ci: add zizmor security scanning for GitHub Actions workflows - #3053
Merged
Conversation
Contributor
|
View rendered docs @ https://intelpython.github.io/dpnp/index.html |
Add a CI job that runs the zizmor static analyzer over the workflow files under .github/ to catch supply-chain and privilege-escalation weaknesses (unpinned actions, credential persistence, template injection, overly broad permissions). The job runs on pull requests and pushes to master with least-privilege permissions and reports findings as inline annotations.
Replace top-level 'permissions: read-all' with the minimal 'contents: read' in check-onemath, conda-package and conda-package-cf; jobs needing more (actions: write to cancel prior runs, pull-requests: write to comment) already declare their own job-level permissions.
Correct the version comments so they match the pinned commit SHAs (addresses zizmor's mismatched/missing version comment finding); the SHAs themselves are unchanged and already correct: - mshick/add-pr-comment: garbled 'v3.12.0.8.3.12.0' -> 'v3.12.0' in build-sphinx and conda-package. - oprypin/find-latest-tag: '1.1.3' -> 'v1.1.3' in cron-run-tests so the ref resolves.
Set 'cooldown: default-days: 7' on the github-actions, pip, conda and pre-commit update entries so Dependabot waits a week after a release before opening an update PR (Dependabot's implicit default is 3 days). Addresses zizmor's dependabot-cooldown finding and reduces exposure to freshly published malicious or broken versions.
Add 'persist-credentials: false' to the actions/checkout steps so the GITHUB_TOKEN is not persisted in .git/config for later steps (addresses zizmor's artipacked finding). The only credential-pushing steps use explicit tokens (a tokened remote in build-sphinx, the peter-evans/create-pull-request token input in bump-sycl-deps) rather than the persisted checkout credential, so they are unaffected.
Move the inputs.channels-list, inputs.recipe-dir and env.python-conda-spec expansions in the conda-build/rebuild steps into step-level env vars and reference them as shell variables (addresses zizmor's high-severity template-injection findings). CHANNELS_LIST stays unquoted so it splits into separate -c CHANNEL args, with a scoped shellcheck disable; RECIPE_DIR is quoted.
Set min-severity: medium on the zizmor action so the job fails only on medium and high findings. The remaining low/informational template-injection notes come from internally-defined env/matrix values (no external input), so they are still surfaced as annotations but do not block CI.
antonwolfy
force-pushed
the
ci/add-zizmor-security-scan
branch
from
September 1, 2026 11:00
7cbbde2 to
ba9d668
Compare
antonwolfy
marked this pull request as ready for review
September 1, 2026 11:02
antonwolfy
requested review from
ndgrigorian and
vlad-perevezentsev
as code owners
September 1, 2026 11:02
Contributor
|
Array API standard conformance tests for dpnp=0.21.0dev7=py314ha0e2e8e_20 ran successfully. |
Collaborator
|
coverage: 78.487% (-0.002%) from 78.489% — ci/add-zizmor-security-scan into master |
vlad-perevezentsev
approved these changes
Sep 2, 2026
vlad-perevezentsev
left a comment
vlad-perevezentsev
left a comment
Contributor
There was a problem hiding this comment.
LGTM
Thank you @antonwolfy for adding this helpful workflow
Are you planning to do this for dpctl as well?
Contributor
Author
Yes, I'm planning to backport to all repos |
The caller conda-package-cf.yml grants only 'contents: read', but this reusable workflow declared 'permissions: read-all'. GitHub rejects a called workflow that requests more scopes than the caller grants, which made conda-package-cf.yml an invalid workflow file. The jobs here only checkout, build and up/download artifacts, so contents: read suffices.
github-actions Bot
added a commit
that referenced
this pull request
Sep 2, 2026
Adds a CI job that runs the [zizmor](https://docs.zizmor.sh) static analyzer over the workflow files under `.github/`. `zizmor` audits GitHub Actions workflows for supply-chain and privilege-escalation weaknesses — unpinned action references, credential persistence through the checkout token, template injection via `${{ ... }}` expansion in `run:` blocks, and overly broad `GITHUB_TOKEN` permissions. This is a CI/configuration-only change; no library code, tests, or documentation are affected. 1bfd8e6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a CI job that runs the zizmor static analyzer over the workflow files under
.github/.zizmoraudits GitHub Actions workflows for supply-chain and privilege-escalation weaknesses — unpinned action references, credential persistence through the checkout token, template injection via${{ ... }}expansion inrun:blocks, and overly broadGITHUB_TOKENpermissions.This is a CI/configuration-only change; no library code, tests, or documentation are affected.