ci: Run zizmor for GHA security analysis #11392

sprt · 2025-06-09T02:21:57Z

This runs the zizmor security lint [1] on our GH Actions.
The initial workflow uses [2] as a base.

[1] https://docs.zizmor.sh/
[2] https://docs.zizmor.sh/usage/#use-in-github-actions

stevenhorsman · 2025-06-09T15:27:33Z

.github/workflows/zizmor.yaml

+jobs:
+  zizmor:
+    runs-on: ubuntu-22.04
+    permissions: {}


I'm not sure if we need the job-level explicit permissions block as well as the top-level, but it doesn't do any harm

Interestingly this might be the reason that the report isn't showing up in fact given the copilot review which says it need more permissions to report?

IMO the workflow should still show up. I think Copilot is confused - per zizmor's docs, we only need security-events: write when Advanced Security is enabled. I had disabled it because I thought it'd would fail on our repo, but I just tried enabling it again - let's see.

https://docs.zizmor.sh/usage/#use-in-github-actions

Ah ok - thanks!

stevenhorsman · 2025-06-09T15:47:20Z

Note that since this is a new workflow, it won't appear in this initial PR (even with the pull_request event).

Do you know the reason for this as when I've added pull_request workflows before they have shown up e.g. #10631 and #10958 ? My understanding was that with the pull_request target the workflows are obtained from the source branch?

sprt · 2025-06-09T16:21:51Z

@stevenhorsman Hmm good point, I'm not exactly sure. Maybe because you had workflow_dispatch? Maybe you ran those manually before submitting the PRs? Some people are reporting the same behavior as here in [1], and [2] says "Some events also require the workflow file to be present on the default branch of the repository in order to run."

[1] https://github.com/orgs/community/discussions/25746
[2] https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/triggering-a-workflow#about-workflow-triggers

github-advanced-security · 2025-06-12T14:13:56Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Copilot

Pull Request Overview

This PR adds a new GitHub Actions workflow to run Zizmor security analysis on pull requests that change workflow files.

Introduces .github/workflows/zizmor.yaml to trigger on PR changes to workflow definitions
Configures scoped permissions and concurrency for the Zizmor job
Adds steps to check out the repo and invoke the zizmor-action

Comments suppressed due to low confidence (2)

.github/workflows/zizmor.yaml:1

[nitpick] The workflow name is generic; consider renaming to something like Zizmor Security Analysis for clearer identification in the Actions UI.

name: GHA security analysis

.github/workflows/zizmor.yaml:23

[nitpick] Pinning to a commit SHA is stable but hampers readability and upgrades. Consider using a semver tag such as actions/checkout@v4 or the specific v4.2.2 tag instead.

        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/zizmor.yaml

stevenhorsman · 2025-06-12T14:28:27Z

Is there anyway we can flag this as failing if there is any issues, or even better if there are issues above a certain threshold, so we can spot issues in PRs before they are merged?

sprt · 2025-06-12T14:29:20Z

Is there anyway we can flag this as failing if there is any issues, or even better if there are issues above a certain threshold, so we can spot issues in PRs before they are merged?

Yes! That will be my next step - see the second Important block here: https://github.com/zizmorcore/zizmor-action?tab=readme-ov-file#usage-with-github-advanced-security-recommended

stevenhorsman

LGTM. Thanks! It will be good to see if we can get the ruleset to give us more value as we work to squash these problems and stop them coming back.

gkurz

/lgtm

Thanks @sprt !

This runs the zizmor security lint [1] on our GH Actions. The initial workflow uses [2] as a base. [1] https://docs.zizmor.sh/ [2] https://docs.zizmor.sh/usage/#use-in-github-actions Signed-off-by: Aurélien Bombo <abombo@microsoft.com>

stevenhorsman · 2025-06-26T13:41:25Z

I think my suggestion in the AC meeting was actually wrong - I thought that we using if: ${{ inputs.skip-test != 'yes' }} to check this and hence it was skipped, but that's not the case. Maybe it's related to the actions allowlist?

stevenhorsman · 2025-06-26T13:42:27Z

Maybe it's related to the actions allowlist?

That looks fine to me 😕

stevenhorsman · 2025-06-26T13:43:19Z

Ok, I'm confused now as I realized that this workflow is running: https://github.com/kata-containers/kata-containers/actions/runs/15898700799/job/44836322438?pr=11392. What was the problem you were facing @sprt as I guess I misunderstood?

sprt · 2025-06-26T13:48:00Z

@stevenhorsman No worries we but misunderstood each other, was early for me! My issue is there's a bunch of required tests that are just not running (and not pending on anything either):

sprt · 2025-06-26T13:48:54Z

So maybe indeed those aren't running because the gatekeeper is seeing a workflow-only change?

stevenhorsman · 2025-06-26T13:50:31Z

So maybe indeed those aren't running because the gatekeeper is seeing a workflow-only change?

Yeah, that's right. Gatekeeper is green: https://github.com/kata-containers/kata-containers/actions/runs/15898700802/job/44836322457?pr=11392, so I say use admin rights to merge it 😄

sprt · 2025-06-26T13:55:33Z

Force-merged as discussed above.

sprt added the force-skip-ci label Jun 9, 2025

sprt force-pushed the sprt/zizmor branch from c9eb0a0 to 3780e88 Compare June 9, 2025 15:23

sprt marked this pull request as ready for review June 9, 2025 15:23

sprt requested review from Copilot and stevenhorsman June 9, 2025 15:26

stevenhorsman reviewed Jun 9, 2025

View reviewed changes

This comment was marked as outdated.

Sign in to view

sprt force-pushed the sprt/zizmor branch from 4df8cd0 to 2c3d92c Compare June 9, 2025 16:18

sprt force-pushed the sprt/zizmor branch 2 times, most recently from a8294ba to 1f3607f Compare June 9, 2025 16:51

sprt requested a review from Copilot June 9, 2025 16:54

This comment was marked as outdated.

Sign in to view

sprt mentioned this pull request Jun 9, 2025

Workflow hardening "epic" #11332

Open

25 tasks

sprt added ok-to-test and removed force-skip-ci labels Jun 12, 2025

sprt force-pushed the sprt/zizmor branch 2 times, most recently from 051b052 to e278bab Compare June 12, 2025 14:21

sprt requested review from Copilot and stevenhorsman June 12, 2025 14:25

Copilot AI reviewed Jun 12, 2025

View reviewed changes

.github/workflows/zizmor.yaml Outdated Show resolved Hide resolved

stevenhorsman approved these changes Jun 12, 2025

View reviewed changes

sprt force-pushed the sprt/zizmor branch 2 times, most recently from cf81127 to 9b2d50f Compare June 13, 2025 18:26

sprt force-pushed the sprt/zizmor branch from 9b2d50f to 8eabcfc Compare June 19, 2025 18:52

stevenhorsman added the security Potential or actual security issue label Jun 20, 2025

gkurz approved these changes Jun 20, 2025

View reviewed changes

stevenhorsman added ok-to-test and removed ok-to-test labels Jun 20, 2025

sprt added ok-to-test and removed ok-to-test labels Jun 20, 2025

sprt force-pushed the sprt/zizmor branch 2 times, most recently from 7951570 to f372955 Compare June 20, 2025 19:53

ci: Run zizmor for GHA security analysis

34c8cd8

This runs the zizmor security lint [1] on our GH Actions. The initial workflow uses [2] as a base. [1] https://docs.zizmor.sh/ [2] https://docs.zizmor.sh/usage/#use-in-github-actions Signed-off-by: Aurélien Bombo <abombo@microsoft.com>

stevenhorsman force-pushed the sprt/zizmor branch from f372955 to 34c8cd8 Compare June 26, 2025 09:52

sprt merged commit a1aa3e7 into main Jun 26, 2025
25 of 26 checks passed

sprt deleted the sprt/zizmor branch June 26, 2025 13:55

ci: Run zizmor for GHA security analysis #11392

ci: Run zizmor for GHA security analysis #11392

Uh oh!

Conversation

sprt commented Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stevenhorsman Jun 9, 2025

Choose a reason for hiding this comment

Uh oh!

stevenhorsman Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sprt Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stevenhorsman Jun 9, 2025

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

stevenhorsman commented Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sprt commented Jun 9, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

github-advanced-security bot commented Jun 12, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

stevenhorsman commented Jun 12, 2025

Uh oh!

sprt commented Jun 12, 2025

Uh oh!

stevenhorsman left a comment

Choose a reason for hiding this comment

Uh oh!

gkurz left a comment

Choose a reason for hiding this comment

Uh oh!

stevenhorsman commented Jun 26, 2025

Uh oh!

stevenhorsman commented Jun 26, 2025

Uh oh!

stevenhorsman commented Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sprt commented Jun 26, 2025

Uh oh!

sprt commented Jun 26, 2025

Uh oh!

stevenhorsman commented Jun 26, 2025

Uh oh!

Uh oh!

sprt commented Jun 26, 2025

Uh oh!

Uh oh!

sprt commented Jun 9, 2025 •

edited

Loading

stevenhorsman Jun 9, 2025 •

edited

Loading

sprt Jun 9, 2025 •

edited

Loading

stevenhorsman commented Jun 9, 2025 •

edited

Loading

stevenhorsman commented Jun 26, 2025 •

edited

Loading