fix(ci): resolve all zizmor findings in GitHub workflows
Metadata
Current evaluation
Merged in canonical/starbase#585 as commit f86068e, hardening GitHub workflows and reducing zizmor findings from 44 to 0; all CI checks passed.
Resolution: closed resolved
Reason: The approved PR was merged as commit f86068e. It pins third-party actions, scopes permissions, limits secret access, and hardens release handling, with all reported checks passing.
Evaluated by: mr-cal-bot
No scores available.
Issue body
> 🤖 This PR description was generated by an AI agent (GitHub Copilot CLI).
## Summary
Fixes every finding reported by [zizmor](https://docs.zizmor.sh) across all GitHub Actions workflows (44 findings → 0).
## Changes
- Pin all third-party actions to commit hashes (`unpinned-uses`), except `canonical/starflow/...@main` references, which are intentionally kept at `@main` per team policy and suppressed with a documented `zizmor: ignore` comment.
- Add `persist-credentials: false` to all `actions/checkout` steps (`artipacked`).
- Scope down permissions (`excessive-permissions`): replace workflow-level `contents: write` in `release-publish.yaml` with per-job permissions, and add explicit `permissions:` blocks where missing.
- Replace `secrets: inherit` in `tics.yaml` with an explicit pass-through of just the one secret needed (`secrets-inherit`).
- Replace `softprops/action-gh-release` with a `gh release create` script step (`superfluous-actions`), passing the tag via an env var to avoid `template-injection`.
- Add a documented, justified ignore for the ad-hoc renovate npm install (`adhoc-packages`) since it has no meaningful lockfile.
## Testing
- `zizmor .` → 0 findings
- `make lint-actions` / `make lint-prettier` → pass
- All CI checks pass, including the repo's own zizmor audit job
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/starbase#585 as commit f86068e, hardening GitHub workflows and reducing zizmor findings from 44 to 0; all CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/starbase#585, resolving all 44 zizmor findings through hardened action pins, scoped permissions, explicit secrets, and safer release scripting; all CI checks passed. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged. Resolved all 44 zizmor findings in GitHub Actions by pinning actions to commit hashes, restricting permissions, removing secrets inheritance, replacing a release action with a script, and adding justified ignores. All CI checks passed. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
15
Confidence:
95
|
needs review | Resolves 44 zizmor security findings across GitHub Actions workflows by pinning actions, scoping permissions, and replacing insecure patterns. All CI checks pass and the PR has two approvals. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
95
|
needs review | Resolves 44 zizmor security findings across GitHub Actions workflows by pinning actions, scoping permissions, and replacing unsafe patterns. All CI checks pass and the PR has one approval. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
15
Confidence:
95
|
needs review | Resolves all zizmor security findings in GitHub workflows by pinning actions, scoping permissions, and replacing unsafe patterns. All CI checks pass; awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
15
Confidence:
90
|
needs review | Resolves 44 zizmor security findings across GitHub Actions workflows by pinning actions, scoping permissions, and removing redundant actions. All CI checks pass, awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Resolves 44 zizmor security findings in GitHub Actions workflows by pinning actions, scoping permissions, and replacing unsafe patterns. All CI checks pass, awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Resolves 44 zizmor security findings across GitHub Actions workflows by pinning actions, scoping permissions, and replacing third-party actions. All CI checks pass. Awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Resolves all zizmor security findings in GitHub workflows by pinning actions, scoping permissions, replacing third-party release actions, and documenting ignores. All CI checks pass, awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Resolves all zizmor security findings in GitHub Actions workflows by pinning actions, scoping permissions, removing secrets inheritance, and replacing third-party release actions. Currently passing CI and awaiting maintainer review. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #462 ci: Remediate Zizmor findings in GitHub Actions workflows | imagecraft | closed | Closed unmerged; superseded by #585 (f86068e), which already resolved all zizmor findings and conflicts with .github/zizmor.yaml. | |
| #1156 ci: add zizmor workflow | craft-application | merged | Merged PR #1156 (commit 517f97e0) added a Zizmor GitHub Actions security-scanning workflow, adapted from canonical/starflow#151. | |
| #6393 ci: fix zizmor warnings | snapcraft | merged | Merged PR #6393 as commit c41c04835, correcting Zizmor warnings originating from the Starbase merge in #6391. | |
| #2897 ci: fix actionlint findings ahead of Starbase merge | charmcraft | closed | PR #2897 (4 workflow files, +10/-32) fixing actionlint/zizmor findings — dropped paths-ignore from merge_group triggers, quoted shell expansions and $CHARMCRAFT_JSON/$proj_file, bound matrix.system via env. Approved by 2 reviewers, merged; OSV-scanner failure ruled unrelated. | |
| #473 No changes needed: workflow findings already resolved | imagecraft | closed | Closed without merge; no changes made. Underlying zizmor findings in #403 were later resolved by #585 (commit f86068e). | |
| #151 ci: add zizmor workflow | starflow | merged | Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169. | |
| #426 ci: fix security scanner | imagecraft | merged | Merged canonical/imagecraft#426 added a one-line CI workflow fix for zizmor; zizmor and GitHub Actions security-audit checks passed. | |
| #416 ci: update permissions for zizmor | craft-store | merged | PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers. | |
| #251 ci: update permissions for zizmor | craft-archives | merged | Merged PR canonical/craft-archives#251 (commit 2845f6b) adding a one-line GitHub Actions permissions update required by the zizmor security-scan workflow; review approved and all CI checks passed. | |
| #471 ci: update permissions for zimzor | craft-cli | merged | Merged PR #471 as commit 04d4625, adding permissions so the zizmor security workflow could run. All listed CI checks passed. |