Track organization-wide zizmor rollout

[trask]

Related to #275

Track the organization-wide rollout of zizmor scanning through the OpenTelemetry shared workflow, along with enforcement through the repository rulesets managed in open-telemetry/admin.

Status

38 of 80 enforced (48%) | inventory refreshed 2026-08-14

State	Count	Meaning
Blocked or remediation	2	Needs a fix, decision, or refreshed candidate
Adoption in review	8	Caller PR is open and awaiting review or merge
Adoption merged, enforcement pending	0	Caller merged; post-merge verification or admin enforcement remains
Not started	32	Eligible inventory repository with no rollout PR yet
Enforced	38	Scanning and branch-rule enforcement are active

Rollout checklist

Rows are grouped by next action and sorted by repository. A row is checked only after scanning and enforcement are active.

Blocked or remediation

• open-telemetry/opamp-go: ci: add shared security scanning workflow opamp-go#613, open-telemetry/admin#785
• open-telemetry/opentelemetry-java: ci: remediate zizmor findings opentelemetry-java#8592, open-telemetry/admin#745

Adoption in review

• open-telemetry/build-tools: ci: add shared security scanning workflow build-tools#502, open-telemetry/admin#815
• open-telemetry/cpp-build-tools: ci: add shared security scanning workflow cpp-build-tools#21, open-telemetry/admin#817
• open-telemetry/opentelemetry-erlang: chore: add shared security scanning workflow opentelemetry-erlang#1028, open-telemetry/admin#795
• open-telemetry/opentelemetry-php-distro: ci: add shared security scanning workflow opentelemetry-php-distro#145, open-telemetry/admin#789
• open-telemetry/opentelemetry-php-instrumentation: ci: add shared security scanning workflow opentelemetry-php-instrumentation#319, open-telemetry/admin#794
• open-telemetry/opentelemetry-rust: ci: add shared security scanning workflow opentelemetry-rust#3617, open-telemetry/admin#792
• open-telemetry/opentelemetry-rust-contrib: ci: add shared security scanning workflow opentelemetry-rust-contrib#735, open-telemetry/admin#791
• open-telemetry/sig-end-user: ci: add shared security scanning workflow sig-end-user#383, open-telemetry/admin#809

Adoption merged, enforcement pending

None.

Not started

• open-telemetry/.project: (no rollout PR yet)
• open-telemetry/community: (no rollout PR yet)
• open-telemetry/opamp-spec: (no rollout PR yet)
• open-telemetry/opentelemetry-collector: (no rollout PR yet)
• open-telemetry/opentelemetry-collector-contrib: (no rollout PR yet)
• open-telemetry/opentelemetry-collector-releases: (no rollout PR yet)
• open-telemetry/opentelemetry-configuration: (no rollout PR yet)
• open-telemetry/opentelemetry-cpp: (no rollout PR yet)
• open-telemetry/opentelemetry-cpp-contrib: (no rollout PR yet)
• open-telemetry/opentelemetry-demo: (no rollout PR yet)
• open-telemetry/opentelemetry-ebpf-instrumentation: (no rollout PR yet)
• open-telemetry/opentelemetry-ebpf-profiler: (no rollout PR yet)
• open-telemetry/opentelemetry-go-compile-instrumentation: (no rollout PR yet)
• open-telemetry/opentelemetry-helm-charts: (no rollout PR yet)
• open-telemetry/opentelemetry-injector: (no rollout PR yet)
• open-telemetry/opentelemetry-lambda: (no rollout PR yet)
• open-telemetry/opentelemetry-network: (no rollout PR yet)
• open-telemetry/opentelemetry-operator: (no rollout PR yet)
• open-telemetry/opentelemetry-proto: (no rollout PR yet)
• open-telemetry/opentelemetry-python: (no rollout PR yet)
• open-telemetry/opentelemetry-python-contrib: (no rollout PR yet)
• open-telemetry/opentelemetry-python-genai: (no rollout PR yet)
• open-telemetry/opentelemetry-specification: (no rollout PR yet)
• open-telemetry/opentelemetry-swift: (no rollout PR yet)
• open-telemetry/opentelemetry-swift-core: (no rollout PR yet)
• open-telemetry/opentelemetry-weaver-examples: (no rollout PR yet)
• open-telemetry/opentelemetry-website-infra: (no rollout PR yet)
• open-telemetry/opentelemetry-zig: (no rollout PR yet)
• open-telemetry/opentelemetry.io: (no rollout PR yet)
• open-telemetry/otel-arrow: (no rollout PR yet)
• open-telemetry/semantic-conventions-conformance: (no rollout PR yet)
• open-telemetry/weaver: (no rollout PR yet)

Enforced

• open-telemetry/.github: ci: add shared security scanning workflow .github#89, open-telemetry/admin#816
• open-telemetry/opentelemetry-android: ci: add shared security scanning workflow opentelemetry-android#1900, follow-up ci: document safe CodeQL cache usage opentelemetry-android#1967, open-telemetry/admin#759
• open-telemetry/opentelemetry-benchmarks: ci: move security scanning to shared workflow opentelemetry-benchmarks#17, (admin enforcement already enabled)
• open-telemetry/opentelemetry-browser: ci: move security scanning to shared workflow opentelemetry-browser#379, open-telemetry/admin#804
• open-telemetry/opentelemetry-dotnet: [Infra] move security scanning to shared workflow opentelemetry-dotnet#7574, (admin enforcement already enabled)
• open-telemetry/opentelemetry-dotnet-contrib: [Infra] Move security scanning to shared workflow opentelemetry-dotnet-contrib#4923, (admin enforcement already enabled)
• open-telemetry/opentelemetry-dotnet-instrumentation: ci: move security scanning to shared workflow opentelemetry-dotnet-instrumentation#5317, (admin enforcement already enabled)
• open-telemetry/opentelemetry-ecosystem-explorer: ci: move security scanning to shared workflow opentelemetry-ecosystem-explorer#922, open-telemetry/admin#778
• open-telemetry/opentelemetry-erlang-contrib: ci: add shared security scanning workflow opentelemetry-erlang-contrib#763, open-telemetry/admin#790
• open-telemetry/opentelemetry-for-beginners: ci: add shared security scanning workflow opentelemetry-for-beginners#15, open-telemetry/admin#818
• open-telemetry/opentelemetry-go: ci: add shared security scanning workflow opentelemetry-go#8684, open-telemetry/admin#781
• open-telemetry/opentelemetry-go-build-tools: ci: add shared security scanning workflow opentelemetry-go-build-tools#2071, follow-up [chore] pin securego/gosec to v2.28.0 instead of master opentelemetry-go-build-tools#2086, open-telemetry/admin#784
• open-telemetry/opentelemetry-go-contrib: ci: add shared security scanning workflow opentelemetry-go-contrib#9397, open-telemetry/admin#782
• open-telemetry/opentelemetry-go-instrumentation: ci: add shared security scanning workflow opentelemetry-go-instrumentation#3726, open-telemetry/admin#783
• open-telemetry/opentelemetry-go-vanityurls: ci: add shared security scanning workflow opentelemetry-go-vanityurls#177, open-telemetry/admin#779
• open-telemetry/opentelemetry-java-contrib: ci: remediate zizmor findings opentelemetry-java-contrib#3009, (admin enforcement already enabled)
• open-telemetry/opentelemetry-java-examples: ci: remediate zizmor findings opentelemetry-java-examples#1218, (admin enforcement already enabled)
• open-telemetry/opentelemetry-java-instrumentation: ci: remediate zizmor findings opentelemetry-java-instrumentation#19283, follow-up ci: clear remaining zizmor findings opentelemetry-java-instrumentation#19339, (admin enforcement already enabled)
• open-telemetry/opentelemetry-js: ci: move security scanning to shared workflow opentelemetry-js#6976, open-telemetry/admin#801
• open-telemetry/opentelemetry-js-contrib: ci: move security scanning to shared workflow opentelemetry-js-contrib#3656, open-telemetry/admin#805
• open-telemetry/opentelemetry-kotlin: ci: add shared security scanning workflow opentelemetry-kotlin#681, open-telemetry/admin#760
• open-telemetry/opentelemetry-packaging: ci: add shared security scanning workflow opentelemetry-packaging#24, follow-up Fix zizmor findings in packaging workflows opentelemetry-packaging#53, open-telemetry/admin#762
• open-telemetry/opentelemetry-php: ci: add shared security scanning workflow opentelemetry-php#2024, open-telemetry/admin#800
• open-telemetry/opentelemetry-php-contrib: ci: add shared security scanning workflow opentelemetry-php-contrib#677, follow-up Fix workflows after Zizmor. opentelemetry-php-contrib#679, follow-up ci: resolve residual zizmor findings opentelemetry-php-contrib#681, open-telemetry/admin#793
• open-telemetry/opentelemetry-proto-go: ci: add shared security scanning workflow opentelemetry-proto-go#675, open-telemetry/admin#780
• open-telemetry/opentelemetry-proto-java: ci: colocate zizmor suppression rationales opentelemetry-proto-java#263, (admin enforcement already enabled)
• open-telemetry/opentelemetry-ruby: ci: add shared security scanning workflow opentelemetry-ruby#2251, open-telemetry/admin#757
• open-telemetry/opentelemetry-ruby-contrib: ci: add shared security scanning workflow opentelemetry-ruby-contrib#2462, open-telemetry/admin#758
• open-telemetry/opentelemetry-ruby-instrumentation: ci: refresh security workflow remediation opentelemetry-ruby-instrumentation#66 (replaces closed ci: move security scanning to shared workflow opentelemetry-ruby-instrumentation#48), (admin enforcement already enabled)
• open-telemetry/opentelemetry-weaver-packages: ci: add shared security scanning workflow opentelemetry-weaver-packages#56, open-telemetry/admin#819
• open-telemetry/semantic-conventions: Add shared zizmor workflow semantic-conventions#3895, follow-up ci: use checkout credentials for git pushes semantic-conventions#3918, open-telemetry/admin#756
• open-telemetry/semantic-conventions-genai: ci: add shared security scanning workflow semantic-conventions-genai#382, open-telemetry/admin#761
• open-telemetry/semantic-conventions-java: ci: remediate zizmor findings semantic-conventions-java#538, (admin enforcement already enabled)
• open-telemetry/semantic-conventions-mainframe: ci: move security scanning to shared workflow semantic-conventions-mainframe#25, (admin enforcement already enabled)
• open-telemetry/sig-contributor-experience: ci: add shared security scanning workflow sig-contributor-experience#120, open-telemetry/admin#807
• open-telemetry/sig-developer-experience: ci: add shared security scanning workflow sig-developer-experience#105, open-telemetry/admin#808
• open-telemetry/sig-profiling: ci: add shared security scanning workflow sig-profiling#176, open-telemetry/admin#810
• open-telemetry/sig-security: ci: add shared security scanning workflow #312, open-telemetry/admin#806

Exclusions

• open-telemetry/shared-workflows: shared workflow repository self-scans and must not call itself

Add future rollout and enforcement PRs to this checklist, and link their descriptions back to this issue.