ci: integrate zizmor workflow security gate into iOS CI#4750
ci: integrate zizmor workflow security gate into iOS CI#4750screendriver wants to merge 2 commits into
Conversation
screendriver
force-pushed
the
zizmor
branch
2 times, most recently
from
029e5fa to
b3ade9e
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Add a dedicated workflow-security job to the shared iOS build workflow to enforce GitHub Actions security auditing with [zizmor](https://github.com/zizmorcore/zizmor), and make it a hard gate for the rest of the pipeline.
Test Results0 tests 0 ✅ 0s ⏱️ Results for commit 45a159f. ♻️ This comment has been updated with latest results. Summary: workflow run #27532399395 |
|
netbe
left a comment
netbe
left a comment
There was a problem hiding this comment.
left some comments before approving.
Also @screendriver could you reference a JIRA ticket for this in the title "ci: ... - WPB-XXX" ?
|
|
||
| permissions: | ||
| contents: read # required for workflows that need repository checkout access | ||
| actions: read # required for reading workflow/action metadata |
There was a problem hiding this comment.
question: should this be fixed?
| types: [checks_requested] | ||
|
|
||
| permissions: | ||
| contents: read # required for workflows that need repository checkout access |
There was a problem hiding this comment.
question: should this be fixed?
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| persist-credentials: false |
There was a problem hiding this comment.
question: Does this need to run on separate job? Why not run zizmor step within the detect-changes so we don't pay twice the checkout and job costs?
4 participants
Issue
Add a dedicated workflow-security job to the shared iOS build workflow to enforce GitHub Actions security auditing with zizmor, and make it a hard gate for the rest of the pipeline.
Checklist
[WPB-XXX].UI accessibility checklist
If your PR includes UI changes, please utilize this checklist: