From 0acc20933a514f74c9d560a92f51a0dce2002228 Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Thu, 3 Sep 2026 12:19:11 +0200 Subject: [PATCH] ci: harden GitHub Actions workflows and add zizmor scan Add a CI job that runs the zizmor static analyzer over the workflow files under .github/, and apply the corresponding hardening so the existing workflows pass the audit: - add persist-credentials: false to every actions/checkout step that lacked it, so the checkout token is not left in the runner's git config for later steps to reuse - narrow top-level permissions: read-all to permissions: contents: read - add a 7-day cooldown to the dependabot update entries CI/configuration-only; no library code, tests, or docs are affected. --- .github/dependabot.yml | 4 ++ .github/workflows/build-with-clang.yml | 4 +- .../workflows/build-with-standard-clang.yml | 4 +- .github/workflows/build_pip.yml | 4 +- .github/workflows/conda-package-cf.yml | 5 ++- .github/workflows/conda-package.yml | 5 ++- .github/workflows/coverity.yml | 2 + .github/workflows/openssf-scorecard.yml | 3 +- .github/workflows/pre-commit.yml | 4 +- .github/workflows/zizmor.yml | 39 +++++++++++++++++++ 10 files changed, 67 insertions(+), 7 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 62ec4a79..f86275e2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,8 @@ updates: schedule: interval: "weekly" day: "saturday" + cooldown: + default-days: 7 labels: ["autoupdate"] groups: github-actions: @@ -15,6 +17,8 @@ updates: schedule: interval: "weekly" day: "saturday" + cooldown: + default-days: 7 labels: ["autoupdate"] groups: pre-commit: diff --git a/.github/workflows/build-with-clang.yml b/.github/workflows/build-with-clang.yml index d42b52bf..77bcdd3f 100644 --- a/.github/workflows/build-with-clang.yml +++ b/.github/workflows/build-with-clang.yml @@ -5,7 +5,8 @@ on: push: branches: [main] -permissions: read-all +permissions: + contents: read jobs: build-with-intel-clang: @@ -51,6 +52,7 @@ jobs: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Install mkl_umath dependencies diff --git a/.github/workflows/build-with-standard-clang.yml b/.github/workflows/build-with-standard-clang.yml index 0c97e73b..fe77b903 100644 --- a/.github/workflows/build-with-standard-clang.yml +++ b/.github/workflows/build-with-standard-clang.yml @@ -5,7 +5,8 @@ on: push: branches: [main] -permissions: read-all +permissions: + contents: read jobs: build-with-standard-clang: @@ -42,6 +43,7 @@ jobs: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Install mkl_umath dependencies diff --git a/.github/workflows/build_pip.yml b/.github/workflows/build_pip.yml index 36699dcf..b2085fab 100644 --- a/.github/workflows/build_pip.yml +++ b/.github/workflows/build_pip.yml @@ -6,7 +6,8 @@ on: - main pull_request: -permissions: read-all +permissions: + contents: read jobs: build: @@ -37,6 +38,7 @@ jobs: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 diff --git a/.github/workflows/conda-package-cf.yml b/.github/workflows/conda-package-cf.yml index 0bf2d194..42b7ec57 100644 --- a/.github/workflows/conda-package-cf.yml +++ b/.github/workflows/conda-package-cf.yml @@ -6,7 +6,8 @@ on: - main pull_request: -permissions: read-all +permissions: + contents: read env: PACKAGE_NAME: mkl_umath @@ -45,6 +46,7 @@ jobs: access_token: ${{ github.token }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Set pkgs_dirs @@ -232,6 +234,7 @@ jobs: access_token: ${{ github.token }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 diff --git a/.github/workflows/conda-package.yml b/.github/workflows/conda-package.yml index 5348040c..57756d3b 100644 --- a/.github/workflows/conda-package.yml +++ b/.github/workflows/conda-package.yml @@ -6,7 +6,8 @@ on: - main pull_request: -permissions: read-all +permissions: + contents: read env: PACKAGE_NAME: mkl_umath @@ -45,6 +46,7 @@ jobs: access_token: ${{ github.token }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Set pkgs_dirs @@ -242,6 +244,7 @@ jobs: access_token: ${{ github.token }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index ee5f78b9..30072a23 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -31,6 +31,8 @@ jobs: steps: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 diff --git a/.github/workflows/openssf-scorecard.yml b/.github/workflows/openssf-scorecard.yml index 0842676d..6eb864bf 100644 --- a/.github/workflows/openssf-scorecard.yml +++ b/.github/workflows/openssf-scorecard.yml @@ -18,7 +18,8 @@ on: # Declare default permissions as read only. -permissions: read-all +permissions: + contents: read jobs: analysis: diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 17ae79d5..01344a99 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -5,7 +5,8 @@ on: push: branches: [main] -permissions: read-all +permissions: + contents: read jobs: pre-commit: @@ -15,6 +16,7 @@ jobs: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false # use commit hash to make "no-commit-to-branch" check passing ref: ${{ github.sha }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..1037f1c0 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,39 @@ +name: Security scan of GitHub Actions workflows (zizmor) + +on: + push: + branches: + - main + pull_request: + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + zizmor: + name: Scan GitHub Actions workflows + + runs-on: ubuntu-latest + timeout-minutes: 10 + + permissions: + contents: read # needed to clone the repo + + steps: + - name: Checkout mkl_umath repo + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3 + with: + # Low/informational template-injection notes come from internally-defined + # values (no external input), so they are reported as annotations but do not gate CI + min-severity: medium + advanced-security: false + annotations: true + inputs: .github/