From dd45f8c4388080c3f8f9b9de7b07d52cf07e7441 Mon Sep 17 00:00:00 2001 From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com> Date: Sat, 1 Aug 2026 22:06:45 -0700 Subject: [PATCH] ci: add shared zizmor security scanning workflow --- .github/workflows/elixir.yml | 10 ++++++++++ .github/workflows/erlang.yml | 10 +++++++++- .github/workflows/fossa.yml | 2 ++ .github/workflows/w3c_interop.yml | 5 ++++- .github/workflows/zizmor.yml | 18 ++++++++++++++++++ 5 files changed, 43 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/elixir.yml b/.github/workflows/elixir.yml index 89cfdf6a..718f7d02 100644 --- a/.github/workflows/elixir.yml +++ b/.github/workflows/elixir.yml @@ -18,6 +18,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: "27.2.4" @@ -51,6 +53,8 @@ jobs: ELIXIR_VERSION: ${{ matrix.elixir_version }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: ${{ matrix.otp_version }} @@ -82,6 +86,8 @@ jobs: working-directory: apps/opentelemetry_api/ steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: ${{ matrix.otp_version }} @@ -125,6 +131,8 @@ jobs: working-directory: apps/opentelemetry_api/ steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: ${{ matrix.otp_version }} @@ -165,6 +173,8 @@ jobs: ELIXIR_VERSION: ${{ matrix.elixir_version }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: ${{ matrix.otp_version }} diff --git a/.github/workflows/erlang.yml b/.github/workflows/erlang.yml index 1f7d7a03..210098fa 100644 --- a/.github/workflows/erlang.yml +++ b/.github/workflows/erlang.yml @@ -29,6 +29,8 @@ jobs: OTP_VERSION: ${{ matrix.otp_version }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Run Collector run: docker compose up -d - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 @@ -41,7 +43,7 @@ jobs: with: path: | _build - key: ${{ runner.os }}-build-${{ matrix.otp_version }}-${{ hashFiles(format('rebar.lock')) }}-5 + key: ${{ runner.os }}-build-${{ matrix.otp_version }}-${{ hashFiles('rebar.lock') }}-5 restore-keys: | ${{ runner.os }}-build-${{ matrix.otp_version }}-5- - name: Compile @@ -96,6 +98,8 @@ jobs: os: [ubuntu-24.04] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: ${{ matrix.otp_version }} @@ -124,6 +128,8 @@ jobs: os: [ubuntu-24.04] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: ${{ matrix.otp_version }} @@ -162,6 +168,8 @@ jobs: OTP_VERSION: ${{ matrix.otp_version }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: ${{ matrix.otp_version }} diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index eed276b9..4861c7c0 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -13,6 +13,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: diff --git a/.github/workflows/w3c_interop.yml b/.github/workflows/w3c_interop.yml index b062bcba..063bd363 100644 --- a/.github/workflows/w3c_interop.yml +++ b/.github/workflows/w3c_interop.yml @@ -17,6 +17,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: '26.1.2' @@ -27,7 +29,7 @@ jobs: with: path: | _build - key: ${{ runner.os }}-build-${{ matrix.otp_version }}-${{ hashFiles(format('rebar.lock')) }}-1 + key: ${{ runner.os }}-build-${{ matrix.otp_version }}-${{ hashFiles('rebar.lock') }}-1 restore-keys: | ${{ runner.os }}-build-${{ matrix.otp_version }}-1- @@ -36,6 +38,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: 'w3c/trace-context' path: 'trace-context' - name: Setup python diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..c332480b --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,18 @@ +name: Zizmor + +on: + push: + branches: [main] + pull_request: + schedule: + - cron: '39 2 * * 4' # weekly at 02:39 UTC on Thursday + workflow_dispatch: + +permissions: {} + +jobs: + zizmor: + permissions: + contents: read # for actions/checkout + security-events: write # for zizmor to upload SARIF results + uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0