code execution when the workflow is run.
Exairnous
changed the title
Member
Author
|
Updated PR with fixes from Zizmor that I'd missed. |
DougReeder
approved these changes
Jul 7, 2026
DougReeder
left a comment
DougReeder
left a comment
Member
There was a problem hiding this comment.
LGTM; variables have proper values
Member
Author
|
Updated PR description with the decision on how the development branch should be updated. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Sets the permissions of the default-branch-pr-guard workflow to none and replaces direct use of the GitHub variables in the shell execution with indirect usage via shell variables.
Why?
To increase its security and in preparation to globally restrict permissions for all Hubs Foundation workflows.
Examples
N/A
How to test
In the short term (and if you have the required permissions), you can just check a recent run of the updated workflow from this PR, e.g.: https://github.com/Hubs-Foundation/hubs-cloud/actions/runs/28285184986/job/83807817462
To verify that all the Zizmor issues have been addressed, run the following command from the repository folder and see that Zizmor reports no issues (that we care about) for the default-branch-pr-guard workflow.
Documentation of functionality
This doesn't change the functionality of the workflow, so no documentation update is needed.
Limitations
None
Alternative implementations considered
None
Open questions
What is the best way to apply this to both the master branch and the development branch, since we can't currently merge the development branch into master?
Note: for the roadmap auto commenter it looks like I merged the PR and then merged the master branch into the development branch. Should I just do that again?
UPDATE: It was initially decided at the 2026-07-07 Hubs Dev Meetup that we would rebase the development branch, however that resulted in the loss of the merge commits that were present on the development branch, so it was decided at the 2026-07-14 Hubs Dev Meetup that we would instead merge the master branch into the development branch.
Additional details or related context
Part of Hubs-Foundation/.github#13
This doesn't touch any of the workflows in the services folder since GitHub doesn't pick them up.