Skip to content

gh-actions: improve security with zizmor linter#11000

Open
maennchen wants to merge 9 commits intoerlang:masterfrom
maennchen:gh-actions-imp
Open

gh-actions: improve security with zizmor linter#11000
maennchen wants to merge 9 commits intoerlang:masterfrom
maennchen:gh-actions-imp

Conversation

@maennchen
Copy link
Copy Markdown
Contributor

@maennchen maennchen commented Apr 10, 2026 •
edited
Loading

Add security improvements to GitHub Actions workflows based on findings from zizmor, a GitHub Actions security linter.

Please review the individual commits for details on each change:

  • Add persist-credentials: false to checkout steps
  • Use environment variables in run blocks instead of direct template interpolation
  • Document workflow_run trigger safety in pr-comment.yaml
  • Add zizmor config to disable obfuscation rule for Windows CMD
  • Ignore secrets-inherit for internal trusted workflow
  • Replace softprops/action-gh-release with gh CLI
  • Disable secrets-outside-env rule (TODO: add dedicated environments)
  • Fix version comment mismatches
  • Add zizmor job to CI

Similar changes have already been applied to:

I would recommend also adding them to "Require code scanning results" in your PR Branch Rulesets in the GitHub Settings.

@github-advanced-security
Copy link
Copy Markdown

github-advanced-security AI commented Apr 10, 2026

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026 •
edited
Loading

CT Test Results

  1 files   11 suites   3m 25s ⏱️
 95 tests  91 ✅ 4 💤 0 ❌
111 runs  107 ✅ 4 💤 0 ❌

Results for commit d29fee8.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

@maennchen maennchen force-pushed the gh-actions-imp branch 3 times, most recently from 1af5fd6 to b61dcd0 Compare April 10, 2026 18:25
@rickard-green rickard-green added team:VM Assigned to OTP team VM team:PS Assigned to OTP team PS labels Apr 13, 2026
@Whaileee
Copy link
Copy Markdown
Contributor

Whaileee commented Apr 13, 2026

Thanks for this improvement! Looks good, I have just one small nitpick. Is there a reason you put env blocks after some of the run blocks? I know some of these are already like that, but for new ones, I think it would be better to place them before the stuff that gets executed.

Best regards,
Konrad

@maennchen
Copy link
Copy Markdown
Contributor Author

maennchen commented Apr 13, 2026

@Whaileee I have not given it any thought. I usually put them after. I'll amend the commit so they're always before.

@maennchen maennchen marked this pull request as draft April 13, 2026 11:52
@maennchen
gh-actions: add persist-credentials: false to checkout steps
d5f606d 
Prevent credential persistence through GitHub Actions artifacts by
setting persist-credentials: false on actions/checkout steps.

The renovate-vendored-deps workflow is excluded because it needs
credentials for git push operations.

See: https://docs.zizmor.sh/audits/#artipacked
@maennchen
gh-actions: use environment variables in run blocks
e9754e8 
Pass template expressions through environment variables instead of
direct interpolation in run blocks to improve static analysis.

See: https://docs.zizmor.sh/audits/#template-injection
@maennchen
gh-actions: document workflow_run trigger safety
b578782 
workflow_run is required to comment on PRs from forks with write
permissions. Document why this is safe and warn about future changes.

See: https://docs.zizmor.sh/audits/#dangerous-triggers
@maennchen
gh-actions: add zizmor config to disable misfeature rule
f863767 
Windows CMD shell is needed to test Windows-specific behavior.

See: https://docs.zizmor.sh/audits/#misfeature
@maennchen
gh-actions: ignore secrets-inherit for internal workflow
36620f4 
See: https://docs.zizmor.sh/audits/#secrets-inherit
@maennchen
gh-actions: replace softprops/action-gh-release with gh CLI
046d85e 
Use the built-in gh CLI instead of a third-party action.

See: https://docs.zizmor.sh/audits/#superfluous-actions
@maennchen
gh-actions: disable secrets-outside-env rule in zizmor
5515472 
TODO: Add dedicated environments for secrets used in cross-repo
triggers and bot authentication.

See: https://docs.zizmor.sh/audits/#secrets-outside-env
@maennchen
gh-actions: fix version comment mismatches
0d62753 
Update version comments to match the actual commit SHA tags.

See: https://docs.zizmor.sh/audits/#ref-version-mismatch
@maennchen
gh-actions: add zizmor security linter job
d29fee8 
Zizmor is a GitHub Actions security linter.

See: https://docs.zizmor.sh/
@maennchen maennchen marked this pull request as ready for review April 13, 2026 12:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kikofernandez kikofernandez kikofernandez approved these changes

@Whaileee Whaileee Whaileee approved these changes

Assignees

@kikofernandez kikofernandez

@Whaileee Whaileee

Labels

team:PS Assigned to OTP team PS team:VM Assigned to OTP team VM

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@maennchen @github-advanced-security @Whaileee @kikofernandez @rickard-green