Skip to content

ci: add zizmor and fix GHA security findings#2632

Merged
theakshaypant merged 1 commit intotektoncd:mainfrom
theakshaypant:fix-zizmor-gha-security
Apr 8, 2026
Merged

ci: add zizmor and fix GHA security findings#2632
theakshaypant merged 1 commit intotektoncd:mainfrom
theakshaypant:fix-zizmor-gha-security

Conversation

@theakshaypant
Copy link
Copy Markdown
Member

@theakshaypant theakshaypant commented Apr 2, 2026 •
edited
Loading

📝 Description of the Change

Add zizmor linter step to the Tekton linter pipeline and a
.github/zizmor.yml config to suppress false positives for e2e.yaml.

Fix expression injection in container.yaml by replacing
${{ github.ref_name }} and ${{ github.ref }} with env vars in run
scripts. Add persist-credentials: false to all checkout steps and
minimal permissions blocks to e2e-tests and notify-slack jobs.

Move secrets from $GITHUB_ENV writes to step-level env blocks and
use step outputs instead of $GITHUB_ENV for smee URLs.

Results

  • Before: 80 findings (13 suppressed, 11 fixable): 2 informational, 0 low, 55 medium, 10 high
  • After: No findings to report. Good job! (50 ignored, 15 suppressed)

🔗 Linked GitHub Issue

Fixes #2613

🧪 Testing Strategy

  • Unit tests
  • Integration tests
  • End-to-end tests
  • Manual testing
  • Not Applicable

🤖 AI Assistance

AI assistance can be used for various tasks, such as code generation,
documentation, or testing.

Please indicate whether you have used AI assistance
for this PR and provide details if applicable.

  • I have not used any AI assistance for this PR.
  • I have used AI assistance for this PR.

Important

Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Claude noreply@anthropic.com

✅ Submitter Checklist

  • 📝 My commit messages are clear, informative, and follow the project's How to write a git commit message guide. The Gitlint linter ensures in CI it's properly validated
  • ✨ I have ensured my commit message prefix (e.g., fix:, feat:) matches the "Type of Change" I selected above.
  • ♽ I have run make test and make lint locally to check for and fix any
    issues. For an efficient workflow, I have considered installing
    pre-commit and running pre-commit install to
    automate these checks.
  • 📖 I have added or updated documentation for any user-facing changes.
  • 🧪 I have added sufficient unit tests for my code changes.
  • 🎁 I have added end-to-end tests where feasible. See README for more details.
  • 🔎 I have addressed any CI test flakiness or provided a clear reason to bypass it.
  • If adding a provider feature, I have filled in the following and updated the provider documentation:
    • GitHub App
    • GitHub Webhook
    • Gitea/Forgejo
    • GitLab
    • Bitbucket Cloud
    • Bitbucket Data Center

@gemini-code-assist
Copy link
Copy Markdown

gemini-code-assist bot commented Apr 2, 2026

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

@github-advanced-security
Copy link
Copy Markdown

github-advanced-security bot commented Apr 2, 2026

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@theakshaypant theakshaypant force-pushed the fix-zizmor-gha-security branch from faef6dc to 358b020 Compare April 2, 2026 06:13
@theakshaypant
Copy link
Copy Markdown
Member Author

theakshaypant commented Apr 2, 2026

Do not have permission to configure env in the repo :/

zakisk
zakisk reviewed Apr 2, 2026
View reviewed changes
@chmouel
Copy link
Copy Markdown
Member

chmouel commented Apr 2, 2026 •
edited
Loading

ah i didn't see this as i started as well, you can pickup that change that add it in linter.yaml i guess instead of using a GHA for that (which we try to avoid, we rather use pac and it consumes GHA org resources)

main...chmouel:pipelines-as-code:zizmor?expand=1#diff-b571c90d1a

@theakshaypant theakshaypant force-pushed the fix-zizmor-gha-security branch from 358b020 to 1730c79 Compare April 2, 2026 11:29
@theakshaypant
Copy link
Copy Markdown
Member Author

theakshaypant commented Apr 6, 2026

/retest linters

@theakshaypant @chmouel
ci(gha): fix zizmor security findings in workflows
a5d1cf1 
Add zizmor linter step to the Tekton linter pipeline and a
.github/zizmor.yml config to suppress false positives for e2e.yaml.

Fix expression injection in container.yaml by replacing
${{ github.ref_name }} and ${{ github.ref }} with env vars in run
scripts. Add persist-credentials: false to all checkout steps and
minimal permissions blocks to e2e-tests and notify-slack jobs.

Move secrets from $GITHUB_ENV writes to step-level env blocks and
use step outputs instead of $GITHUB_ENV for smee URLs.

Co-authored-by: Chmouel Boudjnah <chmouel@redhat.com>
Signed-off-by: Akshay Pant <akpant@redhat.com>
@theakshaypant theakshaypant force-pushed the fix-zizmor-gha-security branch from 1730c79 to a5d1cf1 Compare April 6, 2026 06:42
@theakshaypant theakshaypant marked this pull request as ready for review April 6, 2026 07:14
@theakshaypant
Copy link
Copy Markdown
Member Author

theakshaypant commented Apr 6, 2026

ah i didn't see this as i started as well, you can pickup that change that add it in linter.yaml i guess instead of using a GHA for that (which we try to avoid, we rather use pac and it consumes GHA org resources)

main...chmouel:pipelines-as-code:zizmor?expand=1#diff-b571c90d1a

Incorporated these changes in a5d1cf1

@chmouel
Copy link
Copy Markdown
Member

chmouel commented Apr 7, 2026 •
edited
Loading

were you able to test the change on your fork? feel to merge it but if it breaks stuff be ready to revert it quickly

chmouel
chmouel approved these changes Apr 7, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@chmouel chmouel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@theakshaypant
Copy link
Copy Markdown
Member Author

theakshaypant commented Apr 8, 2026

were you able to test the change on your fork? feel to merge it but if it breaks stuff be ready to revert it quickly

Yes, tested the zizmor step, linters pr will fail listing the issues with the workflow
Attaching a screenshot for reference.

image

@theakshaypant theakshaypant merged commit d78ef4e into tektoncd:main Apr 8, 2026
12 checks passed
@theakshaypant theakshaypant deleted the fix-zizmor-gha-security branch April 8, 2026 01:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zakisk zakisk zakisk left review comments

@chmouel chmouel chmouel approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ci: Run zizmor on GitHub Actions and fix security findings

4 participants

@theakshaypant @github-advanced-security @chmouel @zakisk