Skip to content

ci: add zizmor to lint-actions#37720

Merged
bircni merged 12 commits into
go-gitea:mainfrom
silverwind:ci-zizmor
May 16, 2026
Merged

ci: add zizmor to lint-actions#37720
bircni merged 12 commits into
go-gitea:mainfrom
silverwind:ci-zizmor

Conversation

@silverwind
Copy link
Copy Markdown
Member

@silverwind silverwind commented May 15, 2026 •
edited
Loading

Adds zizmor to make lint-actions with --min-confidence=medium. Fixes the remaining findings:

  • Pin floating-tag service images in pull-db-tests.yml to tag@sha256:digest
  • Move github.ref / github.ref_name (and surrounding secrets/step outputs for consistency) out of run: into env:

This PR was written with the help of Claude Opus 4.7

@silverwind @claude
ci: add zizmor to lint-actions and harden workflows
7db591b 
- Add `persist-credentials: false` to every `actions/checkout`
- Pin floating-tag service images to `tag@sha256:...` in pull-db-tests
- Move `github.ref`, `github.ref_name`, secrets, and step outputs out of
  `run:` blocks into `env:` to prevent template-injection
- Disable `setup-go` cache in release workflows (cache-poisoning)
- Inline-ignore cache-poisoning on `setup-node`'s pnpm cache (per-branch
  scope, only maintainer pushes write to it)
- Wire `zizmor` into `make lint-actions`

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label May 15, 2026
@silverwind silverwind changed the title ci: add zizmor to lint-actions and harden workflows ci: add zizmor to lint-actions May 15, 2026
silverwind and others added 3 commits May 16, 2026 01:37
@silverwind @claude
keep setup-go cache, inline-ignore cache-poisoning instead
4bb46f3 
Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@silverwind @claude
explicit cache: true on setup-go for clarity
79105d8 
Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@silverwind @claude
minimize diff: filter low-confidence findings with --min-confidence=m…
fbccb14 
…edium

Revert the artipacked persist-credentials changes, the explicit setup-go
cache option, and the cache-poisoning inline ignores -- all low-confidence
findings now hidden globally via the new --min-confidence=medium flag in
the Makefile. Keep the env-var extractions for readability and the image
digest pins for unpinned-images (high confidence).

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@silverwind silverwind requested a review from Copilot May 16, 2026 00:01
silverwind
silverwind commented May 16, 2026
View reviewed changes
Comment thread Makefile Outdated
@silverwind
Apply suggestion from @silverwind
a27de5a 
Signed-off-by: silverwind <me@silverwind.io>
Copilot AI reviewed May 16, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds the zizmor GitHub Actions security linter to make lint-actions (at --min-confidence=medium) and resolves all remaining findings by pinning floating service-container images to digests and moving GitHub expressions / secrets out of run: blocks into env: blocks.

Changes:

  • Add zizmor>=1.25.1 as a Python dev dependency and run it via uv run --frozen in the lint-actions Makefile target (now also depends on .venv).
  • In release workflows, move secrets.*, steps.*.outputs, github.ref, and github.ref_name references from inline ${{ … }} interpolations into env: blocks and reference them as shell variables (quoted).
  • In pull-db-tests.yml, pin floating :latest service-container images (gitea/test-openldap, redis, azurite, tabascoterrier/docker-imap-devel) to tag@sha256:… digests.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file
File Description
pyproject.toml Adds zizmor>=1.25.1 to dev dependencies.
uv.lock Lockfile entries for zizmor 1.25.1 wheels/sdist.
Makefile lint-actions now requires .venv and runs zizmor after actionlint.
.github/workflows/release-tag-version.yml Moves secrets/refs into env: and pins shell vars; no behavior change.
.github/workflows/release-tag-rc.yml Same env-block refactor for the RC release workflow.
.github/workflows/release-nightly.yml Same env-block refactor for nightly binary + container jobs.
.github/workflows/pull-db-tests.yml Pins :latest service images to @sha256: digests for ldap/redis/azurite/smtpimap.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

silverwind and others added 4 commits May 16, 2026 02:03
@silverwind @claude
pin zizmor to exact version
60f7655 
Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@silverwind @claude
ensure uv is set up for lint-actions in CI
b414353 
Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@silverwind @claude
also pin python 3.14 for lint-actions path
81118c7 
Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@silverwind @claude
use setup-uv python-version input instead of uv python install
cb3ce67 
Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@silverwind silverwind requested a review from Copilot May 16, 2026 00:10
Copilot AI reviewed May 16, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 16, 2026
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 16, 2026
@lunny lunny added topic/build PR changes how Gitea is built, i.e. regarding Docker or the Makefile reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. labels May 16, 2026
@bircni bircni merged commit 02be228 into go-gitea:main May 16, 2026
21 checks passed
@GiteaBot GiteaBot added this to the 1.27.0 milestone May 16, 2026
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label May 16, 2026
@silverwind silverwind deleted the ci-zizmor branch May 16, 2026 09:05
silverwind added a commit to silverwind/gitea that referenced this pull request May 18, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into ci-cache-improvements
751acd4 
* origin/main: (39 commits)
  fix: Add missed token scope checking (go-gitea#37735)
  chore: Use giteabot instead of backporter (go-gitea#37422)
  fix: Allow direct commits for unprotected files with push restrictions (go-gitea#37657)
  chore: Conventional adjustments (go-gitea#37677)
  chore(db): introduce db.Session and db.EngineMigration interfaces (go-gitea#37746)
  fix(migrations): preserve unique constraints in v334 sync (go-gitea#37743)
  feat(web): also display PR counts in repo list (go-gitea#37739)
  feat: execute post run cleanup when workflow is cancelled (go-gitea#37275)
  fix(actions): wrong assumption that run id always >= job id (go-gitea#37737)
  fix(icon): use repo-forked icon to display forks count (go-gitea#37731)
  fix(oauth): strengthen PKCE validation and refresh token replay protection (go-gitea#37706)
  fix(web): enforce token scopes on raw, media, and attachment downloads (go-gitea#37698)
  feat: Add bypass allowlist for branch protection (go-gitea#36514)
  refactor(glob): use strings.Builder for regexp compilation (go-gitea#37730)
  feat(oauth): Support AWS Cognito OAuth2 provider (go-gitea#37607)
  feat: Add default PR branch update style setting (go-gitea#37410)
  refactor: move `workflowpattern` into `modules/actions` (go-gitea#37717)
  ci: add `zizmor` to `lint-actions` (go-gitea#37720)
  chore(doctor): remove four obsolete doctor check implementations (go-gitea#37728)
  chore(renovate): enable dockerfile manager (go-gitea#37719)
  ...

# Conflicts:
#	modules/globallock/locker_test.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@lunny lunny lunny approved these changes

@bircni bircni bircni approved these changes

Assignees

No one assigned

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. topic/build PR changes how Gitea is built, i.e. regarding Docker or the Makefile

Projects

None yet

Milestone

1.27.0

Development

Successfully merging this pull request may close these issues.

5 participants

@silverwind @lunny @bircni @GiteaBot