← Back to issue list

ci: Remediate Zizmor findings in GitHub Actions workflows

View original Github issue

Metadata

Project
imagecraft
Number
#462
Type
pull request
State
closed
Author
copilot-swe-agent
Labels
—
Created
Updated
Closed

Current evaluation

Closed unmerged; superseded by #585 (f86068e), which already resolved all zizmor findings and conflicts with .github/zizmor.yaml.

Resolution: closed superseded

Reason: PR #585 (commit f86068e) already resolved all zizmor findings in GitHub workflows, and .github/zizmor.yaml deliberately allows unpinned starflow refs, making this PR redundant.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Address Zizmor findings across repository workflows by pinning mutable references and reducing credential and token exposure. - **Pinned dependencies:** Replaced mutable action and reusable workflow refs with verified commit SHAs. - **Restricted access:** Removed inherited secrets, scoped workflow permissions, and disabled persisted checkout credentials. - **Safe shell interpolation:** Passed GitHub expressions through environment variables instead of embedding them in shell commands.

Evaluation history

Date Model Scores Action Summary
~deepseek/deepseek-pro-latest — closed superseded Closed unmerged; superseded by #585 (f86068e), which already resolved all zizmor findings and conflicts with .github/zizmor.yaml.
stealth/space-bunny-alpha
Impact: 22
Quick Win: 3
Complexity: 25
Confidence: 85
Actionability: 20
close superseded Copilot-authored CI hygiene PR pinning action/workflow refs and scoping permissions in 4 workflow files. Largely duplicates merged #585 (f86068e) and conflicts with .github/zizmor.yaml, which deliberately allows unpinned starflow refs. 0 reviewers, 2 unresolved comments.
qwen/qwen3.8-27b
Impact: 40
Quick Win: 7
Complexity: 45
Confidence: 65
Actionability: 30
needs review Pins mutable action/workflow refs to SHAs, removes inherited secrets, and scopes permissions across 4 CI workflow files. External contributor PR with 2 unresolved review comments; contradicts project zizmor config that explicitly allows unpinned starflow refs.
qwen/qwen3.8-27b
Impact: 45
Quick Win: 20
Complexity: 20
Confidence: 72
Actionability: 55
needs review Pins mutable action refs to SHAs, scopes workflow permissions, and removes credential exposure across 4 CI workflow files to remediate Zizmor findings re-introduced by a starbase merge. CI passing; 2 unresolved review comments.
qwen/qwen3.8-27b
Impact: 45
Quick Win: 18
Complexity: 35
Confidence: 70
Actionability: 60
needs review Pins mutable action/reusable-workflow refs to commit SHAs, scopes permissions, removes inherited secrets, and avoids shell-embedded expressions across 4 workflows. Fresh external-agent PR; CLA passing, reviewer check pending, no review comments yet.

Update history

Date Change
closed
updated
created

Related work

  • Superseded By: imagecraft#585 (confidence 95%)

    Merged PR #585 (f86068e) resolved all zizmor findings and conflicts with this PR's pinning approach.

Related issues

Issue Project State Summary Similarity
#585 fix(ci): resolve all zizmor findings in GitHub workflows starbase merged Merged in canonical/starbase#585 as commit f86068e, hardening GitHub workflows and reducing zizmor findings from 44 to 0; all CI checks passed.
77%
#473 No changes needed: workflow findings already resolved imagecraft closed Closed without merge; no changes made. Underlying zizmor findings in #403 were later resolved by #585 (commit f86068e).
77%
#151 ci: add zizmor workflow starflow merged Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169.
74%
#1156 ci: add zizmor workflow craft-application merged Merged PR #1156 (commit 517f97e0) added a Zizmor GitHub Actions security-scanning workflow, adapted from canonical/starflow#151.
73%
#1670 ci: add zizmor actions permission craft-parts merged Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
72%
#999 ci: update permissions for zimzor craft-providers merged Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed.
72%
#208 ci: update permissions for zimzor craft-grammar merged Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run.
71%
#168 ci: update required permissions for zizmor starflow merged Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories.
71%
#416 ci: update permissions for zizmor craft-store merged PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.
71%
#591 ci: add zizmor actions permission starbase merged Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.
70%