github/gh-aw-actions PR #238 (chore: sync actions from gh-aw@v0.89.4) regenerated workflows that triggered zizmor findings. Do not add broad or permanent zizmor suppressions. Fix the compiler and workflow source so regenerated artifacts are secure by construction.
Historical precedent in github/gh-aw-actions:
- Pin mutable
uses: references to immutable commit SHAs (unpinned-uses).
- Ensure SHA comments match the actual action version (
ref-version-mismatch).
- Use
persist-credentials: false for read-only checkouts (artipacked).
- Bind dynamic GitHub expressions through
env: before using them in shell commands (template-injection).
Required changes
1. Emit immutable action references in action mode
Investigate and update:
pkg/workflow/action_reference.go
When compiling in action mode, require resolution of action references to full immutable commit SHAs. Do not emit a mutable fallback such as:
uses: github/gh-aw-actions/setup@vX.Y.Z
github/gh-aw-actionsPR #238 (chore: sync actions from gh-aw@v0.89.4) regenerated workflows that triggered zizmor findings. Do not add broad or permanent zizmor suppressions. Fix the compiler and workflow source so regenerated artifacts are secure by construction.Historical precedent in
github/gh-aw-actions:uses:references to immutable commit SHAs (unpinned-uses).ref-version-mismatch).persist-credentials: falsefor read-only checkouts (artipacked).env:before using them in shell commands (template-injection).Required changes
1. Emit immutable action references in action mode
Investigate and update:
pkg/workflow/action_reference.goWhen compiling in action mode, require resolution of action references to full immutable commit SHAs. Do not emit a mutable fallback such as: