Victor Lyuboslavsky
95c349be96
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #41198 Also fixed the currently failing check on main. Final zizmor PR <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security & Infrastructure** * Enhanced credential handling in automated workflows by disabling unnecessary credential persistence * Strengthened security scanning configuration to enforce additional checks on GitHub Actions workflows while maintaining a curated allowlist for compatibility <!-- end of auto-generated comment: release notes by coderabbit.ai -->
74 lines
3.4 KiB
YAML
74 lines
3.4 KiB
YAML
# zizmor "blocking gate" configuration.
|
|
#
|
|
# This config is used by the zizmor job in .github/workflows/zizmor.yml.
|
|
#
|
|
# This file is passed explicitly via the action's `config:` input rather than being named
|
|
# .github/zizmor.yml, so a plain `zizmor .` run still reports the full backlog locally.
|
|
|
|
rules:
|
|
# The misfeature rule stays ENABLED so new workflows are still checked; we only waive the
|
|
# specific Windows signing/build workflows below. Their findings are all `shell: cmd` notices:
|
|
# zizmor cannot introspect CMD scripts, so it emits a Low-severity analysis-limitation note
|
|
# rather than a real finding, and these workflows require the Windows CMD shell. Matching is by
|
|
# filename, so keep these names unique.
|
|
misfeature:
|
|
ignore:
|
|
- build-fleetctl-msi.yml
|
|
- code-sign-windows.yml
|
|
- e2e-agent.yml
|
|
- fleet-and-orbit.yml
|
|
- generate-osqueryd-targets.yml
|
|
- goreleaser-fleet.yaml
|
|
# The template-injection rule stays ENABLED so new workflows are checked, and we waive only the
|
|
# workflows that carry the existing backlog (listed below). We audited every current finding by
|
|
# trigger and source: none are reachable by untrusted input. There are no pull_request_target /
|
|
# workflow_run / issue_comment workflows; the one issues-triggered workflow
|
|
# (auto-tag-unreleased-bugs.yml) reads the issue body via actions/github-script's context object,
|
|
# never interpolated into a shell. The remaining findings draw only from maintainer-/runner-
|
|
# controlled sources (static matrix values, workflow_dispatch inputs gated behind write access,
|
|
# push/tag refs, github.sha, and internal step outputs), so they are not externally exploitable.
|
|
# This waiver freezes the backlog: any template-injection in a NEW workflow, or any NEW finding
|
|
# in a workflow not listed here, fails the gate.
|
|
#
|
|
# Matching is by filename only (zizmor does not match on path), so keep these names unique.
|
|
# NOTE: `action.yml` matches every composite-action manifest. Today only .github/actions/r2-upload
|
|
# carries findings; a future finding in another composite action (e.g. eng-metrics) would also be
|
|
# suppressed. Revisit if more composite actions are added.
|
|
template-injection:
|
|
ignore:
|
|
- action.yml # .github/actions/r2-upload/action.yml (bash; env/inputs from trusted callers)
|
|
- build-fleetctl-msi.yml
|
|
- build-fleetctl-pkg.yml
|
|
- build-fleetd-base-msi.yml
|
|
- build-fleetd-base-pkg.yml
|
|
- build-fleetdm-fleetctl-check-vulnerabilities.yml
|
|
- check-bomutils-vulnerabilities.yml
|
|
- check-vulnerabilities-in-released-docker-images.yml
|
|
- check-wix-vulnerabilities.yml
|
|
- code-sign-windows.yml
|
|
- db-upgrade-test.yml
|
|
- dogfood-automated-policy-updates.yml
|
|
- dogfood-update-testing-qa-apps.yml
|
|
- e2e-agent.yml
|
|
- fleet-and-orbit.yml
|
|
- generate-desktop-targets.yml
|
|
- golangci-lint.yml
|
|
- goreleaser-fleet.yaml
|
|
- goreleaser-orbit.yaml
|
|
- goreleaser-snapshot-fleet.yaml
|
|
- ingest-maintained-apps.yml
|
|
- loadtest-infra.yml
|
|
- loadtest-osquery-perf.yml
|
|
- product-eng-handbook-summary.yml
|
|
- publish-go-module.yml
|
|
- randokiller-go.yml
|
|
- release-fleetd-base.yml
|
|
- release-fleetd-chrome-beta.yml
|
|
- release-fleetd-chrome.yml
|
|
- tag-aging-bugs.yml
|
|
- test-db-changes.yml
|
|
- test-fma-darwin-pr-only.yml
|
|
- test-fma-windows-pr-only.yml
|
|
- test-go-suite.yaml
|
|
- verify-fleetd-base.yml
|