Skip to content

Commit 94a6cd3

Browse files
stevebeattiestevebeattie
authored
fix(ci): resolve template injection and ref-version-mismatch findings (#1502)
* fix(ci): resolve template injection findings Move ${{ context }} expressions to env: variables to prevent shell injection. Refs: PSEC-923 * fix(ci): add pedantic persona and suppress noisy zizmor rules Add .github/zizmor.yml to configure dependabot cooldown and disable pedantic-only rules with no security value (anonymous-definition, undocumented-permissions, concurrency-limits). Switch zizmor CI to pedantic persona to catch all template expansions in run: blocks. Extend trigger paths to include .github/zizmor.yml and .github/dependabot.yml so config changes also run the check. Refs: PSEC-923 * fix(ci): add missing version comments to SHA-pinned action refs Resolves 6 ref-version-mismatch zizmor findings by annotating SHA-pinned action refs with their corresponding version: - chainguard-dev/actions@0cba302 (5 occurrences): add # main (this action tracks the rolling main branch; no semver tags are published) - dtolnay/rust-toolchain@e97e2d8: add # v1 Refs: PSEC-923
1 parent ba96e19 commit 94a6cd3

11 files changed

Lines changed: 45 additions & 18 deletions

File tree

‎.github/workflows/codeql.yaml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ jobs:
6666
ref: refs/tags/v${{ env.YARA_X_RELEASE }}
6767
- name: Install Rust for yara-x-capi
6868
if: steps.yara-x-capi.outputs.cache-hit != 'true'
69-
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
69+
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
7070
with:
7171
toolchain: stable
7272
- name: Cache Rust dependencies
@@ -80,16 +80,18 @@ jobs:
8080
restore-keys: rust-cargo-
8181
- name: Build yara-x-capi
8282
if: steps.yara-x-capi.outputs.cache-hit != 'true'
83+
env:
84+
WORKSPACE: ${{ github.workspace }}
8385
run: |
8486
command -v cargo-cinstall || cargo install cargo-c --locked
85-
cd ${{ github.workspace }}/yara-x
87+
cd "${WORKSPACE}/yara-x"
8688
RUSTFLAGS="-C target-feature=+crt-static" cargo cinstall -p yara-x-capi --features=native-code-serialization \
8789
--profile release-lto \
88-
--pkgconfigdir=${{ github.workspace }}/yara-x-install \
89-
--includedir=${{ github.workspace }}/yara-x-install \
90-
--libdir=${{ github.workspace }}/yara-x-install \
90+
--pkgconfigdir="${WORKSPACE}/yara-x-install" \
91+
--includedir="${WORKSPACE}/yara-x-install" \
92+
--libdir="${WORKSPACE}/yara-x-install" \
9193
--crt-static --library-type="staticlib"
92-
rm -rf ${{ github.workspace }}/yara-x
94+
rm -rf "${WORKSPACE}/yara-x"
9395
- name: Set up Go
9496
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
9597
with:

‎.github/workflows/digestabot.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
release-assets.githubusercontent.com:443
3737
tuf-repo-cdn.sigstore.dev:443
3838
39-
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d
39+
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d # main
4040

4141
- uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
4242
id: octo-sts

‎.github/workflows/fuzz.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ jobs:
125125
- name: Install dependencies
126126
run: |
127127
apk update
128-
apk add curl findutils git gnutar ${{ env.GO_RELEASE }} nodejs upx xz yara-x~${{ env.YARA_X_RELEASE }}
128+
apk add curl findutils git gnutar "${GO_RELEASE}" nodejs upx xz "yara-x~${YARA_X_RELEASE}"
129129
130130
- name: Checkout code
131131
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -170,6 +170,8 @@ jobs:
170170
# -parallel=1 is used for now due to this: https://github.com/golang/go/issues/56238
171171
- name: Run fuzzer - ${{ matrix.target.test }}
172172
env:
173+
FUZZ_TARGET: ${{ matrix.target.test }}
174+
FUZZ_PACKAGE: ${{ matrix.target.package }}
173175
FUZZ_TIME: ${{ inputs.fuzz_time || '30s' }}
174176
run: |
175-
go test -parallel=1 -timeout 0 -fuzz="^${{ matrix.target.test }}$" -fuzztime="${FUZZ_TIME}" "${{ matrix.target.package }}"
177+
go test -parallel=1 -timeout 0 -fuzz="^${FUZZ_TARGET}$" -fuzztime="${FUZZ_TIME}" "${FUZZ_PACKAGE}"

‎.github/workflows/go-tests.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
- name: Install dependencies
4242
run: |
4343
apk update
44-
apk add curl findutils git gnutar ${{ env.GO_RELEASE }} nodejs upx xz yara-x~${{ env.YARA_X_RELEASE }}
44+
apk add curl findutils git gnutar "${GO_RELEASE}" nodejs upx xz "yara-x~${YARA_X_RELEASE}"
4545
4646
- name: Checkout code
4747
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -92,7 +92,7 @@ jobs:
9292
- name: Install dependencies
9393
run: |
9494
apk update
95-
apk add curl findutils git gnutar ${{ env.GO_RELEASE }} nodejs upx xz yara-x~${{ env.YARA_X_RELEASE }}
95+
apk add curl findutils git gnutar "${GO_RELEASE}" nodejs upx xz "yara-x~${YARA_X_RELEASE}"
9696
9797
- name: Checkout code
9898
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/release.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
github.com:443
3030
octo-sts.dev:443
3131
release-assets.githubusercontent.com:443
32-
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d
32+
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d # main
3333
- name: Set up Octo-STS
3434
uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
3535
id: octo-sts

‎.github/workflows/style.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ jobs:
188188
- name: Install dependencies
189189
run: |
190190
apk update
191-
apk add curl findutils git ${{ env.GO_RELEASE }} nodejs yara-x~${{ env.YARA_X_RELEASE }}
191+
apk add curl findutils git "${GO_RELEASE}" nodejs "yara-x~${YARA_X_RELEASE}"
192192
193193
- name: Checkout code
194194
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/third-party.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ jobs:
4040
- name: Install dependencies
4141
run: |
4242
apk update
43-
apk add bash curl findutils gh git gnutar ${{ env.GO_RELEASE }} nodejs perl upx xz yara-x~${{ env.YARA_X_RELEASE }}
44-
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d
43+
apk add bash curl findutils gh git gnutar "${GO_RELEASE}" nodejs perl upx xz "yara-x~${YARA_X_RELEASE}"
44+
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d # main
4545
- name: Set up Octo-STS
4646
uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
4747
id: octo-sts

‎.github/workflows/update-yara-x.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ jobs:
4646
id: check
4747
env:
4848
GH_TOKEN: ${{ github.token }}
49+
REPOSITORY: ${{ github.repository }}
4950
run: |
5051
CURRENT=$(grep '^YARA_X_VERSION' Makefile | head -1 | sed 's/.*= *//')
5152
echo "Current version: ${CURRENT}"
@@ -68,7 +69,7 @@ jobs:
6869
6970
# Skip if there is already an open PR for this version
7071
VERSION="${LATEST#v}"
71-
EXISTING=$(gh pr list --repo "${{ github.repository }}" --head "bump-yara-x-${VERSION}" --state open --json number --jq 'length')
72+
EXISTING=$(gh pr list --repo "${REPOSITORY}" --head "bump-yara-x-${VERSION}" --state open --json number --jq 'length')
7273
if [[ "${EXISTING}" -gt 0 ]]; then
7374
echo "Open PR already exists for yara-x ${VERSION}"
7475
echo "update_available=false" >> "$GITHUB_OUTPUT"
@@ -111,7 +112,7 @@ jobs:
111112
sum.golang.org:443
112113
tuf-repo-cdn.sigstore.dev:443
113114
114-
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d
115+
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d # main
115116
- name: Set up Octo-STS
116117
uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
117118
id: octo-sts

‎.github/workflows/version.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
rekor.sigstore.dev:443
4040
release-assets.githubusercontent.com:443
4141
tuf-repo-cdn.sigstore.dev:443
42-
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d
42+
- uses: chainguard-dev/actions/setup-gitsign@4a81273c8653122cf4e48cc248f9073b660c5e6d # main
4343
- name: Set up Octo-STS
4444
uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
4545
id: octo-sts

‎.github/workflows/zizmor.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,15 @@ on:
99
paths:
1010
- '.github/workflows/**'
1111
- '.github/actions/**'
12+
- '.github/dependabot.yml'
13+
- '.github/zizmor.yml'
1214
push:
1315
branches: ['main']
1416
paths:
1517
- '.github/workflows/**'
1618
- '.github/actions/**'
19+
- '.github/dependabot.yml'
20+
- '.github/zizmor.yml'
1721

1822
permissions: {}
1923

@@ -42,3 +46,5 @@ jobs:
4246

4347
- name: Run zizmor
4448
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
49+
with:
50+
persona: pedantic

0 commit comments

Comments
 (0)