ci: Zizmor security hardening#212
Open
ndonkoHenri wants to merge 4 commits into
Open
Conversation
…abot Harden ci.yml to pass zizmor (49 findings -> 0): - Bump every action to its latest release as of today, then pin to commit SHA (with version comments for Dependabot): checkout v4->v6.0.3, setup-uv v6->v8.2.0, actions/cache v4->v5.0.5, simulator-action v4->v5, gradle/actions v3->v6.2.0, android-emulator-runner v2.37.0, subosito/flutter-action v2.23.0, flutter-fvm-config-action v3.3. - persist-credentials: false on all checkouts (no job pushes via git; publish only reads tags with git describe). - Least-privilege top-level permissions: contents: read (publish uses PUB_DEV_TOKEN, not GITHUB_TOKEN). - template-injection: move simulator UDID output into env:. - cache-poisoning: disable caching on tag/release refs only (per zizmor remediation) so branch/PR CI stays fast while release builds cannot restore a poisoned cache: setup-uv enable-cache and gradle cache-disabled gated on github.ref, AVD cache lookup-only on tags. Add .github/workflows/zizmor.yml (official zizmor-action on push/PR -> code scanning) and .github/dependabot.yml (github-actions, monthly, grouped, 7-day cooldown).
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s GitHub Actions configuration to satisfy zizmor security guidance (pinning actions by SHA, tightening token permissions, and mitigating injection/cache-poisoning findings) and adds automation for ongoing security analysis and dependency updates.
Changes:
- Hardened
.github/workflows/ci.ymlby pinning all actions to SHAs, settingpersist-credentials: false, adding top-levelpermissions: contents: read, and reducing injection risk by moving simulator UDID intoenv:. - Added
.github/workflows/zizmor.ymlto run zizmor and upload results to Code Scanning. - Added
.github/dependabot.ymlto group monthly GitHub Actions updates with a cooldown.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/zizmor.yml | New zizmor workflow for GitHub Actions security analysis + SARIF upload. |
| .github/workflows/ci.yml | CI workflow hardening: pinned actions, reduced permissions, safer env usage, cache-poisoning mitigations. |
| .github/dependabot.yml | Dependabot configuration for grouped monthly GitHub Actions updates. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Windows Image: windows-2025-vs2026 |
Fork PRs run with a read-only GITHUB_TOKEN (no security-events: write), so the code-scanning SARIF upload fails and reddens the check for external contributors. Gate advanced-security on the PR not being from a fork: forks still get inline annotations, while pushes and same-repo PRs upload to the Security tab.
Keep this PR focused on zizmor security hardening; Dependabot to be handled separately.
ndonkoHenri
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens
ci.ymlto pass zizmor (49 findings → 0) and adds ongoing automation.Hardening
persist-credentials: falseon all checkouts; top-levelpermissions: contents: read(publish usesPUB_DEV_TOKEN).env:.refs/tags/*builds (per zizmor remediation) — fast on branch/PR runs, safe on releases.Added
.github/workflows/zizmor.yml— runs zizmor on every push/PR → code scanning..github/dependabot.yml— github-actions, monthly, grouped, 7-day cooldown.