chore(ci): adopt zizmor, fix its high findings, group dependabot PRs - #169
Merged
Conversation
Plumb's package audit fails two security checks for this package, which together hold the composite score at 82.16: security.actions-sha-pinned 0 of 12 refs pinned (weight 8) security.dependency-update-cooldown no cooldown config (weight 4) Tag refs are mutable: a compromised maintainer can re-point v7 at arbitrary code, as tj-actions/changed-files did in March 2025. Every third-party action is now pinned to a full 40-character commit SHA with the resolved version in a trailing comment, which is also what Dependabot reads to keep the pins current. The first-party reusable workflow ref (./.github/workflows/tests.yml) stays as-is; it is covered by branch protection. The dependabot cooldown adds a 7-day minimum age before an update is proposed, so an obviously malicious release has time to be caught before it lands. Matches filamentphp/filament and bezhanSalleh/filament-shield. Also adds a CI job that fails on any unpinned third-party ref, so this cannot silently regress, and pins tests.yml to a read-only token.
Follow-up to the SHA pinning work. Pins stop tag mutation but say nothing about the rest of the workflow surface, so this adds the static analyser the ecosystem has standardised on and clears everything it flags above low severity. zizmor 1.29.0 reported 5 high and 1 medium finding. All are fixed: dangerous-triggers auto-merge.yml ran on pull_request_target bot-conditions github.actor is spoofable as a bot check template-injection x2 release tag/branch interpolated into a run block excessive-permissions release.yml granted contents: write workflow-wide secrets-inherit release.yml passed every secret to tests.yml auto-merge.yml now follows GitHub's documented pattern: the pull_request trigger with permissions elevated per job, and the actor check reading github.event.pull_request.user.login. laravel/framework runs the same shape, so the elevated-permissions path is known to work for Dependabot. tests.yml consumes no secrets, so secrets: inherit was pure over-grant. zizmor itself runs via zizmorcore/zizmor-action, matching filamentphp/ filament. Results land in the Security tab; the pin gate stays the tests.yml job, which release.yml calls, so releases remain gated. Dependabot now groups action and npm bumps into one PR each instead of one per dependency, as laravel/framework does. Four artipacked and four low-confidence template-injection findings remain. The checkouts they name push commits and need their credentials.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
ManukMinasyan
changed the base branch from
chore/pin-actions-sha-and-cooldown
to
4.x
August 19, 2026 14:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on #168 and targets
4.xdirectly, so the full test matrix and the pin guard actually run here (tests.ymlonly triggers on PRs into4.x, so a stacked base skipped them). Until #168 merges this PR shows both commits; once it does, the diff collapses to this commit alone. Merge #168 first.#168 stops tag mutation. It says nothing about the rest of the workflow surface, so this adds the static analyser the ecosystem has standardised on and clears everything above low severity.
zizmor findings
Ran
zizmor 1.29.0locally against the.github/tree.dangerous-triggersauto-merge.ymlpull_request_targettopull_requestbot-conditionsauto-merge.ymlgithub.actortogithub.event.pull_request.user.logintemplate-injectionx2changelog.ymlenv:instead of interpolated into therunblockexcessive-permissionsrelease.ymlcontents: writemoved from workflow level to the one job that needs itsecrets-inheritrelease.ymlsecrets: inherit;tests.ymlreferences no secretsOn the auto-merge trigger change
This is the one behavioural change, so it is worth being explicit. GitHub's documented pattern for Dependabot auto-merge is
on: pull_requestwithpermissionselevated in the workflow, and the actor check readinggithub.event.pull_request.user.login.That is both zizmor High findings at once.
pull_request_targetis flagged because it runs against the base with a privileged token; the actor check is flagged becausegithub.actoris spoofable.Dependabot-triggered
pull_requestruns get a read-only token by default, which is why the permissions are declared per job.laravel/frameworkruns this exact shape in production, so the path is proven, not theoretical.zizmor in CI
New
zizmor.yml, copied fromfilamentphp/filament, path-filtered to.github/**and pinned tozizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2.Results go to the Security tab. This is deliberately advisory: the hard gate for pins stays the
actions-pinnedjob intests.yml, whichrelease.ymlcalls viaworkflow_call, so releases stay gated on pinning. zizmor's lower-confidence heuristics should not block unrelated PRs.Dependabot grouping
Action and npm bumps now arrive as one PR each instead of one per dependency, matching
laravel/framework. With the 7-day cooldown that means roughly one action-update PR a week. If a group contains a major bump,update-typereportssemver-majorand auto-merge correctly leaves it for review.What is intentionally left
Four
artipacked(low) and four low-confidencetemplate-injection(informational) findings. The checkouts named byartipackedare inpint.yml,changelog.ymlanddeploy-docs.yml, all of which push commits and need their credentials.persist-credentials: falsewas added only to thetests.ymlcheckouts, which do not.Verification
dependabot.ymlparse as YAML.zizmor --min-severity medium .github/reportsNo findings to report.zizmorcore/zizmor-action@3dc1ecc9re-resolved against its upstream repo.