CI: harden the workflows (zizmor) and add dependabot - #215
Merged
ThomasWaldmann merged 2 commits intoAug 31, 2026
Conversation
zizmor (https://docs.zizmor.sh/) flagged these in .github/workflows/: - unpinned-uses: actions/checkout@v7, actions/setup-python@v6 and psf/black@stable are all mutable refs - "stable" is a branch, so whatever it points at today is what runs tomorrow. Pin all of them to a commit hash with the version in a comment, like release.yml already does. setup-python goes from v6 to v7 on the way (v7 only drops the pip-install input, which we do not use). - artipacked: actions/checkout leaves the credentials it used in .git/config of the workspace. Nothing here pushes, so turn that off via persist-credentials: false. In release.yml this also stops the token from being in the workspace while the sdist artifact is uploaded; the release job talks to GitHub via GH_TOKEN, not git. - template-injection: "tox -e ${{ matrix.toxenv }}" expanded the matrix value into the shell command. The values are literals in this workflow, so it was not exploitable, but the job already exports TOXENV - so just run tox and let it pick that up. - concurrency-limits: without a concurrency group, pushing to a pull request branch stacked up runs instead of cancelling the previous one. Same group expression as borg uses. zizmor is clean on .github/workflows/ now (default persona). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Same setup as in borg: one weekly grouped update for the GitHub Actions (now that they are pinned to hashes, they need something that bumps them), one for requirements.d, and a cooldown so we do not run into a version that gets yanked or hotfixed right after release. black is excluded because its version is pinned in two places - requirements.d/codestyle.txt and the psf/black step in black.yaml - and dependabot only knows about the first one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ran zizmor 1.30 over
.github/workflows/and fixed everything it reported, plus a dependabot config modelled on the one in borg.What zizmor found
unpinned-usesactions/checkout@v7,actions/setup-python@v6,psf/black@stableartipackedactions/checkoutsteptemplate-injectiontox -e ${{ matrix.toxenv }}inci.ymlconcurrency-limitsci.yml,black.yamlWhat this changes
release.ymlalready does it. The one that actually mattered ispsf/black@stable—stableis a branch of a third-party action.setup-pythongoes v6 → v7 on the way; v7 only drops thepip-installinput, which we do not use, and borg already runs v7 on the same OS set.persist-credentials: falseon all checkouts. Nothing here pushes, so the token has no reason to sit in the workspace.git/config. Inrelease.ymlthat is the medium finding: the token was in the workspace while the sdist artifact got uploaded. That job talks to GitHub viaGH_TOKEN, not via git, so it does not care.run: toxinstead oftox -e ${{ matrix.toxenv }}. Not exploitable — the matrix values are literals in the workflow — but the job already exportsTOXENV, so the expansion was redundant anyway.concurrency:group for CI and Lint, same expression as borg. Pushing twice to a PR branch now cancels the older run instead of stacking up. Not a security thing, just runner time..github/dependabot.yml, same shape as borg's: weekly grouped updates for the actions (they need something to bump them now that they are hashes) and forrequirements.d, with a cooldown so a version that gets yanked right after release does not reach us.blackis excluded because its version lives in two places (requirements.d/codestyle.txtand thepsf/blackstep) and dependabot only sees one of them.zizmor --offline .github/workflows/is clean now. With--persona=auditorthree things remain, deliberately:concurrency-limitsonrelease.yml— that one is tag-triggered, cancelling a release build in flight is not what we want.anonymous-definitionon thelintandci_jobjobs — adding aname:renames the check runs, which would break any required-status-check configuration. Left alone.No functional change to what CI runs.