What is the problem or limitation you are having?
zizmor is a useful tool for performing a static analysis of GitHub actions configurations, auditing for common security issues and related problems. It can be run standalone, but it can also be integrated into pre-commit.
Describe the solution you'd like
We should add zizmor to this project's pre-commit pipeline.
This will require fixing any issues that zizmor identifies with the existing Github actions configuration. Zizmor is able to automatically fix many problem, and it is able to make suggestions about other fixes. However, there are some problems where investigation and a manual fix will be required.
Zimor was recently added to the .github repository (see beeware/.github#378). That pull request may be instructive for how to add a zizmor configuration, the types of problems that Zizmor reports, and the fixes for those problems. The most invasive fixes are:
unpinned-uses - this requires providing a full hash for a reference to a GitHub Action, rather than just a version number. These hashes must be manually determined.template-injection - Use of ${{ }} syntax is a possible vector for security issues because the content isn't escaped; instead of using direct variable substitution, it is necessary to proxy GitHub variables through environment variables.
However, zizmor may find other problems; they should all be resolved.
Describe alternatives you've considered
No real alternative.
Additional context
Skipping rules, excluding files, or raising the minimum report level should not be considered unless absolutely necessary. A member of the core team can advise if you believe you have found a situation that requires an exclusion of this kind; post a comment on this ticket, or ask on Discord if you believe a rule cannot be satisfied.
What is the problem or limitation you are having?
zizmor is a useful tool for performing a static analysis of GitHub actions configurations, auditing for common security issues and related problems. It can be run standalone, but it can also be integrated into pre-commit.
Describe the solution you'd like
We should add zizmor to this project's pre-commit pipeline.
This will require fixing any issues that zizmor identifies with the existing Github actions configuration. Zizmor is able to automatically fix many problem, and it is able to make suggestions about other fixes. However, there are some problems where investigation and a manual fix will be required.
Zimor was recently added to the
.githubrepository (see beeware/.github#378). That pull request may be instructive for how to add a zizmor configuration, the types of problems that Zizmor reports, and the fixes for those problems. The most invasive fixes are:unpinned-uses- this requires providing a full hash for a reference to a GitHub Action, rather than just a version number. These hashes must be manually determined.template-injection- Use of${{ }}syntax is a possible vector for security issues because the content isn't escaped; instead of using direct variable substitution, it is necessary to proxy GitHub variables through environment variables.However, zizmor may find other problems; they should all be resolved.
Describe alternatives you've considered
No real alternative.
Additional context
Skipping rules, excluding files, or raising the minimum report level should not be considered unless absolutely necessary. A member of the core team can advise if you believe you have found a situation that requires an exclusion of this kind; post a comment on this ticket, or ask on Discord if you believe a rule cannot be satisfied.