Add GitHub Actions security scanning with CodeQL and zizmor#15114
Add GitHub Actions security scanning with CodeQL and zizmor#15114josevalim merged 6 commits intoelixir-lang:mainfrom
Conversation
Add `persist-credentials: false` to all `actions/checkout` usages to prevent Git credentials from being persisted in the repository after checkout completes. See: https://docs.zizmor.sh/audits/#artipacked
Use environment variables instead of direct template expansion in shell run blocks to prevent potential code injection. See: https://docs.zizmor.sh/audits/#template-injection
Delay automatic dependency updates to allow time for discovery of regressions or supply-chain compromises in newly released versions. See: https://docs.zizmor.sh/audits/#dependabot-cooldown
The GITHUB_PATH and GITHUB_ENV writes are safe as they use only workflow-controlled values, not attacker-controlled input. See: https://docs.zizmor.sh/audits/#github-env
Run CodeQL static analysis on GitHub Actions workflows to detect potential security vulnerabilities in CI/CD configuration. Scheduled weekly and on pushes/PRs to main branch.
Run zizmor static analysis on GitHub Actions workflows to detect potential security vulnerabilities in CI/CD configuration. See: https://docs.zizmor.sh/
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
|
@maennchen thank you, this is great! Shall I go ahead and merge it? Do you want me to rebase or squash it? |
|
@josevalim Yes, this is ready to be merged :) I have no opinion on rebase vs squash. I just did multiple commits to make the review simpler for you. |
|
💚 💙 💜 💛 ❤️ |
2 participants
Summary
This PR contains multiple commits:
persist-credentials: falseto allactions/checkoutusagesgithub-envwarnings with inline ignoresRequired Repository Settings
After merging, enable the following repository settings in "Rules" / "Rulesets":
Add "Require code scanning results" with the following tools:
CodeQLzizmorSet "Security Alerts" and "Alert" to "All":
That way PR merges are blocked until all issues have been identified.
References