From a03e7c3af8f82abd4b3139ccb3923805d7152fab Mon Sep 17 00:00:00 2001 From: thewrz Date: Tue, 15 Sep 2026 12:19:13 -0700 Subject: [PATCH] ci: harden workflows against zizmor artipacked and cache-poisoning Two documented flags, no logic or deployment changes: - `persist-credentials: false` on every actions/checkout step (8). No step after checkout uses git credentials: the release upload, issue creation, CodeQL upload and dependency review all authenticate via the GITHUB_TOKEN input/env, so the token no longer needs to live in .git/config where an uploaded artifact could capture it. - `package-manager-cache: false` on the setup-node step of build-server.yml only. That job publishes release artifacts, so it must never restore a shared npm cache. CI and the scheduled contract job keep their cache; they publish nothing. zizmor (v1.30.1): 1 high + 8 medium -> 0 high, 0 medium. The remaining informational finding (script `gh release` instead of softprops/action-gh-release) is a deliberate keep -- changing how we publish is out of scope. Closes #156. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/build-server.yml | 5 +++++ .github/workflows/ci.yml | 8 ++++++++ .github/workflows/codeql.yml | 2 ++ .github/workflows/dependency-health.yml | 2 ++ .github/workflows/dependency-review.yml | 2 ++ 5 files changed, 19 insertions(+) diff --git a/.github/workflows/build-server.yml b/.github/workflows/build-server.yml index e6ef061..223f7cb 100644 --- a/.github/workflows/build-server.yml +++ b/.github/workflows/build-server.yml @@ -38,6 +38,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # The runtime resolved here is the one bundled into the release artifact # below, so .nvmrc pins what ships to users, not just what CI builds with. @@ -45,6 +47,9 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc + # Release artifacts are built here; never restore an npm cache into a + # publishing job (zizmor cache-poisoning, issue #156). + package-manager-cache: false - name: Install dependencies working-directory: server diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 36954f9..d489457 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,6 +15,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -36,6 +38,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -56,6 +60,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -73,6 +79,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0d16170..1fe08db 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,6 +19,8 @@ jobs: language: [javascript-typescript] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: diff --git a/.github/workflows/dependency-health.yml b/.github/workflows/dependency-health.yml index b45a03c..5ebb335 100644 --- a/.github/workflows/dependency-health.yml +++ b/.github/workflows/dependency-health.yml @@ -15,6 +15,8 @@ jobs: continue-on-error: true steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 8df2410..94e6264 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -12,6 +12,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: