From 2614e7f22f41f02aefb7c7cd3cd7bcb347e63c3d Mon Sep 17 00:00:00 2001
From: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Date: Wed, 3 Jun 2026 16:01:49 -0500
Subject: [PATCH] zizmor checks cleanup (1) (#46646)

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41198

Fixing/enabling these zizmor checks:
- dependabot-cooldown
- secrets-inherit
- unpinned-uses


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Refined secret handling in CI test workflows: replaced inherited
secrets with explicit secret mappings and conditional forwarding
(scheduled runs vs others).
* Declared additional callable secrets for the reusable test suite: a
GitHub token and a Slack webhook for scheduled-run notifications.
* Updated blocking gate configuration: adjusted which rules are shown as
disabled and updated finding count comments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .github/workflows/test-go-activity.yaml |  8 ++++++--
 .github/workflows/test-go-suite.yaml    |  7 +++++++
 .github/workflows/test-go.yaml          | 12 +++++++++---
 .github/zizmor-gate.yml                 | 10 ++--------
 4 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/test-go-activity.yaml b/.github/workflows/test-go-activity.yaml
index 5978efbce5..cda7be0295 100644
--- a/.github/workflows/test-go-activity.yaml
+++ b/.github/workflows/test-go-activity.yaml
@@ -58,7 +58,9 @@ jobs:
       cover_pkg: 'github.com/fleetdm/fleet/v4/server/activity/...'
       generate_go: false
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Extended MySQL coverage: only on the nightly cron schedule.
@@ -76,7 +78,9 @@ jobs:
       cover_pkg: 'github.com/fleetdm/fleet/v4/server/activity/...'
       generate_go: false
       is_cron: true
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
 
   # We upload all backend coverage in one step so that we're less likely to end up with a partial coverage report.
   upload-coverage:
diff --git a/.github/workflows/test-go-suite.yaml b/.github/workflows/test-go-suite.yaml
index 66f46fc6b2..deaf6d756b 100644
--- a/.github/workflows/test-go-suite.yaml
+++ b/.github/workflows/test-go-suite.yaml
@@ -29,6 +29,13 @@ on:
         required: false
         type: boolean
         default: false
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT:
+        description: 'GitHub PAT used as NETWORK_TEST_GITHUB_TOKEN for tests that hit the GitHub API.'
+        required: false
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL:
+        description: 'Slack webhook for notifying on scheduled (cron) run failures.'
+        required: false
 
 permissions:
   contents: read
diff --git a/.github/workflows/test-go.yaml b/.github/workflows/test-go.yaml
index d1e38dc799..b5fb52e1e9 100644
--- a/.github/workflows/test-go.yaml
+++ b/.github/workflows/test-go.yaml
@@ -64,7 +64,9 @@ jobs:
     with:
       suite: ${{ matrix.suite }}
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Suites that need MySQL: always-run versions (every push/PR + cron).
@@ -80,7 +82,9 @@ jobs:
       suite: ${{ matrix.suite }}
       mysql: ${{ matrix.mysql }}
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Extended MySQL coverage: only on the nightly cron schedule.
@@ -97,7 +101,9 @@ jobs:
       suite: ${{ matrix.suite }}
       mysql: ${{ matrix.mysql }}
       is_cron: true
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
 
   # Based on https://github.com/micromdm/nanomdm/blob/main/.github/workflows/on-push-pr.yml#L87
   test-go-nanomdm:
diff --git a/.github/zizmor-gate.yml b/.github/zizmor-gate.yml
index 92d5be0578..77b8596300 100644
--- a/.github/zizmor-gate.yml
+++ b/.github/zizmor-gate.yml
@@ -12,11 +12,9 @@
 # .github/zizmor.yml, so a plain `zizmor .` run still reports the full backlog locally.
 
 rules:
-  artipacked: # 125 findings
+  artipacked: # 112 findings
     disable: true
-  dependabot-cooldown: # 2 findings
-    disable: true
-  excessive-permissions: # 20 findings
+  excessive-permissions: # 6 findings
     disable: true
   known-vulnerable-actions: # 418 findings (online audit)
     disable: true
@@ -24,9 +22,5 @@ rules:
     disable: true
   ref-version-mismatch: # 44 findings (online audit)
     disable: true
-  secrets-inherit: # 5 findings
-    disable: true
   template-injection: # 234 findings
     disable: true
-  unpinned-uses: # 31 findings
-    disable: true