From 265af8a1831c2948e9b4126fdfe3f132a8f0384f Mon Sep 17 00:00:00 2001 From: zi0Black <13380579+zi0Black@users.noreply.github.com> Date: Thu, 14 May 2026 00:34:57 +0200 Subject: [PATCH] ci: harden GitHub Actions workflows (zizmor audit) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Pin all unpinned action refs to immutable commit SHAs (tag immutability verified via GitHub rulesets API for each repo; all returned false/empty so SHA pinning applied) - Add top-level `permissions: contents: read` to ci.yml, test.yml, and validate.yml (publish.yml already had per-job permissions) - Add `persist-credentials: false` to all actions/checkout steps to prevent credential leakage through GitHub Actions artifacts Findings addressed: unpinned-uses (40 errors), excessive-permissions (27 warnings), artipacked (26 warnings) — 93 findings total Actions pinned: actions/checkout v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 actions/publish-immutable-action v0.0.4 -> 4bc8754ffc40f27910afb20287dbbbb675a4e978 docker/setup-qemu-action v3 -> c7c53464625b32c7a7e944ae62b3e17d2b600130 docker/build-push-action v6 -> 10e90e3645eae34f1e60eeb005ba3a3d33f178e8 docker/build-push-action master -> 789f68658055d3ca993799b232b5c46dfe3f114d docker/bake-action v5 -> 4a9a8d494466d37134e2bfca2d3a8de8fb2681ad crazy-max/ghaction-dump-context v2 -> 5355a8e5e6ac5a302e746a1c4b7747a0393863c8 codecov/codecov-action v4 -> b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 crazy-max/.github install-k3s -> already SHA-pinned (skipped) --- .github/workflows/ci.yml | 111 +++++++++++++++++++++++---------- .github/workflows/publish.yml | 6 +- .github/workflows/test.yml | 11 +++- .github/workflows/validate.yml | 13 +++- 4 files changed, 101 insertions(+), 40 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9c7b235..06e253e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,6 +15,9 @@ on: - 'v*' pull_request: +permissions: + contents: read + jobs: main: runs-on: ubuntu-latest @@ -30,7 +33,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx id: buildx @@ -49,7 +54,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx 1 uses: ./ @@ -62,7 +69,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Stop docker run: | @@ -83,14 +92,16 @@ jobs: - name: Dump context if: always() - uses: crazy-max/ghaction-dump-context@v2 + uses: crazy-max/ghaction-dump-context@5355a8e5e6ac5a302e746a1c4b7747a0393863c8 # v2 debug: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Create Dockerfile run: | @@ -100,7 +111,7 @@ jobs: EOL - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Set up Docker Buildx uses: ./ @@ -108,7 +119,7 @@ jobs: buildkitd-flags: --debug - name: Build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . platforms: linux/amd64,linux/arm64,linux/ppc64le @@ -118,7 +129,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: ./ @@ -140,7 +153,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: ./ @@ -163,7 +178,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: ./ @@ -176,7 +193,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: ./ @@ -209,7 +228,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Create context run: | @@ -231,7 +252,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Create buildkitd conf run: | @@ -254,7 +277,7 @@ jobs: buildkitd-config: /tmp/buildkitd.toml - name: Build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . @@ -263,7 +286,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Create Dockerfile run: | @@ -281,7 +306,7 @@ jobs: mirrors = ["mirror.gcr.io"] - name: Build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . @@ -299,10 +324,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 with: platforms: ${{ matrix.qemu-platforms }} - @@ -328,7 +355,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: ./ @@ -342,7 +371,7 @@ jobs: EOL - name: Build - uses: docker/build-push-action@master + uses: docker/build-push-action@789f68658055d3ca993799b232b5c46dfe3f114d # master with: context: . @@ -351,7 +380,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Uninstall docker cli run: | @@ -379,7 +410,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Uninstall docker cli run: | @@ -401,7 +434,7 @@ jobs: EOL - name: Build - uses: docker/build-push-action@master + uses: docker/build-push-action@789f68658055d3ca993799b232b5c46dfe3f114d # master with: context: . @@ -410,7 +443,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Uninstall docker cli run: | @@ -440,7 +475,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Create dummy contexts run: | @@ -469,10 +506,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Set up Docker Buildx uses: ./ @@ -484,7 +523,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Create Docker context run: | @@ -507,7 +548,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: ./ @@ -525,7 +568,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Install k3s uses: crazy-max/.github/.github/actions/install-k3s@605d30d5ae97f6680578ace4b56645af79343e60 @@ -560,7 +605,7 @@ jobs: EOL - name: Build - uses: docker/build-push-action@master + uses: docker/build-push-action@789f68658055d3ca993799b232b5c46dfe3f114d # master with: context: . @@ -575,7 +620,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: ./ diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f30e15f..8e79629 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -15,7 +15,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Publish - uses: actions/publish-immutable-action@v0.0.4 + uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 99b120d..fe8defd 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -11,24 +11,29 @@ on: - 'releases/v*' pull_request: +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Set up Docker Buildx uses: ./ - name: Test - uses: docker/bake-action@v5 + uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5 with: targets: test - name: Upload coverage - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4 with: file: ./coverage/clover.xml token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index a28f09c..3414535 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -11,6 +11,9 @@ on: - 'releases/v*' pull_request: +permissions: + contents: read + jobs: prepare: runs-on: ubuntu-latest @@ -19,7 +22,9 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Targets matrix id: targets @@ -37,9 +42,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + with: + persist-credentials: false - name: Validate - uses: docker/bake-action@v5 + uses: docker/bake-action@4a9a8d494466d37134e2bfca2d3a8de8fb2681ad # v5 with: targets: ${{ matrix.target }}