Skip to content

chore(ci): adopt zizmor, fix its high findings, group dependabot PRs - #169

Merged
ManukMinasyan merged 2 commits into
4.xfrom
chore/harden-workflows
Aug 19, 2026
Merged

chore(ci): adopt zizmor, fix its high findings, group dependabot PRs#169
ManukMinasyan merged 2 commits into
4.xfrom
chore/harden-workflows

Conversation

@ManukMinasyan

@ManukMinasyan ManukMinasyan commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Builds on #168 and targets 4.x directly, so the full test matrix and the pin guard actually run here (tests.yml only triggers on PRs into 4.x, so a stacked base skipped them). Until #168 merges this PR shows both commits; once it does, the diff collapses to this commit alone. Merge #168 first.

#168 stops tag mutation. It says nothing about the rest of the workflow surface, so this adds the static analyser the ecosystem has standardised on and clears everything above low severity.

zizmor findings

Ran zizmor 1.29.0 locally against the .github/ tree.

Before (#168) After
High 5 0
Medium 1 0
Low 6 4
Informational 5 4
Rule Where Fix
dangerous-triggers auto-merge.yml pull_request_target to pull_request
bot-conditions auto-merge.yml github.actor to github.event.pull_request.user.login
template-injection x2 changelog.yml release tag and default branch passed through env: instead of interpolated into the run block
excessive-permissions release.yml contents: write moved from workflow level to the one job that needs it
secrets-inherit release.yml dropped secrets: inherit; tests.yml references no secrets

On the auto-merge trigger change

This is the one behavioural change, so it is worth being explicit. GitHub's documented pattern for Dependabot auto-merge is on: pull_request with permissions elevated in the workflow, and the actor check reading github.event.pull_request.user.login.

That is both zizmor High findings at once. pull_request_target is flagged because it runs against the base with a privileged token; the actor check is flagged because github.actor is spoofable.

Dependabot-triggered pull_request runs get a read-only token by default, which is why the permissions are declared per job. laravel/framework runs this exact shape in production, so the path is proven, not theoretical.

zizmor in CI

New zizmor.yml, copied from filamentphp/filament, path-filtered to .github/** and pinned to zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2.

Results go to the Security tab. This is deliberately advisory: the hard gate for pins stays the actions-pinned job in tests.yml, which release.yml calls via workflow_call, so releases stay gated on pinning. zizmor's lower-confidence heuristics should not block unrelated PRs.

Dependabot grouping

Action and npm bumps now arrive as one PR each instead of one per dependency, matching laravel/framework. With the 7-day cooldown that means roughly one action-update PR a week. If a group contains a major bump, update-type reports semver-major and auto-merge correctly leaves it for review.

What is intentionally left

Four artipacked (low) and four low-confidence template-injection (informational) findings. The checkouts named by artipacked are in pint.yml, changelog.yml and deploy-docs.yml, all of which push commits and need their credentials. persist-credentials: false was added only to the tests.yml checkouts, which do not.

Verification

  • All 7 workflows and dependabot.yml parse as YAML.
  • zizmor --min-severity medium .github/ reports No findings to report.
  • Pin guard still passes: 15 of 15 third-party refs on a 40-char SHA, including the two new ones.
  • zizmorcore/zizmor-action@3dc1ecc9 re-resolved against its upstream repo.

Plumb's package audit fails two security checks for this package, which
together hold the composite score at 82.16:

  security.actions-sha-pinned        0 of 12 refs pinned  (weight 8)
  security.dependency-update-cooldown  no cooldown config (weight 4)

Tag refs are mutable: a compromised maintainer can re-point v7 at
arbitrary code, as tj-actions/changed-files did in March 2025. Every
third-party action is now pinned to a full 40-character commit SHA with
the resolved version in a trailing comment, which is also what Dependabot
reads to keep the pins current. The first-party reusable workflow ref
(./.github/workflows/tests.yml) stays as-is; it is covered by branch
protection.

The dependabot cooldown adds a 7-day minimum age before an update is
proposed, so an obviously malicious release has time to be caught before
it lands. Matches filamentphp/filament and bezhanSalleh/filament-shield.

Also adds a CI job that fails on any unpinned third-party ref, so this
cannot silently regress, and pins tests.yml to a read-only token.
Follow-up to the SHA pinning work. Pins stop tag mutation but say nothing
about the rest of the workflow surface, so this adds the static analyser
the ecosystem has standardised on and clears everything it flags above
low severity.

zizmor 1.29.0 reported 5 high and 1 medium finding. All are fixed:

  dangerous-triggers     auto-merge.yml ran on pull_request_target
  bot-conditions         github.actor is spoofable as a bot check
  template-injection x2  release tag/branch interpolated into a run block
  excessive-permissions  release.yml granted contents: write workflow-wide
  secrets-inherit        release.yml passed every secret to tests.yml

auto-merge.yml now follows GitHub's documented pattern: the pull_request
trigger with permissions elevated per job, and the actor check reading
github.event.pull_request.user.login. laravel/framework runs the same
shape, so the elevated-permissions path is known to work for Dependabot.
tests.yml consumes no secrets, so secrets: inherit was pure over-grant.

zizmor itself runs via zizmorcore/zizmor-action, matching filamentphp/
filament. Results land in the Security tab; the pin gate stays the
tests.yml job, which release.yml calls, so releases remain gated.

Dependabot now groups action and npm bumps into one PR each instead of
one per dependency, as laravel/framework does.

Four artipacked and four low-confidence template-injection findings
remain. The checkouts they name push commits and need their credentials.
Copilot AI lite review requested due to automatic review settings August 19, 2026 14:23

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@ManukMinasyan
ManukMinasyan changed the base branch from chore/pin-actions-sha-and-cooldown to 4.x August 19, 2026 14:24
@ManukMinasyan ManukMinasyan reopened this Aug 19, 2026
@ManukMinasyan
ManukMinasyan merged commit 964c67f into 4.x Aug 19, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants