Add Zizmor - Pin commit hashes in GitHub Actions (#31)

* chore: update GitHub Actions to use specific commit hashes for actions
* Update pytest dependency to version 9.0.3 in pyproject.toml
* chore: update GitHub Actions to use specific version tags for actions
* chore: update actions/cache to version 6.0.0 in deploy_mkdocs.yml
* chore: set Git remote URL with access token in deploy_mkdocs.yml
* chore: update deployment branches in deploy_mkdocs.yml to remove master and specific feature branch

Author: mwirikia

.github/workflows/ci.yml

@@ -18,12 +18,14 @@ jobs:
     name: Lint and Test
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
+        with:
+          persist-credentials: false
       - name: Install Poetry
         run: pipx install poetry==1.8.3
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
         with:
           python-version-file: .python-version
           cache: poetry

.github/workflows/deploy_mkdocs.yml

@@ -4,24 +4,26 @@ name: Deploy MkDocs
 on:
   push:
     branches:
-      - master
       - main
 permissions:
   contents: write
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
+        with:
+          persist-credentials: false
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-      - uses: actions/setup-python@v5
+          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
         with:
           python-version: 3.x
       - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-      - uses: actions/cache@v4
+      - uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           key: mkdocs-material-${{ env.cache_id }}
           path: .cache

.github/workflows/mega-linter.yml

@@ -66,9 +66,10 @@ jobs:
     steps:
       # Git Checkout
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
         with:
           token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
+          persist-credentials: false
 
           # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
           # improve performance
@@ -85,8 +86,8 @@ jobs:
 
         # You can override MegaLinter flavor used to have faster performances
         # More info at https://megalinter.io/latest/flavors/
-        # The below commit hash is v8.8.0
-        uses: oxsecurity/megalinter@e08c2b05e3dbc40af4c23f41172ef1e068a7d651
+        # The below commit hash is v9.5.0
+        uses: oxsecurity/megalinter@0e3ce9b9c8c10effb9b269509cc47ca17cae31c7
 
         id: ml
 
@@ -114,7 +115,7 @@ jobs:
 
       # Upload MegaLinter artifacts
       - name: Archive production artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: success() || failure()
         with:
           name: MegaLinter reports
@@ -159,8 +160,11 @@ jobs:
           ) &&
           !contains(github.event.head_commit.message, 'skip fix')
         run: |
-          echo "PR Number - ${{ steps.cpr.outputs.pull-request-number }}"
-          echo "PR URL - ${{ steps.cpr.outputs.pull-request-url }}"
+          echo "PR Number - ${PR_NUMBER}"
+          echo "PR URL - ${PR_URL}"
+        env:
+          PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
+          PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
 
       # Push new commit if applicable
       # (for now works only on PR from same repository, not from forks)

.mega-linter.yml

@@ -40,6 +40,9 @@ DISABLE_LINTERS:
 
 SHOW_ELAPSED_TIME: true
 
+ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
+  - GITHUB_TOKEN
+
 FILEIO_REPORTER: false
 # Uncomment if you want MegaLinter to detect errors but not block CI to pass
 # DISABLE_ERRORS: true

concourse/scripts/terraform_infra.sh

@@ -25,6 +25,7 @@ lambda_memory=$(echo "$secrets" | jq -r .lambda_memory)
 export AWS_ACCESS_KEY_ID="$aws_access_key_id"
 export AWS_SECRET_ACCESS_KEY="$aws_secret_access_key"
 
+# kingfisher:ignore
 git config --global url."https://x-access-token:$github_access_token@github.com/".insteadOf "https://github.com/"
 
 if [ "${env}" != "prod" ]; then