From d9c6fd6f47eb7af96f39b0ba07a1d3ba3782eac1 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Sat, 1 Aug 2026 11:52:53 +0200 Subject: [PATCH 1/2] ci: add zizmor config exempting first-party reusables MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit zizmor's default unpinned-uses policy is blanket hash-pin, which flags every netresearch/* reusable referenced @main — including the scanner jobs added in this PR. First-party reusables track @main by policy so fixes propagate to all consumers, so they are exempted to ref-pin here. Third-party actions remain hash-pin enforced. Byte-identical to the shared template config (netresearch/.github#329). Signed-off-by: Sebastian Mendel --- .github/zizmor.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..b9d8464 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,13 @@ +# zizmor (https://zizmor.sh) configuration +# +# Tunes zizmor to Netresearch conventions so the audit reports only +# actionable findings. Third-party actions remain hash-pin enforced. +rules: + unpinned-uses: + config: + policies: + # First-party reusable workflows track @main by policy and are + # never SHA-pinned, so fixes propagate to all consumers. + "netresearch/*": ref-pin + # Everything else must be pinned to a full commit SHA. + "*": hash-pin From b360e078e6d77e614ac00d4ee130d024bae63dd7 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Sat, 1 Aug 2026 13:01:18 +0200 Subject: [PATCH 2/2] ci: add zizmor workflow from the template Syncs the standalone zizmor caller workflow that the go templates ship (netresearch/.github#327). The file was missing in this repo, which is what the template drift check reports. Report-only: the reusable runs in SARIF mode and uploads to code scanning; it never fails CI. Minimal permissions (contents: read + security-events: write). Signed-off-by: Sebastian Mendel --- .github/workflows/zizmor.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..ad292c8 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,21 @@ +name: Zizmor + +# Static analysis of the repo's GitHub Actions workflows (https://zizmor.sh). +# Report-only: the reusable runs in SARIF mode (exit 0 regardless of findings) +# and uploads results to the Security / code-scanning tab, like CodeQL and +# Scorecard. Findings surface as alerts; they never fail CI. + +on: + push: + branches: [main] + pull_request: + branches: [main] + +permissions: {} + +jobs: + zizmor: + uses: netresearch/.github/.github/workflows/zizmor.yml@main + permissions: + contents: read + security-events: write