Added zizmor GitHub Actions security analysis (#46576)

**Related issue:** Resolves #41198 Subsequent PRs will clean up existing failures to enable more checks.  ## Summary by CodeRabbit * **New Features** * Added automated security scanning for repository workflow/configuration changes and pull requests, with manual trigger and concurrent-run cancellation. * **Chores** * Introduced a configurable audit gate to suppress backlog rules with guidance for removal. * Enabled runner hardening, pinned tool versions, read-only checkout, annotation-enabled reporting, and limited-scope analysis for workflow files.
2026-06-02 10:34:00 -05:00
parent a4d1cfab1f
commit bad1bc5494
2 changed files with 101 additions and 0 deletions
@@ -0,0 +1,67 @@
+name: zizmor GitHub Actions security analysis
+
+# Statically analyzes our GitHub Actions workflows and composite actions with zizmor
+# (https://docs.zizmor.sh) to catch supply-chain and CI/CD security issues such as
+# template injection, unpinned actions/images, cache poisoning, credential persistence,
+# and excessive permissions.
+#
+# The job fails for the audit rules the repository already passes, so we never regress on
+# them. The rules with an existing backlog of findings are disabled in
+# .github/zizmor-gate.yml and burned down in follow-up work; deleting a `disable: true`
+# entry there starts enforcing that rule too.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor-gate.yml"
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+      - ".github/zizmor-gate.yml"
+  workflow_dispatch:
+
+# This allows a subsequently queued workflow run to interrupt previous runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+# Declare default permissions as none; the job below grants exactly what it needs.
+permissions: {}
+
+# Pin the zizmor version so a new release adding an audit rule cannot unexpectedly break
+# the gate. Bump deliberately.
+env:
+  ZIZMOR_VERSION: 1.25.2
+
+jobs:
+  zizmor:
+    name: Analyze GitHub Actions workflows
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # checkout
+      actions: read # zizmor online audits read workflow and run metadata
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          version: ${{ env.ZIZMOR_VERSION }}
+          # Scope analysis to Fleet's own workflows and composite actions.
+          inputs: .github/workflows .github/actions
+          # Fail the job on findings, emitting them as inline annotations.
+          advanced-security: false
+          annotations: true
+          config: .github/zizmor-gate.yml
@@ -0,0 +1,34 @@
+# zizmor "blocking gate" configuration.
+#
+# This config is used by the zizmor job in .github/workflows/zizmor.yml. It disables the
+# audit rules for which we currently carry a backlog of findings, so the job fails the
+# build only for rules the repository ALREADY passes (catching regressions).
+#
+# As the backlog is burned down in follow-up work, delete the corresponding `disable: true`
+# entry below to start enforcing that rule too. The current finding counts (in our
+# .github/workflows + .github/actions scope) are noted for reference.
+#
+# This file is passed explicitly via the action's `config:` input rather than being named
+# .github/zizmor.yml, so a plain `zizmor .` run still reports the full backlog locally.
+
+rules:
+  artipacked: # 125 findings
+    disable: true
+  cache-poisoning: # 16 findings
+    disable: true
+  dependabot-cooldown: # 2 findings
+    disable: true
+  excessive-permissions: # 20 findings
+    disable: true
+  known-vulnerable-actions: # 418 findings (online audit)
+    disable: true
+  misfeature: # 11 findings
+    disable: true
+  ref-version-mismatch: # 44 findings (online audit)
+    disable: true
+  secrets-inherit: # 5 findings
+    disable: true
+  template-injection: # 234 findings
+    disable: true
+  unpinned-uses: # 31 findings
+    disable: true