kingchenc
73415cd2dc
* ci: pass ref context through env in release tag step zizmor flagged the "Resolve target tag" step in release.yml for template-injection: github.event_name / github.ref / github.ref_name were interpolated directly into the shell script. On a tag push the tag name is attacker-influenceable, so a crafted tag could inject commands. Move all three context values into the step env and reference them as shell variables instead. Verified with zizmor 1.16.3: template-injection findings on release.yml drop from 2 to 0. * ci: accept release.yml build caches via zizmor config The release pipeline restores Swatinem/rust-cache and actions/setup-node caches as a deliberate optimisation. zizmor flags all eight under cache-poisoning because release.yml publishes to crates.io / PyPI / npm. The caches are maintainer-controlled and the restore speedup is kept on purpose, so accept the finding via a zizmor config ignore for release.yml rather than running cache-free release builds. (Six of the eight are actions/setup-node, reported at Low confidence.) Adds .github/zizmor.yml; release.yml now reports 0 high findings. * ci: drop persisted checkout credentials on read-only jobs zizmor's artipacked audit flags every actions/checkout that keeps the default persisted credential: the token is written to the runner's .git/config, where it can leak if a later step packs .git into an uploaded artifact, or be read by another step in the same job. Set persist-credentials: false on the 20 checkouts whose jobs never push or authenticate to git (build/test/clippy/msrv/coverage/supply-chain/ fuzz/python/wasm/node in ci.yml, plus bench.yml, codeql.yml, the seven release.yml build/publish jobs, and sync-metadata.yml). The publish and release jobs authenticate to crates.io / npm / PyPI / the GitHub API with their own tokens, not persisted git credentials, so this is safe. sync-about.yml genuinely pushes the indicator-count fix-up to the PR branch, so it keeps its credential and is accepted via .github/zizmor.yml. zizmor artipacked for the repo drops to 0 (0 high, 0 medium remaining).
25 lines
1.1 KiB
YAML
25 lines
1.1 KiB
YAML
# zizmor configuration — https://docs.zizmor.sh/configuration/
|
|
#
|
|
# cache-poisoning (release.yml):
|
|
# The release pipeline restores build caches (Swatinem/rust-cache for the Rust
|
|
# compilation, actions/setup-node) as a deliberate, accepted optimisation.
|
|
# zizmor flags these under cache-poisoning because release.yml publishes
|
|
# artifacts to crates.io / PyPI / npm, so a poisoned cache could in theory
|
|
# reach a released build. Our caches are maintainer-controlled and the
|
|
# restore speedup is kept on purpose; we accept this risk rather than running
|
|
# cache-free release builds. (Six of the eight hits are actions/setup-node,
|
|
# which zizmor reports at "Low" confidence.)
|
|
#
|
|
# artipacked (sync-about.yml):
|
|
# The sync-about job checks out with persisted credentials on purpose: it
|
|
# pushes the indicator-count fix-up back to the PR head branch (git commit +
|
|
# git push), which needs the token in the runner's git config. It uploads no
|
|
# artifacts, so the persisted token is never packaged or leaked; accept it.
|
|
rules:
|
|
cache-poisoning:
|
|
ignore:
|
|
- release.yml
|
|
artipacked:
|
|
ignore:
|
|
- sync-about.yml
|