feat(zizmor): add a reusable workflow for zizmor GitHub Actions static analysis #605
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
iainlane
force-pushed
the
iainlane/add-zizmor-reusable-workflow
branch
6 times, most recently
from
2f972d2 to
9488aad
Compare
…c analysis This is a [reusable workflow] which runs the [`zizmor`][zizmor] static analysis tool on a repo's GitHub Actions workflow files. This will report things such as whether there is potential for untrusted code to be injected via a template. See a full list of checks in [the documentation][zizmor-checks]. This workflow will run zizmor, upload results to GitHub's code scanning service (requires an Advanced Security subscription for private repositories), and comment on the pull request with the results. The comment will be re-posted on each run - and previous comments hidden - so the most recent comment will always show the current results. [reusable workflow]: https://docs.github.com/en/actions/using-workflows/reusing-workflows [zizmor]: https://woodruffw.github.io/zizmor/ [zizmor-checks]: https://woodruffw.github.io/zizmor/audits/
iainlane
force-pushed
the
iainlane/add-zizmor-reusable-workflow
branch
from
9488aad to
94890b3
Compare
This comment has been minimized.
This comment has been minimized.
|
In this PR I introduced and fixed some problems that the script found. You can see that above 👍 If you look at the files changed tab, you can see results for the other files (same as in the comment) |
zerok
approved these changes
Dec 2, 2024
iainlane
commented
Dec 3, 2024
|
😢 zizmor failed with exit code 14. Expand for full output |
|
I decided to leave this for the time being, because I don't want us to "randomly" add shared workflows for different tools and rely on repository owners to pick the ones they like. We as an organisation should have a position on this. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a reusable workflow which runs the
zizmorstatic analysis tool on a repo's GitHub Actions workflow files. This will report things such as whether there is potential for untrusted code to be injected via a template. See a full list of checks in the documentation.This workflow will run zizmor, upload results to GitHub's code scanning service (requires an Advanced Security subscription for private repositories), and comment on the pull request with the results. The comment will be re-posted on each run - and previous comments hidden - so the most recent comment will always show the current results.