Add auto-labelling and security linting for workflows - #260
Open
rlahfa-dinum wants to merge 5 commits into
Open
rlahfa-dinum wants to merge 5 commits into
rlahfa-dinum wants to merge 5 commits into
Conversation
rlahfa-dinum
requested review from
jdauphant-dinum,
olebrouster-dinum and
plegrand-dinum
as code owners
September 9, 2026 17:40
Required for zizmor. Signed-off-by: Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
Add zizmor (static analysis for GitHub Actions) as a pre-push hook. Also address every zizmor finding in the existing workflows: - scope GITHUB_TOKEN permissions per-job and drop unneeded writes, - set `persist-credentials: false` on checkout where no push is needed, - add the REUSE SPDX header that was missing from several files. Signed-off-by: Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
Signed-off-by: Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
Add a path-based labeler that applies A/* area labels to pull requests based on the files they touch, matching the existing labels of the Sécurix repository. The workflow is restricted to same-repository PRs, scopes its token to contents: read + pull-requests: write, and pins actions/labeler by SHA1. Signed-off-by: Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
Signed-off-by: Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
rlahfa-dinum
force-pushed
the
autolabeller
branch
from
September 9, 2026 17:41
a3ad44a to
06cdd98
Compare
rlahfa-dinum
added
status: awaiting-maintainers
agrimault-dinum
approved these changes
Sep 10, 2026
agrimault-dinum
left a comment
agrimault-dinum
left a comment
Contributor
There was a problem hiding this comment.
I think you are using pull_request_target safely, I don't see untrusted code execution. I would still justify the safety a bit more by saying that there are:
- no checkout
- no payload as code (no ${{ }})
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 | ||
| # zizmor: ignore[artipacked] - the persisted credential is required to |
Contributor
There was a problem hiding this comment.
The docs seems to recommend adding explicit persist-credentials: true https://docs.zizmor.sh/audits/#remediation_3
| # workflow_run is safe here: github-script is pinned, no secrets are used, | ||
| # and the action only calls the GitHub API to manage labels. We only act on | ||
| # PRs from the same repository to avoid processing fork-sourced workflow runs. | ||
| if: github.event_name == 'workflow_run' && github.event.workflow_run.head_repository.full_name == github.repository |
Contributor
There was a problem hiding this comment.
is workflow_run missing from on:?
rlahfa-dinum
added
status: awaiting-author
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds automatic labelling for status updates and areas.
Because I had to use
pull_request_target, I ensured that from now on, our workflows will passzizmorwhich is a well-known basic security practice for GHA workflows, esp. ones that usespull_request_target.I spent extra time checking and hardening all workflows that made use of it.
Signed-off-by: Ryan Lahfa ryan.lahfa.ext@numerique.gouv.fr