ci: add zizmor config exempting first-party reusables - #258
Conversation
zizmor's default unpinned-uses policy is blanket hash-pin, which flags every netresearch/* reusable referenced @main — including the scanner jobs added in this PR. First-party reusables track @main by policy so fixes propagate to all consumers, so they are exempted to ref-pin here. Third-party actions remain hash-pin enforced. Byte-identical to the shared template config (netresearch/.github#329). Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
Dependency ReviewThe following issues were found:
License Issues.github/workflows/zizmor.yml
OpenSSF Scorecard
Scanned Files
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #258 +/- ##
=======================================
Coverage 74.70% 74.70%
=======================================
Files 10 10
Lines 427 427
=======================================
Hits 319 319
Misses 88 88
Partials 20 20
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds a repository-level zizmor configuration so the GitHub Actions security audit aligns with Netresearch policy: first-party reusable workflows may track @main (ref-pin), while third-party actions remain enforced as full-SHA pinned (hash-pin). This supports keeping the template drift check green for this template consumer repo.
Changes:
- Add
.github/zizmor.ymlconfiguringunpinned-usespolicies:netresearch/*→ref-pin*→hash-pin
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Syncs the standalone zizmor caller workflow that the go templates ship (netresearch/.github#327). The file was missing in this repo, which is what the template drift check reports. Report-only: the reusable runs in SARIF mode and uploads to code scanning; it never fails CI. Minimal permissions (contents: read + security-events: write). Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Adds
.github/zizmor.yml, byte-identical to the shared template config innetresearch/.github#329.
zizmor's default
unpinned-usespolicy is blanket hash-pin, so it flags everynetresearch/*reusable referenced@main. First-party reusables track@mainby policy so fixes propagate to all consumers without a SHA bump, so they are
exempted to
ref-pinhere.Third-party actions remain hash-pin enforced — the audit is not disabled.
This repo is a template consumer (
.github/template.yaml), and the sharedtemplates now ship this file, so it is required to keep the template drift check
green.