fix: upgrade upload-pages-artifact to v4 and add zizmor workflow linting#299
fix: upgrade upload-pages-artifact to v4 and add zizmor workflow linting#299
Conversation
- Upgrade actions/upload-pages-artifact from v3 to v4 (SHA 7b1f4a764d45) — v4 SHA-pins its internal actions/upload-artifact dependency, fixing the sha_pinning_required conflict where composite action internals used tag references (actions/upload-artifact@v4) - Add zizmor workflow security analysis on workflow file changes — catches unpinned actions, script injection, excessive permissions, and other GitHub Actions security issues via SARIF upload Closes #299
Add FOUND flag to update-release retry loop so exhaustion surfaces a clear error instead of falling through to a confusing gh release edit failure (Greptile PR #298 finding).
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
📝 WalkthroughSummary by CodeRabbit
WalkthroughThree GitHub Actions workflow files are modified: Docker workflow now includes bounded retry verification (6 attempts) for GitHub release existence with explicit error handling, Pages workflow upgraded to use newer upload-pages-artifact action version, and a new Zizmor workflow added for workflow security scanning. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
Greptile SummaryThis PR addresses a post-merge Pages deployment breakage caused by
Confidence Score: 5/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant GH as GitHub Events
participant ZW as zizmor.yml Workflow
participant ZA as zizmorcore/zizmor-action
participant ST as Security Tab (SARIF)
participant PR as PR Annotations
GH->>ZW: push to main (workflow files changed)
ZW->>ZA: checkout + run zizmor (advanced-security=true)
ZA->>ST: upload SARIF results
GH->>ZW: pull_request to main (workflow files changed)
ZW->>ZA: checkout + run zizmor (advanced-security=false)
ZA->>PR: annotate PR with findings (no SARIF upload)
GH->>ZW: workflow_dispatch (manual)
ZW->>ZA: checkout + run zizmor (advanced-security=true)
ZA->>ST: upload SARIF results
Last reviewed commit: 5bf6876 |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/zizmor.yml:
- Around line 28-29: Add a manual trigger to the CI by adding a
workflow_dispatch event to the zizmor workflow so it can be run on-demand;
update the triggers section in .github/workflows/zizmor.yml (where the existing
event configuration for the zizmor job and the use of the action
zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 is defined) to
include workflow_dispatch alongside the current triggers.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: ccf4e34f-50e5-49c3-8f9d-470b925e3ea2
📒 Files selected for processing (3)
.github/workflows/docker.yml.github/workflows/pages.yml.github/workflows/zizmor.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Agent
- GitHub Check: Greptile Review
🧰 Additional context used
📓 Path-based instructions (3)
.github/workflows/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
CI pipeline: lint (ruff) + type-check (mypy src/ tests/) + test (pytest + coverage) run in parallel → ci-pass gate. Coverage enforced at 80% minimum.
Files:
.github/workflows/pages.yml.github/workflows/zizmor.yml.github/workflows/docker.yml
.github/workflows/pages.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Pages workflow (.github/workflows/pages.yml) builds Astro landing + MkDocs docs, merges, deploys to GitHub Pages on push to main.
Files:
.github/workflows/pages.yml
.github/workflows/docker.yml
📄 CodeRabbit inference engine (CLAUDE.md)
.github/workflows/docker.yml: Docker workflow (.github/workflows/docker.yml) builds backend + web images, pushes to GHCR, signs with cosign. Scans: Trivy (CRITICAL = hard fail, HIGH = warn-only) + Grype (critical cutoff). CVE triage via .github/.trivyignore.yaml and .github/.grype.yaml. Images only pushed after scans pass. Triggers on push to main and version tags (v*).
Docker CI tags images with version from pyproject.toml ([tool.commitizen].version), semver, and SHA.
Files:
.github/workflows/docker.yml
🧠 Learnings (4)
📓 Common learnings
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/workflows/docker.yml : Docker workflow (.github/workflows/docker.yml) builds backend + web images, pushes to GHCR, signs with cosign. Scans: Trivy (CRITICAL = hard fail, HIGH = warn-only) + Grype (critical cutoff). CVE triage via .github/.trivyignore.yaml and .github/.grype.yaml. Images only pushed after scans pass. Triggers on push to main and version tags (v*).
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/workflows/release.yml : Release workflow (.github/workflows/release.yml) uses Release Please (Google) to auto-create a release PR on every push to main. Merging the release PR creates a git tag (vX.Y.Z) + GitHub Release with changelog. Tag push triggers Docker workflow for version-tagged images. Uses RELEASE_PLEASE_TOKEN secret (PAT/GitHub App token). Config in .github/release-please-config.json and .github/.release-please-manifest.json.
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/workflows/pages.yml : Pages workflow (.github/workflows/pages.yml) builds Astro landing + MkDocs docs, merges, deploys to GitHub Pages on push to main.
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/dependabot.yml : Dependabot auto-updates uv + github-actions + docker dependencies daily with grouped minor/patch updates, no auto-merge.
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/workflows/docker.yml : Docker CI tags images with version from pyproject.toml ([tool.commitizen].version), semver, and SHA.
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/workflows/*.yml : CI pipeline: lint (ruff) + type-check (mypy src/ tests/) + test (pytest + coverage) run in parallel → ci-pass gate. Coverage enforced at 80% minimum.
📚 Learning: 2026-03-11T14:50:09.256Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/workflows/pages.yml : Pages workflow (.github/workflows/pages.yml) builds Astro landing + MkDocs docs, merges, deploys to GitHub Pages on push to main.
Applied to files:
.github/workflows/pages.yml.github/workflows/zizmor.yml
📚 Learning: 2026-03-11T14:50:09.256Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/workflows/docker.yml : Docker workflow (.github/workflows/docker.yml) builds backend + web images, pushes to GHCR, signs with cosign. Scans: Trivy (CRITICAL = hard fail, HIGH = warn-only) + Grype (critical cutoff). CVE triage via .github/.trivyignore.yaml and .github/.grype.yaml. Images only pushed after scans pass. Triggers on push to main and version tags (v*).
Applied to files:
.github/workflows/zizmor.yml.github/workflows/docker.yml
📚 Learning: 2026-03-11T14:50:09.256Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-11T14:50:09.256Z
Learning: Applies to .github/workflows/release.yml : Release workflow (.github/workflows/release.yml) uses Release Please (Google) to auto-create a release PR on every push to main. Merging the release PR creates a git tag (vX.Y.Z) + GitHub Release with changelog. Tag push triggers Docker workflow for version-tagged images. Uses RELEASE_PLEASE_TOKEN secret (PAT/GitHub App token). Config in .github/release-please-config.json and .github/.release-please-manifest.json.
Applied to files:
.github/workflows/zizmor.yml.github/workflows/docker.yml
🔇 Additional comments (3)
.github/workflows/docker.yml (1)
299-311: LGTM — explicit failure on retry exhaustion.The
FOUNDflag correctly surfaces a clear error when the release is unavailable after 6 attempts, preventing the previous confusing fallthrough togh release editwith empty content. The logic properly initializesFOUND=0, sets it to1only on success, and exits with an actionable error message if exhausted..github/workflows/zizmor.yml (1)
1-14: LGTM — well-structured security workflow.Good security posture with empty top-level permissions and appropriately scoped job-level permissions. Triggering on workflow file changes ensures CI-level enforcement of security checks.
.github/workflows/pages.yml (1)
75-75: LGTM — SHA pin verified for v4.The upgrade to
actions/upload-pages-artifact@v4with SHA7b1f4a764d45c48632c6b24a0339c27f5614fb0bis correct. This change resolves thesha_pinning_requiredconflict and aligns with GitHub Actions best practices. The workflow correctly builds and merges Astro landing pages with MkDocs documentation before deployment.
| - name: Run zizmor | ||
| uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify SHA 71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 is tagged as v0.5.2
gh api repos/zizmorcore/zizmor-action/git/ref/tags/v0.5.2 --jq '.object.sha'Repository: Aureliolo/synthorg
Length of output: 222
🏁 Script executed:
cat -n .github/workflows/zizmor.ymlRepository: Aureliolo/synthorg
Length of output: 862
🌐 Web query:
zizmor-action v0.5.2 release SHA 71321a20a9ded102f6e9ce5718a2fcec2c4f70d8
💡 Result:
71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 is the commit that the zizmorcore/zizmor-action v0.5.2 release/tag points to (short SHA 71321a2). [1]
That commit is titled “Sync zizmor versions (#96)” and updates the action’s bundled/“latest” zizmor version to 1.23.1. [1][2]
SHA is correctly pinned to v0.5.2; consider adding workflow_dispatch for manual security scans.
The SHA-pinned action reference correctly follows repository conventions. Adding workflow_dispatch trigger would enable manual runs when needed (e.g., after zizmor rule updates), since the workflow currently only runs on workflow file changes.
💡 Optional: Add workflow_dispatch trigger
on:
push:
branches: [main]
paths:
- ".github/workflows/**"
pull_request:
branches: [main]
paths:
- ".github/workflows/**"
+ workflow_dispatch:🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/zizmor.yml around lines 28 - 29, Add a manual trigger to
the CI by adding a workflow_dispatch event to the zizmor workflow so it can be
run on-demand; update the triggers section in .github/workflows/zizmor.yml
(where the existing event configuration for the zizmor job and the use of the
action zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 is
defined) to include workflow_dispatch alongside the current triggers.
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s GitHub Actions workflows to comply with strict SHA pinning policies and to improve workflow security validation in CI.
Changes:
- Upgrades
actions/upload-pages-artifactfrom v3 to v4 (pinned by SHA) in the Pages deployment workflow. - Adds a new
zizmorworkflow to lint GitHub Actions workflows for security issues. - Improves the Docker release workflow’s retry loop to fail with a clear error when the GitHub Release never becomes available.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/zizmor.yml | Adds a workflow-security job intended to run zizmor and (per PR description) upload SARIF results. |
| .github/workflows/pages.yml | Updates Pages artifact upload action to v4 (SHA-pinned) to resolve transitive pinning policy conflicts. |
| .github/workflows/docker.yml | Adds a FOUND flag and explicit failure to make release retry exhaustion clearer. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| pull_request: | ||
| branches: [main] | ||
| paths: | ||
| - ".github/workflows/**" | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| zizmor: | ||
| name: zizmor | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| security-events: write | ||
| contents: read | ||
| actions: read |
There was a problem hiding this comment.
pull_request workflows triggered from forks will receive a read-only GITHUB_TOKEN, so security-events: write (and SARIF upload) will fail in that context. Consider limiting SARIF upload to push on main (or gating the upload step on github.event_name == 'push') while still running the analysis on PRs, so external PRs don't fail spuriously.
| - name: Run zizmor | ||
| uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 |
There was a problem hiding this comment.
The PR description mentions uploading SARIF to the Security tab, but this workflow doesn't show any explicit SARIF upload step or inputs enabling upload; it relies on zizmorcore/zizmor-action defaults. To avoid silent drift if the action defaults change, consider making the SARIF upload behavior explicit (via documented with: options and/or a dedicated upload step).
…pilot - Document zizmor workflow in CLAUDE.md CI section - Add zizmor.yml to DESIGN_SPEC.md file tree - Add workflow_dispatch trigger for manual security scans (CodeRabbit) - Make SARIF upload explicit and conditional on push/dispatch events to prevent fork PR failures from read-only GITHUB_TOKEN (Copilot)
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the reliability and security of the CI/CD pipeline. It resolves a critical dependency pinning issue in GitHub Actions by upgrading a core component, and introduces a new static analysis workflow to proactively identify and mitigate security vulnerabilities within GitHub Actions workflows. Additionally, it improves the robustness of the release process by providing clearer failure indications. Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
🤖 I have created a release *beep* *boop* --- ## [0.1.1](v0.1.0...v0.1.1) (2026-03-11) ### Features * add PR preview deployments via Cloudflare Pages ([#302](#302)) ([b73c45a](b73c45a)) ### Bug Fixes * correct deploy-pages SHA and improve preview cleanup reliability ([#304](#304)) ([584d64a](584d64a)) * harden API key hashing with HMAC-SHA256 and clean up legacy changelog ([#292](#292)) ([5e85353](5e85353)) * upgrade upload-pages-artifact to v4 and add zizmor workflow linting ([#299](#299)) ([2eac571](2eac571)) * use Cloudflare Pages API default per_page for pagination ([#305](#305)) ([9fec245](9fec245)) ### Documentation * remove milestone references and rebrand to SynthOrg ([#289](#289)) ([57a03e0](57a03e0)) * set up documentation site, release CI, and sandbox hardening ([#298](#298)) ([0dec9da](0dec9da)) * split DESIGN_SPEC.md into 7 focused design pages ([#308](#308)) ([9ea0788](9ea0788)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Signed-off-by: Aurelio <19254254+Aureliolo@users.noreply.github.com>
Summary
actions/upload-pages-artifactv3 → v4 — v4.0.0 (PR #127) SHA-pins its internalactions/upload-artifactdependency, fixing thesha_pinning_requiredconflict where the composite action's tag reference (@v4) was rejected by the repo's Actions permissions policyzizmorworkflow security analysis — runs on workflow file changes (push to main + PRs), catches unpinned actions, script injection, excessive permissions, and uploads SARIF to the Security tabFOUNDflag so exhaustion surfaces a clear::error::instead of falling through to a confusinggh release editfailure (Greptile PR docs: set up documentation site, release CI, and sandbox hardening #298 finding)Context
After merging #298, the Pages workflow failed on main because
upload-pages-artifactv3 internally calledactions/upload-artifact@v4(tag, not SHA), violating the repo'ssha_pinning_required: truesetting. This is a known limitation with composite actions — GitHub enforces SHA pinning transitively but composite action authors don't always pin their internal deps. v4.0.0 fixed this upstream.The zizmor workflow provides CI-level enforcement of SHA pinning and other workflow security checks, complementing the repo-level
sha_pinning_requiredsetting.Test plan