Add zizmor static analysis gate for GitHub Actions workflows - #78
Open
michaelpeterswa wants to merge 7 commits into
Open
Add zizmor static analysis gate for GitHub Actions workflows#78michaelpeterswa wants to merge 7 commits into
michaelpeterswa wants to merge 7 commits into
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
michaelpeterswa
added a commit
that referenced
this pull request
Sep 1, 2026
-f/--raw-field only accepts literal string values; -F/--field is required for the "@<path>" file-read syntax. The lowercase flag was posting the literal string "@/tmp/zizmor_comment.md" as the comment body instead of its contents, caught by testing the update path on PR #78. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
🌈 zizmor findingsFound 203 finding(s) across the workflows in this PR.
See the |
Runs zizmorcore/zizmor-action on PRs and pushes to main that touch .github/workflows/**, uploading results to code scanning. First step toward the cleanup tracked in #76. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
SARIF/code scanning requires a GitHub Advanced Security license, which most private consumer repos don't have. Standardize on the `github` annotation format so this workflow behaves identically everywhere it's adopted. Drops the now-unused security-events permission. The annotation format propagates zizmor's real exit code (unlike SARIF, which always exits 0), so continue-on-error is added temporarily until the findings tracked in #76 are cleaned up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Annotations land on individual lines and are easy to miss, so add a second job that runs zizmor a second time for JSON output, builds a rule/severity breakdown, and posts (or updates, keyed on a marker comment) a single summary comment on the PR. Split into its own job with only the permissions it needs (pull-requests: write) rather than granting that at the workflow level, per zizmor's own excessive-permissions finding on the first draft of this change. Also adds a concurrency group and explanatory comments on the remaining permissions. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
-f/--raw-field only accepts literal string values; -F/--field is required for the "@<path>" file-read syntax. The lowercase flag was posting the literal string "@/tmp/zizmor_comment.md" as the comment body instead of its contents, caught by testing the update path on PR #78. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Order rows high -> low severity, breaking ties by finding count descending, instead of count alone. Makes the highest-risk rows easiest to spot at the top of the table. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
michaelpeterswa
force-pushed
the
feat/zizmor-ci-gate
branch
from
September 1, 2026 18:52
dcfda7e to
47eb228
Compare
This was referenced Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
zizmor.ymlCI workflow that runszizmorcore/zizmor-action@v0.6.3against.github/workflows/**on pushes tomainand on pull requests that touch workflow files.--format=github), not SARIF/code scanning. Most consumer repos of this template repo are private and don't have a GitHub Advanced Security license, so we're standardizing on the format that works everywhere rather than a public-repo-only path.continue-on-error: trueis set on the zizmor step, temporarily. Thegithubannotation format propagates zizmor's real exit code (unlike SARIF, which always exits 0), and this repo currently has real high-severity findings tracked in Adopt zizmor for static analysis of GitHub Actions workflows #76. Once that cleanup lands, we'll removecontinue-on-errorso the check actually blocks merges.actions/checkoutandzizmor-actionare pinned to commit SHAs.Test plan
zizmor .github/workflows/zizmor.ymllocally — no findings.continue-on-errorin a follow-up PR.Part of #76.