Repository navigation
ci: harden GitHub Actions workflows (FB-4904) - #550
Conversation
- Upgrade and SHA-pin actions (pinact, 7-day min age); repin
action-python-release to current main.
- Default every workflow to `permissions: {}` and grant per-job
permissions, including on reusable-workflow caller jobs.
- Set `persist-credentials: false` on checkouts that don't push; the
release job keeps `true` for the version bump and tag push.
- Drop the pip cache from the docs deploy job (cache poisoning) and move
template expressions in `run:` into `env:`; quote shell variables.
- Add actionlint + zizmor CI workflow and an actionlint config that
ignores the intentional `cache-mode` job key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
pinact -u ignores Dependabot's semver-major ignore and moves v1 callers of integration-testing-setup to v2, a different product with different inputs. Exclude the action from pinact; Dependabot keeps it updated within its major. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
startsWith(github.head_ref, 'dependabot') matches any branch named dependabot*, so anyone could skip the check by naming their branch so. Check the PR author instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Disable the self-repository audit: actionlint does not support the suggested `uses: $/...` syntax yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2a989ef. Configure here.
| # reusable workflows, but actionlint does not support it yet and fails on it. | ||
| # Keep the workspace-relative `./.github/workflows/...` form until it does. | ||
| self-repository: | ||
| disable: true |
There was a problem hiding this comment.
Zizmor config breaks the scan job
High Severity
.github/zizmor.yml disables self-repository, but zizmor-action v0.6.0 runs zizmor 1.27.0, which does not know that audit (added in 1.30.0). zizmor rejects unknown rules keys, so the scan job fails to start instead of applying the suppression.
Reviewed by Cursor Bugbot for commit 2a989ef. Configure here.
3 participants
Summary
action-python-releaseto currentmain(README-only change).permissions: {}; jobs (and reusable-workflow caller jobs) get only what they need.persist-credentials: falseon all checkouts except the release job, which keepstruebecause the release action pushes the version commit and tag.contents: writejob), moved${{ }}out ofrun:, quoted shell variables. Addedlint-and-scan-actions.yml(actionlint + zizmor) plus.github/actionlint.yamlto ignore the intentionalcache-modekey, which actionlint doesn't know yet.Action upgrades with changes
actions/setup-pythonv6 → v7 andactions/cachev5 → v6: no input changes needed (v7 dropspip-install, which isn't used).Scan results
zizmor: 17 → 10 findings (10 low
self-repository, which suggests$/…instead of./…for local reusable workflows; actionlint rejects that syntax, so it stays). actionlint: 10 → 0 errors (cache-modeignored via config).Follow-up fixes
check-pr-formatting.yml: skip the title check for Dependabot by PR author (github.event.pull_request.user.login != 'dependabot[bot]') instead ofstartsWith(github.head_ref, 'dependabot'), which anyone could match by naming their branch..github/zizmor.ymlto disableself-repository(actionlint rejects the$/syntax). zizmor now reports no findings.Part of FB-4904.
🤖 Generated with Claude Code
Note
Medium Risk
Touches every CI workflow including release and integration tests; permission and checkout credential changes could break jobs if mis-scoped, though release push behavior is explicitly preserved.
Overview
Hardens GitHub Actions across the repo: workflows default to
permissions: {}, with least-privilege grants on individual jobs (including reusable-workflow callers),persist-credentials: falseon checkouts except release (which still needs push), and SHA-pinned action bumps (e.g.checkoutv7.0.1,setup-pythonv7) plus pinact config to avoid auto-bumping the Firebolt integration-testing major ref.Adds
.github/workflows/lint-and-scan-actions.yml(actionlint + zizmor on.github/**changes) with actionlint/zizmor config to tolerate intentional keys (cache-modeoncode-check) and keep local reusable workflow paths as./.github/....Targeted workflow fixes: docs deploy drops pip cache on the
contents: writejob and hardens shell/env usage; PR semantic title skips Dependabot by PR author instead of branch name;code-checksetscache-mode: none; minor shell quoting and artifact/action version updates elsewhere.Reviewed by Cursor Bugbot for commit 2a989ef. Bugbot is set up for automated code reviews on this repo. Configure here.