From 4f305f22c11c7abcc0cc1b3d014f35ea6cb8a80a Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com> Date: Wed, 3 Jun 2026 14:50:37 -0500 Subject: [PATCH] Fixed/enabled cache-poisoning zizmor check (#46655) **Related issue:** Resolves #41198 ## Summary by CodeRabbit * **Chores** * Disabled Go toolchain/module caching across CI build, release, and publish workflows. * Disabled Node package-manager caching in relevant publish workflows. * **Security** * Re-enabled the cache-poisoning gate rule so cache-poisoning checks can now block failing runs. --- .github/workflows/generate-desktop-targets.yml | 10 ++++++++++ .github/workflows/goreleaser-fleet.yaml | 4 ++++ .github/workflows/goreleaser-orbit.yaml | 10 ++++++++++ .github/workflows/goreleaser-snapshot-fleet.yaml | 4 ++++ .github/workflows/publish-go-module.yml | 2 ++ .github/workflows/release-fleetctl-docker-deps.yaml | 2 ++ .github/zizmor-gate.yml | 2 -- 7 files changed, 32 insertions(+), 2 deletions(-) diff --git a/.github/workflows/generate-desktop-targets.yml b/.github/workflows/generate-desktop-targets.yml index 35deca90ee..20deca2569 100644 --- a/.github/workflows/generate-desktop-targets.yml +++ b/.github/workflows/generate-desktop-targets.yml @@ -47,6 +47,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' + # Security best practice to disable caching in release/publish workflows + cache: false - name: Import signing keys env: @@ -116,6 +118,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' + # Security best practice to disable caching in release/publish workflows + cache: false - name: Generate fleet-desktop.exe run: | @@ -162,6 +166,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' + # Security best practice to disable caching in release/publish workflows + cache: false - name: Generate fleet-desktop.exe run: | @@ -209,6 +215,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' + # Security best practice to disable caching in release/publish workflows + cache: false - name: Generate desktop.tar.gz run: | @@ -243,6 +251,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' + # Security best practice to disable caching in release/publish workflows + cache: false - name: Generate desktop.tar.gz run: | diff --git a/.github/workflows/goreleaser-fleet.yaml b/.github/workflows/goreleaser-fleet.yaml index fc44171ef5..02fb1271b5 100644 --- a/.github/workflows/goreleaser-fleet.yaml +++ b/.github/workflows/goreleaser-fleet.yaml @@ -51,11 +51,15 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: "go.mod" + # Security best practice to disable caching in release/publish workflows + cache: false - name: Set up Node.js uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1 with: node-version-file: package.json + # Security best practice to disable caching in release/publish workflows + package-manager-cache: false - name: Install JS Dependencies run: make deps-js diff --git a/.github/workflows/goreleaser-orbit.yaml b/.github/workflows/goreleaser-orbit.yaml index e66a936d2a..bb48c2e2e8 100644 --- a/.github/workflows/goreleaser-orbit.yaml +++ b/.github/workflows/goreleaser-orbit.yaml @@ -55,6 +55,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: "go.mod" + # Security best practice to disable caching in release/publish workflows + cache: false - name: Run GoReleaser run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-macos.yml # v2.4.4 @@ -103,6 +105,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: "go.mod" + # Security best practice to disable caching in release/publish workflows + cache: false - name: Install musl tools run: sudo apt update && sudo apt install -y musl-tools @@ -148,6 +152,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: "go.mod" + # Security best practice to disable caching in release/publish workflows + cache: false - name: Run GoReleaser run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-linux-arm64.yml # v2.4.4 @@ -190,6 +196,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: "go.mod" + # Security best practice to disable caching in release/publish workflows + cache: false - name: Run GoReleaser run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows.yml # v2.4.4 @@ -244,6 +252,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: "go.mod" + # Security best practice to disable caching in release/publish workflows + cache: false - name: Run GoReleaser run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows-arm64.yml # v2.4.4 diff --git a/.github/workflows/goreleaser-snapshot-fleet.yaml b/.github/workflows/goreleaser-snapshot-fleet.yaml index ebe3ea70ad..997d47ccf2 100644 --- a/.github/workflows/goreleaser-snapshot-fleet.yaml +++ b/.github/workflows/goreleaser-snapshot-fleet.yaml @@ -60,6 +60,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: "go.mod" + # Security best practice to disable caching in release/publish workflows + cache: false # Set the Node.js version - name: Set up Node.js @@ -67,6 +69,8 @@ jobs: with: node-version-file: package.json check-latest: true + # Security best practice to disable caching in release/publish workflows + package-manager-cache: false - name: Install Dependencies run: make deps diff --git a/.github/workflows/publish-go-module.yml b/.github/workflows/publish-go-module.yml index 6c7a022bf4..b729d6a0c6 100644 --- a/.github/workflows/publish-go-module.yml +++ b/.github/workflows/publish-go-module.yml @@ -34,6 +34,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' + # Security best practice to disable caching in release/publish workflows + cache: false - name: Publish go module run: | diff --git a/.github/workflows/release-fleetctl-docker-deps.yaml b/.github/workflows/release-fleetctl-docker-deps.yaml index c1307d1e45..558a3b4948 100644 --- a/.github/workflows/release-fleetctl-docker-deps.yaml +++ b/.github/workflows/release-fleetctl-docker-deps.yaml @@ -43,6 +43,8 @@ jobs: uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' + # Security best practice to disable caching in release/publish workflows + cache: false - name: Login to Docker Hub uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0 diff --git a/.github/zizmor-gate.yml b/.github/zizmor-gate.yml index fa05eacdf3..92d5be0578 100644 --- a/.github/zizmor-gate.yml +++ b/.github/zizmor-gate.yml @@ -14,8 +14,6 @@ rules: artipacked: # 125 findings disable: true - cache-poisoning: # 16 findings - disable: true dependabot-cooldown: # 2 findings disable: true excessive-permissions: # 20 findings