Background
PR #21127 added zizmor to the lint job. Running it revealed pre-existing security findings across many QA and CD workflow files. These are suppressed in .github/zizmor.yml for now so CI stays green; this issue tracks fixing them properly.
template-injection (code injection via template expansion)
${{ ... }} expressions used directly in run: blocks instead of going through env: vars. Most are github.ref, github.ref_name, runner.name, github.workspace (low risk — GitHub-controlled) but some are github.event.inputs.* (user-controlled, higher risk).
| File |
Lines |
| backups-dashboards.yml |
107, 111 |
| ci-cd-main-branch-docker-images.yml |
56, 128 |
| ci-gate.yml |
110 (toJSON(needs) — false positive) |
| qa-clean-exit-block-downloading.yml |
91 |
| qa-clean-exit-snapshot-downloading.yml |
99 |
| qa-constrained-tip-tracking.yml |
150 |
| qa-rpc-integration-tests-clients.yml |
96 |
| qa-rpc-integration-tests-gnosis.yml |
52, 54, 119, 162 |
| qa-rpc-integration-tests-latest.yml |
50, 52, 187, 242 |
| qa-rpc-integration-tests-polygon.yml |
181 |
| qa-rpc-integration-tests-remote.yml |
46, 48, 184, 259 |
| qa-rpc-integration-tests.yml |
52, 54, 120, 163 |
| qa-rpc-performance-comparison-tests.yml |
110, 112, 339, 408 |
| qa-rpc-performance-tests.yml |
101, 103, 317 |
| qa-snap-download.yml |
88 |
| qa-stage-exec.yml |
40, 42, 116 |
| qa-sync-from-scratch-minimal-node.yml |
91 |
| qa-sync-from-scratch.yml |
116, 197 |
| qa-sync-with-externalcl.yml |
108 |
| qa-tip-tracking-gnosis.yml |
33, 35, 153 |
| qa-tip-tracking-with-load.yml |
242 |
| qa-tip-tracking.yml |
33, 35, 153 |
| qa-txpool-performance-test.yml |
256 |
Fix: Route each expression through an env: block. Example:
env:
REF_NAME: ${{ github.ref_name }}
run: |
echo "Branch: $REF_NAME"cache-poisoning (artipacked)
Docker-layer or artifact caching that could be poisoned:
| File |
Line |
| manifest.yml |
40 |
| qa-rpc-integration-tests-gnosis.yml |
78 |
| qa-rpc-integration-tests.yml |
78 |
| qa-sync-from-scratch.yml |
148 |
| test-kurtosis-assertoor.yml |
83 |
excessive-permissions
ci-gate.yml:33 — actions: write at workflow level (intentional: needed for merge-queue sibling cancellation)
Resolution
Once fixed, remove the corresponding entries from .github/zizmor.yml so zizmor enforces the rule going forward.
Background
PR #21127 added zizmor to the lint job. Running it revealed pre-existing security findings across many QA and CD workflow files. These are suppressed in
.github/zizmor.ymlfor now so CI stays green; this issue tracks fixing them properly.template-injection (code injection via template expansion)
${{ ... }}expressions used directly inrun:blocks instead of going throughenv:vars. Most aregithub.ref,github.ref_name,runner.name,github.workspace(low risk — GitHub-controlled) but some aregithub.event.inputs.*(user-controlled, higher risk).toJSON(needs)— false positive)Fix: Route each expression through an
env:block. Example:cache-poisoning (artipacked)
Docker-layer or artifact caching that could be poisoned:
excessive-permissions
ci-gate.yml:33—actions: writeat workflow level (intentional: needed for merge-queue sibling cancellation)Resolution
Once fixed, remove the corresponding entries from
.github/zizmor.ymlso zizmor enforces the rule going forward.