Previously:

• #62221 GitHub Actions workflow hardening #8007
• GitHub Actions workflow hardening gutenberg#69126

This change:

• Introduces Zizmor which is a tool for linting workflow files for security weaknesses.
• Fixes some issues in workflow files that were identified by Zizmor.

Code scanning alerts

Like the existing Actionlint job, Zizmor reports to GitHub Code Scanning by uploading a SARIF report via the github/codeql-action/upload-sarif action (none of these tools use CodeQL but GitHub groups its code scanning actions under the CodeQL name).

• This makes the results available on the Security → Code Scanning screen for users with write permission on the repo.
• Code scanning errors and warnings that are newly introduced in a PR will cause the code scanning to fail. The code scanning job itself won't fail, it will produce a separate "Code scanning results" workflow on the Checks screen which shows the failures, accompanied with an inline annotation on the affected file and line.
• Existing issues (documented below) will remain in place until fixed or dismissed. They won't affect new PRs, so they behave like a baseline.
  • Note: It's unclear whether the dismissed issues in this branch will carry across to trunk when this gets committed. I suspect not because the PR won't get merged on GitHub. I'll handle it post merge if necessary.

Todo

• Implement scanning
• Add docs to the readme
• Address reported errors
• Draft new page for the coding standards handbook

We already have Actionlint in place. Why do we need Zizmor?

The tools are complementary. Actionlint implements 38 checks, Zizmor implements 34 in its strictest mode, but only around 9 of the checks fully overlap. Zizmor gives us a net of about 20 new checks in its default mode, including detection of archived actions, spoofable bot conditions, problematic use of GitHub Actions features and patterns, overprovisioned secrets, git ref confusion, and unpinned actions.

Actionlint primarily focuses on correctness, with some security related audits included. Zizmor primarily focues on security.

Results

Some code scanning alerts remain after I dismissed the false positives and closed some non-critical warnings.

Errors

• ❌ use of fundamentally insecure workflow trigger
  • Refers to the pull_request_target trigger.
  • We're aware that this trigger is fundamentally risky. Need to document it inline and then close the alerts.
• ❌ Use of "downloadArtifact" in "actions/github-script" action.
  • Need to audit these to ensure the artifact contents are not treated as trusted.
• ❌ Use of 'actions/checkout' with a custom ref
  • Need to audit these so we're clear on where the refs originate.
• ❌ Write to $GITHUB_ENV and $GITHUB_OUTPUT in a bash script
  • These are only dangerous if the input is user-controlled. I've closed off all the false positives, the remaining needs to be reviewed.

Warnings

• ⚠️ Obfuscated usage of GitHub Actions features
  • Refers to incorrect usage of ${{ true }} instead of true. No security concern but needs an audit.