From 11b3db48056025befb1bd08777a065f9b7bb6289 Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Mon, 20 Jul 2026 16:10:28 +0900 Subject: [PATCH 1/9] ci: add zizmor scanner workflow --- .github/workflows/zizmor.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000..138de5f13 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,32 @@ +name: zizmor + +# Static analysis of GitHub Actions workflows with zizmor +# (https://docs.zizmor.sh). Results are uploaded as SARIF to +# Code Scanning; findings do not fail the build. + +on: + push: + branches: [main] + pull_request: + branches: [main] + +permissions: {} + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write # SARIF upload to Code Scanning + steps: + - name: Checkout code + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 + with: + min-severity: low + min-confidence: low From 32e05b7f144ddbf4688accb019d4df2a5f264377 Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Mon, 20 Jul 2026 19:42:09 +0900 Subject: [PATCH 2/9] ci: set persist-crdentials to false on checkout actions --- .github/workflows/ci.yml | 2 ++ .github/workflows/codeql.yml | 2 ++ .github/workflows/dependency-review.yml | 3 +++ .github/workflows/docker-publish.yml | 2 ++ .github/workflows/e2e.yml | 2 ++ .github/workflows/experimental-inventory-ci.yml | 1 + .github/workflows/experimental-inventory-cli-publish.yml | 4 ++++ .github/workflows/experimental-inventory-publish.yml | 3 +++ .github/workflows/lint.yml | 1 + .github/workflows/npm.yml | 3 +++ .github/workflows/sample-publish.yml | 3 +++ .github/workflows/unused-dependencies.yml | 3 +++ 12 files changed, 29 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7a65ed4d3..a926c5010 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -31,6 +31,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - name: Use Node.js ${{ matrix.node-version }} uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -103,6 +104,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - name: Use Node.js 24.x uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c435471dc..5a1c9e23c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,8 @@ jobs: - name: Checkout repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Initialize CodeQL uses: github/codeql-action/init@cf463419fdde78c727231e445622a9ac37966f84 # ratchet:github/codeql-action/init@v4 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 85613b8ab..3f821dded 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -16,6 +16,9 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - name: Dependency Review uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4 with: diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 92c885439..267fc548b 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -27,6 +27,8 @@ jobs: - name: Checkout Repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Log in to Docker Hub if: github.repository_owner == 'finos' diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 5ecc61918..72c61813f 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -28,6 +28,8 @@ jobs: - name: Checkout code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set up Docker Buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c diff --git a/.github/workflows/experimental-inventory-ci.yml b/.github/workflows/experimental-inventory-ci.yml index 49b23f380..39c4c112f 100644 --- a/.github/workflows/experimental-inventory-ci.yml +++ b/.github/workflows/experimental-inventory-ci.yml @@ -31,6 +31,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - name: Use Node.js ${{ matrix.node-version }} uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 diff --git a/.github/workflows/experimental-inventory-cli-publish.yml b/.github/workflows/experimental-inventory-cli-publish.yml index 09db86568..c22a23df7 100644 --- a/.github/workflows/experimental-inventory-cli-publish.yml +++ b/.github/workflows/experimental-inventory-cli-publish.yml @@ -19,6 +19,8 @@ jobs: egress-policy: audit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false # Setup .npmrc file to publish to npm - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 @@ -41,3 +43,5 @@ jobs: working-directory: ./experimental/li-cli env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + with: + persist-credentials: false diff --git a/.github/workflows/experimental-inventory-publish.yml b/.github/workflows/experimental-inventory-publish.yml index 2d139831a..ab67c500a 100644 --- a/.github/workflows/experimental-inventory-publish.yml +++ b/.github/workflows/experimental-inventory-publish.yml @@ -19,12 +19,15 @@ jobs: egress-policy: audit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false # Setup .npmrc file to publish to npm - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: node-version: '24.x' registry-url: 'https://registry.npmjs.org' + persist-credentials: false - name: check version matches input run: | diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 3b3234cb6..3736788d2 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -27,6 +27,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - name: Install Dependencies run: npm ci --workspaces diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml index d75200837..6583ebce5 100644 --- a/.github/workflows/npm.yml +++ b/.github/workflows/npm.yml @@ -16,6 +16,9 @@ jobs: egress-policy: audit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + # Setup .npmrc file to publish to npm - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: diff --git a/.github/workflows/sample-publish.yml b/.github/workflows/sample-publish.yml index eb62036db..76fb238cc 100644 --- a/.github/workflows/sample-publish.yml +++ b/.github/workflows/sample-publish.yml @@ -17,6 +17,9 @@ jobs: with: egress-policy: audit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + # Setup .npmrc file to publish to npm - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: diff --git a/.github/workflows/unused-dependencies.yml b/.github/workflows/unused-dependencies.yml index 05e41797f..601973de5 100644 --- a/.github/workflows/unused-dependencies.yml +++ b/.github/workflows/unused-dependencies.yml @@ -15,6 +15,9 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - name: 'Setup Node.js' uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: From 6f40c523ca66c254bdda01c311807c9df165bb44 Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Mon, 20 Jul 2026 21:21:18 +0900 Subject: [PATCH 3/9] ci: ignore pr_target trigger error in pr-lint Testing zizmor GH alert removed on ignore --- .github/workflows/pr-lint.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml index 2e6a351e9..54647dac4 100644 --- a/.github/workflows/pr-lint.yml +++ b/.github/workflows/pr-lint.yml @@ -3,6 +3,8 @@ name: 'PR' on: + # PR target used in accordance with README + # zizmor: ignore[dangerous-triggers] pull_request_target: types: - opened From cf585099d365d0d3017d0ecad793a8b2413470e3 Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Mon, 20 Jul 2026 21:37:26 +0900 Subject: [PATCH 4/9] ci: sanitize shell inputs into envs --- .github/workflows/docker-publish.yml | 2 +- .github/workflows/experimental-inventory-cli-publish.yml | 4 +++- .github/workflows/experimental-inventory-publish.yml | 4 +++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 267fc548b..c5296e121 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -41,7 +41,7 @@ jobs: id: tags run: | if [ "${{ github.event_name }}" = "release" ]; then - echo "tags=${{ github.repository }}:${{ github.ref_name }},${{ github.repository }}:latest" >> $GITHUB_OUTPUT + echo "tags=${{ github.repository }}:${GITHUB_REF_NAME},${{ github.repository }}:latest" >> $GITHUB_OUTPUT else echo "tags=${{ github.repository }}:main" >> $GITHUB_OUTPUT fi diff --git a/.github/workflows/experimental-inventory-cli-publish.yml b/.github/workflows/experimental-inventory-cli-publish.yml index c22a23df7..2f60e7368 100644 --- a/.github/workflows/experimental-inventory-cli-publish.yml +++ b/.github/workflows/experimental-inventory-cli-publish.yml @@ -30,8 +30,10 @@ jobs: - name: check version matches input run: | - grep "\"version\": \"${{ github.event.inputs.version }}\"," package.json + grep "\"version\": \"${GITHUB_EVENT_INPUTS_VERSION}\"," package.json working-directory: ./experimental/li-cli + env: + GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }} - run: npm ci working-directory: ./experimental/li-cli diff --git a/.github/workflows/experimental-inventory-publish.yml b/.github/workflows/experimental-inventory-publish.yml index ab67c500a..860ce71d6 100644 --- a/.github/workflows/experimental-inventory-publish.yml +++ b/.github/workflows/experimental-inventory-publish.yml @@ -31,8 +31,10 @@ jobs: - name: check version matches input run: | - grep "\"version\": \"${{ github.event.inputs.version }}\"," package.json + grep "\"version\": \"${GITHUB_EVENT_INPUTS_VERSION}\"," package.json working-directory: ./experimental/license-inventory + env: + GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }} - run: npm ci working-directory: ./experimental/license-inventory From 6291ee346f60a6a6a2f5dd9d8137fa5c3a81f99f Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Mon, 20 Jul 2026 21:48:01 +0900 Subject: [PATCH 5/9] ci: fix unused permissions in ci.yml, e2e.yml --- .github/workflows/ci.yml | 2 +- .github/workflows/e2e.yml | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a926c5010..ccdeacf8d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,7 +10,7 @@ on: branches: [main] permissions: - pull-requests: write + contents: read jobs: build-ubuntu: diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 72c61813f..c52841367 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -2,8 +2,6 @@ name: E2E Tests permissions: contents: read - issues: write - pull-requests: write on: push: From 3d135eff899afd384793eea9ea1855c62cf4e8aa Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Mon, 20 Jul 2026 21:53:43 +0900 Subject: [PATCH 6/9] ci: ignore false positive zizmor errors --- .github/workflows/npm.yml | 2 ++ .github/workflows/sample-publish.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml index 6583ebce5..a9b9696f5 100644 --- a/.github/workflows/npm.yml +++ b/.github/workflows/npm.yml @@ -1,6 +1,8 @@ name: Publish to NPM on: release: + # False positive: setup-node step doesn't use cache input + # zizmor: ignore[cache-poisoning] types: [published] permissions: contents: read diff --git a/.github/workflows/sample-publish.yml b/.github/workflows/sample-publish.yml index 76fb238cc..05b9f20aa 100644 --- a/.github/workflows/sample-publish.yml +++ b/.github/workflows/sample-publish.yml @@ -3,6 +3,8 @@ name: Publish samples to NPM on: push: tags: + # False positive: setup-node step doesn't use cache input + # zizmor: ignore[cache-poisoning] - 'sample-*' permissions: From 64c1c1885593fef64094ab7f770fe2a7a1248ed1 Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Tue, 21 Jul 2026 12:26:44 +0900 Subject: [PATCH 7/9] ci: fix mismatched or missing version pins --- .github/dependabot.yml | 1 + .github/workflows/codeql.yml | 6 +++--- .github/workflows/dependency-review.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/experimental-inventory-ci.yml | 2 +- .github/workflows/experimental-inventory-cli-publish.yml | 2 +- .github/workflows/experimental-inventory-publish.yml | 2 +- .github/workflows/lint.yml | 2 +- .github/workflows/npm.yml | 2 +- .github/workflows/pr-lint.yml | 2 +- .github/workflows/sample-publish.yml | 2 +- .github/workflows/unused-dependencies.yml | 2 +- 12 files changed, 14 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a87f7e04c..649acb646 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -52,6 +52,7 @@ updates: semver-patch-days: 3 semver-minor-days: 3 semver-major-days: 7 + default-days: 7 open-pull-requests-limit: 10 commit-message: prefix: 'chore' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5a1c9e23c..7ae696778 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,14 +36,14 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@cf463419fdde78c727231e445622a9ac37966f84 # ratchet:github/codeql-action/init@v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@cf463419fdde78c727231e445622a9ac37966f84 # ratchet:github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cf463419fdde78c727231e445622a9ac37966f84 # ratchet:github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: category: '/language:${{matrix.language}}' diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 3f821dded..e9c64a890 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -20,7 +20,7 @@ jobs: persist-credentials: false - name: Dependency Review - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: comment-summary-in-pr: always fail-on-severity: high diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index c52841367..d9e141aec 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -41,7 +41,7 @@ jobs: uses: docker/setup-compose-action@3408803818f5b5065308cdf3293ecbddf1ab2fac - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: 'npm' diff --git a/.github/workflows/experimental-inventory-ci.yml b/.github/workflows/experimental-inventory-ci.yml index 39c4c112f..99f2479c9 100644 --- a/.github/workflows/experimental-inventory-ci.yml +++ b/.github/workflows/experimental-inventory-ci.yml @@ -34,7 +34,7 @@ jobs: persist-credentials: false - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/experimental-inventory-cli-publish.yml b/.github/workflows/experimental-inventory-cli-publish.yml index 2f60e7368..0f3526bca 100644 --- a/.github/workflows/experimental-inventory-cli-publish.yml +++ b/.github/workflows/experimental-inventory-cli-publish.yml @@ -23,7 +23,7 @@ jobs: persist-credentials: false # Setup .npmrc file to publish to npm - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24.x' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/experimental-inventory-publish.yml b/.github/workflows/experimental-inventory-publish.yml index 860ce71d6..9f2ecdcbd 100644 --- a/.github/workflows/experimental-inventory-publish.yml +++ b/.github/workflows/experimental-inventory-publish.yml @@ -23,7 +23,7 @@ jobs: persist-credentials: false # Setup .npmrc file to publish to npm - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24.x' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 3736788d2..735b0d90d 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -19,7 +19,7 @@ jobs: egress-policy: audit - name: Install NodeJS - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml index a9b9696f5..d6d8d3183 100644 --- a/.github/workflows/npm.yml +++ b/.github/workflows/npm.yml @@ -22,7 +22,7 @@ jobs: persist-credentials: false # Setup .npmrc file to publish to npm - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml index 54647dac4..11b003384 100644 --- a/.github/workflows/pr-lint.yml +++ b/.github/workflows/pr-lint.yml @@ -56,7 +56,7 @@ jobs: uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - - uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7 + - uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0 with: commitish: main env: diff --git a/.github/workflows/sample-publish.yml b/.github/workflows/sample-publish.yml index 05b9f20aa..b062ff828 100644 --- a/.github/workflows/sample-publish.yml +++ b/.github/workflows/sample-publish.yml @@ -23,7 +23,7 @@ jobs: persist-credentials: false # Setup .npmrc file to publish to npm - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24.x' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/unused-dependencies.yml b/.github/workflows/unused-dependencies.yml index 601973de5..0737fcd49 100644 --- a/.github/workflows/unused-dependencies.yml +++ b/.github/workflows/unused-dependencies.yml @@ -19,7 +19,7 @@ jobs: persist-credentials: false - name: 'Setup Node.js' - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24.x' - name: 'Run depcheck' From 49dd3b6e4c7e2247bc7b8dce023c219c8881af48 Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Tue, 21 Jul 2026 12:48:23 +0900 Subject: [PATCH 8/9] ci: increase GHA and Docker default-days to 7 --- .github/dependabot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 649acb646..59fb48579 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,7 +7,7 @@ updates: schedule: interval: weekly cooldown: - default-days: 3 + default-days: 7 commit-message: prefix: 'chore' include: 'scope' @@ -26,7 +26,7 @@ updates: schedule: interval: weekly cooldown: - default-days: 3 + default-days: 7 commit-message: prefix: 'chore' include: 'scope' From 3ba24b121598f6c7d3e48f8d0d02cb957a7a899b Mon Sep 17 00:00:00 2001 From: Juan Escalada Date: Tue, 21 Jul 2026 13:32:45 +0900 Subject: [PATCH 9/9] docs: add zizmor guide to CONTRIBUTING.md --- CONTRIBUTING.md | 75 ++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 68 insertions(+), 7 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6d09f1be5..337a95b20 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -17,6 +17,8 @@ For project governance, roles, and voting procedures, see the [Governance sectio - [Fuzz Tests](#fuzz-tests) - [Coverage Requirements](#coverage-requirements) - [Code Quality](#code-quality) + - [Linting & Formatting](#linting--formatting) + - [GitHub Actions Security (zizmor)](#github-actions-security-zizmor) - [Configuration Schema](#configuration-schema) - [Submitting a Pull Request](#submitting-a-pull-request) - [Community](#community) @@ -25,12 +27,13 @@ For project governance, roles, and voting procedures, see the [Governance sectio We actively support and test against the latest two LTS Node versions, currently 22 and 24. When a new LTS version rolls out (26, 28, etc.), we deprecate the oldest one. -| Tool | Version | Notes | -| ---------------------------------------------------------------------------------------------------------- | -------------------- | --------------------------- | -| [Node.js](https://nodejs.org/en/download) | 22.13.1+, or 24.0.0+ | Check with `node -v` | -| [npm](https://npmjs.com/) | 8+ | Bundled with Node.js | -| [Git](https://git-scm.com/downloads) | Any recent version | Must support HTTP/S | -| [Docker](https://docs.docker.com/get-docker/) & [Docker Compose](https://docs.docker.com/compose/install/) | Any recent version | Required for E2E tests only | +| Tool | Version | Notes | +| ---------------------------------------------------------------------------------------------------------- | -------------------- | --------------------------------------------------------------------------------------- | +| [Node.js](https://nodejs.org/en/download) | 22.13.1+, or 24.0.0+ | Check with `node -v` | +| [npm](https://npmjs.com/) | 8+ | Bundled with Node.js | +| [Git](https://git-scm.com/downloads) | Any recent version | Must support HTTP/S | +| [Docker](https://docs.docker.com/get-docker/) & [Docker Compose](https://docs.docker.com/compose/install/) | Any recent version | Required for E2E tests only | +| [zizmor](https://docs.zizmor.sh/) | Any recent version | Optional; scans GitHub Actions workflows (see [below](#github-actions-security-zizmor)) | ## Getting Started @@ -349,6 +352,8 @@ The coverage report is written to `./coverage/`. If your PR is below the thresho ## Code Quality +### Linting & Formatting + ```bash npm run lint # Run ESLint npm run lint:fix # ESLint with auto-fix @@ -358,6 +363,62 @@ npm run format:check # Check formatting without modifying files CI runs ESLint, Prettier, and TypeScript type checks on every PR (see [`.github/workflows/lint.yml`](.github/workflows/lint.yml)). +### GitHub Actions Security (zizmor) + +We use [zizmor](https://docs.zizmor.sh/) to statically analyze our GitHub Actions workflows for security issues (template injection, credential persistence, overly broad permissions, etc.). It runs in CI on every push and PR to `main` (see [`.github/workflows/zizmor.yml`](.github/workflows/zizmor.yml)) and uploads results to GitHub Code Scanning. By design, the CI job does **not** fail the build, so running zizmor locally before pushing is the best way to catch and fix findings early. + +If you change anything under `.github/workflows/`, you should first run zizmor locally. + +#### Install + +zizmor is a standalone tool. Install it with your preferred tool: + +```bash +# Using uv (recommended) +uv tool install zizmor + +# Using pipx +pipx install zizmor + +# Using pip +pip install zizmor + +# Using Homebrew (macOS/Linux) +brew install zizmor + +# Using Cargo (Rust toolchain) +cargo install zizmor +``` + +See the [zizmor installation docs](https://docs.zizmor.sh/installation/) for more options. + +#### Run + +```bash +# Scan all workflows in the repo (matches the CI thresholds) +zizmor --min-severity low --min-confidence low . + +# Scan a single workflow +zizmor .github/workflows/ci.yml +``` + +By default zizmor runs in offline mode; some audits such as version pinning require online access. To enable the full set of checks, pass a GitHub token: + +```bash +zizmor . --gh-token +``` + +#### Fixing findings + +Some findings have auto-fixes. Preview them before applying: + +```bash +zizmor --fix=all --dry-run . # Show what would change +zizmor --fix=all . # Apply safe and unsafe fixes +``` + +Always review auto-fixes before committing. For findings without an auto-fix, follow the linked audit documentation in the zizmor output. If a finding is a false positive or an accepted risk, suppress it with an inline [`# zizmor: ignore[]` comment](https://docs.zizmor.sh/usage/#ignoring-results) rather than disabling the check globally. + ## Configuration Schema GitProxy uses a JSON Schema ([config.schema.json](config.schema.json)) to define and validate configuration. When adding or modifying config properties: @@ -399,7 +460,7 @@ The following checks must pass before a PR can be merged: - **Lint & format**: ESLint, Prettier, TypeScript type checks - **Commit lint**: Conventional Commits validation - **Coverage**: 80%+ patch coverage via CodeCov -- **Security**: CodeQL analysis, dependency review, OpenSSF Scorecard +- **Security**: CodeQL analysis, dependency review, OpenSSF Scorecard, and [zizmor](#github-actions-security-zizmor) GitHub Actions analysis ### Contributor License Agreement (CLA)