Skip to content

Commit cd7a124

Browse files
bogdandinaclaude
bogdandina
and
claude
committed
feat(79894): add zizmor workflow security audit and pin all action SHAs
Add a zizmor job to ci.yml that runs on every PR and push to main, auditing all workflow files for unpinned actions, template injection, excessive permissions, and other insecure patterns via zizmorcore/zizmor-action (SARIF results uploaded to GitHub Security tab). Pin every uses: reference across all four shared workflows to an immutable commit SHA with a human-readable version comment, eliminating the supply-chain risk of mutable tags being silently redirected to malicious commits. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 4e0f903 commit cd7a124

4 files changed

Lines changed: 50 additions & 35 deletions

File tree

‎.github/workflows/ci-cd-java.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
runs-on: ubuntu-latest
3838
steps:
3939
- name: Checkout
40-
uses: actions/checkout@v4
40+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
4141
with:
4242
clean: 'true'
4343
fetch-depth: 2
@@ -61,14 +61,14 @@ jobs:
6161
echo "shared_workflow_ref=${SHARED_WORKFLOW_REF}" >> "$GITHUB_OUTPUT"
6262
6363
- name: Checkout shared workflow scripts
64-
uses: actions/checkout@v4
64+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
6565
with:
6666
repository: HSLdevcom/transitdata-shared-workflows
6767
ref: ${{ steps.resolve_shared_workflow_ref.outputs.shared_workflow_ref }}
6868
path: .shared-workflows
6969

7070
- name: Setup JDK
71-
uses: actions/setup-java@v4
71+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
7272
with:
7373
distribution: 'temurin'
7474
java-version: '25'
@@ -134,15 +134,15 @@ jobs:
134134
run: mvn -B verify
135135

136136
- name: Upload coverage reports to Codecov
137-
uses: codecov/codecov-action@v5
137+
uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
138138
with:
139139
token: ${{ secrets.CODECOV_TOKEN }}
140140
fail_ci_if_error: true
141141
verbose: true
142142

143143
- name: Upload test results to Codecov
144144
if: ${{ !cancelled() }}
145-
uses: codecov/codecov-action@v5
145+
uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
146146
with:
147147
token: ${{ secrets.CODECOV_TOKEN }}
148148
fail_ci_if_error: true
@@ -156,7 +156,7 @@ jobs:
156156

157157
- name: Upload .jar artifact
158158
if: ${{ inputs.uploadJarArtifact }}
159-
uses: actions/upload-artifact@v4
159+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
160160
with:
161161
name: 'app.jar'
162162
path: '/app/app.jar'
@@ -174,7 +174,7 @@ jobs:
174174
echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
175175
176176
- name: Build Docker Image
177-
uses: docker/build-push-action@v6
177+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
178178
with:
179179
context: ${{ inputs.workingDirectory }}
180180
push: 'false'
@@ -201,7 +201,7 @@ jobs:
201201
- name: Extract Docker metadata
202202
if: ${{ env.PERFORM_RELEASE == 'true' }}
203203
id: meta
204-
uses: docker/metadata-action@v5
204+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
205205
with:
206206
images: ${{ env.IMAGE_NAME }}
207207
tags: |
@@ -214,24 +214,24 @@ jobs:
214214
215215
- name: Setup Docker Buildx
216216
if: ${{ env.PERFORM_RELEASE == 'true' }}
217-
uses: docker/setup-buildx-action@v3
217+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
218218

219219
- name: Login to Docker Hub
220220
if: ${{ env.PERFORM_RELEASE == 'true' }}
221-
uses: docker/login-action@v3
221+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
222222
with:
223223
username: ${{ secrets.DOCKER_HUB_INFODEVOPS_USERNAME }}
224224
password: ${{ secrets.DOCKER_HUB_INFODEVOPS_TOKEN }}
225225

226226
- name: Build & Push Docker image
227227
if: ${{ env.PERFORM_RELEASE == 'true' }}
228-
uses: docker/build-push-action@v6
228+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
229229
with:
230230
context: ${{ inputs.workingDirectory }}
231231
push: ${{ env.PERFORM_RELEASE }}
232232
tags: ${{ steps.meta.outputs.tags }}
233233
labels: ${{ steps.meta.outputs.labels }}
234234
secrets: |
235235
github_token=${{ secrets.GITHUB_TOKEN }}
236-
build-args: |
237-
GITHUB_ACTOR=${{ github.actor }}
236+
build-args: |
237+
GITHUB_ACTOR=${{ github.actor }}

‎.github/workflows/ci-cd-kotlin.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
runs-on: ubuntu-latest
4040
steps:
4141
- name: Checkout
42-
uses: actions/checkout@v4
42+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
4343
with:
4444
clean: 'true'
4545
fetch-depth: 2
@@ -62,14 +62,14 @@ jobs:
6262
echo "SHARED_WORKFLOW_REF=${SHARED_WORKFLOW_REF}" >> "$GITHUB_ENV"
6363
6464
- name: Checkout shared workflow scripts
65-
uses: actions/checkout@v4
65+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
6666
with:
6767
repository: HSLdevcom/transitdata-shared-workflows
6868
ref: ${{ env.SHARED_WORKFLOW_REF }}
6969
path: .shared-workflows
7070

7171
- name: Setup JDK
72-
uses: actions/setup-java@v4
72+
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
7373
with:
7474
distribution: 'temurin'
7575
java-version: '11'
@@ -126,23 +126,23 @@ jobs:
126126
run: ./gradlew test integrationTest jacocoTestReport --stacktrace
127127

128128
- name: Upload coverage reports to Codecov
129-
uses: codecov/codecov-action@v5
129+
uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
130130
with:
131131
token: ${{ secrets.CODECOV_TOKEN }}
132132
fail_ci_if_error: true
133133
verbose: true
134134

135135
- name: Upload test results to Codecov
136136
if: ${{ !cancelled() }}
137-
uses: codecov/codecov-action@v5
137+
uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
138138
with:
139139
token: ${{ secrets.CODECOV_TOKEN }}
140140
fail_ci_if_error: true
141141
report_type: test_results
142142

143143
- name: Upload .jar artifact
144144
if: ${{ inputs.uploadJarArtifact }}
145-
uses: actions/upload-artifact@v4
145+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
146146
with:
147147
name: ${{ inputs.jarArtifactName }}
148148
path: ${{ inputs.jarArtifactPath }}
@@ -157,7 +157,7 @@ jobs:
157157
run: |
158158
echo "IMAGE_NAME=${IMAGE_NAME_MIXED_CASE,,}" >> "${GITHUB_ENV}"
159159
- name: Build Docker Image
160-
uses: docker/build-push-action@v6
160+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
161161
with:
162162
context: .
163163
push: 'false'
@@ -179,12 +179,12 @@ jobs:
179179
180180
- name: Setup Docker Buildx
181181
if: env.PERFORM_RELEASE == 'true'
182-
uses: docker/setup-buildx-action@v3
182+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
183183

184184
- name: Extract Docker metadata
185185
if: env.PERFORM_RELEASE == 'true'
186186
id: meta
187-
uses: docker/metadata-action@v5
187+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
188188
with:
189189
images: ${{ env.IMAGE_NAME }}
190190
tags: |
@@ -197,14 +197,14 @@ jobs:
197197
198198
- name: Login to Docker Hub
199199
if: env.PERFORM_RELEASE == 'true'
200-
uses: docker/login-action@v3
200+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
201201
with:
202202
username: ${{ secrets.DOCKER_HUB_INFODEVOPS_USERNAME }}
203203
password: ${{ secrets.DOCKER_HUB_INFODEVOPS_TOKEN }}
204204

205205
- name: Build & Push Docker image
206206
if: env.PERFORM_RELEASE == 'true'
207-
uses: docker/build-push-action@v6
207+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
208208
with:
209209
context: .
210210
push: ${{ env.PERFORM_RELEASE }}

‎.github/workflows/ci-cd-typescript.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,13 @@ jobs:
3232
runs-on: ubuntu-latest
3333
steps:
3434
- name: Checkout
35-
uses: actions/checkout@v4
35+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3636
with:
3737
clean: 'true'
3838
fetch-depth: 2
3939

4040
- name: Install Node
41-
uses: actions/setup-node@v4
41+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
4242
with:
4343
node-version: "lts/*"
4444
cache: "npm"
@@ -51,15 +51,15 @@ jobs:
5151
run: npm run check-and-build
5252

5353
- name: Upload coverage reports to Codecov
54-
uses: codecov/codecov-action@v5
54+
uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
5555
with:
5656
token: ${{ secrets.CODECOV_TOKEN }}
5757
fail_ci_if_error: true
5858
verbose: true
5959

6060
- name: Upload test results to Codecov
6161
if: ${{ !cancelled() }}
62-
uses: codecov/codecov-action@v5
62+
uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
6363
with:
6464
token: ${{ secrets.CODECOV_TOKEN }}
6565
fail_ci_if_error: true
@@ -85,7 +85,7 @@ jobs:
8585
8686
- name: Extract docker metadata
8787
id: meta
88-
uses: docker/metadata-action@v5
88+
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
8989
with:
9090
images: ${{ env.IMAGE_NAME }}
9191
tags: |
@@ -97,11 +97,11 @@ jobs:
9797
9898
- name: Setup Docker Buildx
9999
if: env.PERFORM_RELEASE == 'true'
100-
uses: docker/setup-buildx-action@v3
100+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
101101

102102
- name: Build and export to Docker
103103
if: ${{ inputs.checkAndTestInsideDocker }}
104-
uses: docker/build-push-action@v6
104+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
105105
with:
106106
context: .
107107
load: true
@@ -115,14 +115,14 @@ jobs:
115115
116116
- name: Login to Docker Hub
117117
if: env.PERFORM_RELEASE == 'true'
118-
uses: docker/login-action@v3
118+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
119119
with:
120120
username: ${{ secrets.DOCKER_HUB_INFODEVOPS_USERNAME }}
121121
password: ${{ secrets.DOCKER_HUB_INFODEVOPS_TOKEN }}
122122

123123
- name: Build and push
124124
if: env.PERFORM_RELEASE == 'true'
125-
uses: docker/build-push-action@v6
125+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
126126
with:
127127
context: .
128128
push: true

‎.github/workflows/ci.yml‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- name: Checkout
18-
uses: actions/checkout@v4
18+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
1919

2020
- name: Setup Python
21-
uses: actions/setup-python@v5
21+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
2222
with:
2323
python-version: '3.x'
2424

@@ -27,3 +27,18 @@ jobs:
2727

2828
- name: Run script tests
2929
run: pytest scripts/ -v
30+
31+
zizmor:
32+
name: Workflow security audit (zizmor)
33+
runs-on: ubuntu-latest
34+
permissions:
35+
contents: read
36+
security-events: write
37+
steps:
38+
- name: Checkout
39+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
40+
with:
41+
persist-credentials: false
42+
43+
- name: Run zizmor
44+
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3

0 commit comments

Comments
 (0)