From ccb0fdb87cec308b6c71f8c103d95ed28e4736d3 Mon Sep 17 00:00:00 2001 From: HarishPermal Date: Tue, 4 Aug 2026 09:45:17 +0530 Subject: [PATCH 1/3] Automate Zizmor security scanning and fix workflow findings --- .github/CODEOWNERS | 2 ++ .github/workflows/build_android.yaml | 8 ++++++-- .github/workflows/static.yml | 10 ++++++---- .github/workflows/zizmor.yml | 27 +++++++++++++++++++++++++++ CONTRIBUTING.md | 9 +++++++++ 5 files changed, 50 insertions(+), 6 deletions(-) create mode 100644 .github/CODEOWNERS create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 000000000..f9bda4a23 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +# Security and infrastructure team approval required for workflows +/.github/workflows/ @security-team @infrastructure-team diff --git a/.github/workflows/build_android.yaml b/.github/workflows/build_android.yaml index b80bcbbaf..b43220fd4 100644 --- a/.github/workflows/build_android.yaml +++ b/.github/workflows/build_android.yaml @@ -15,13 +15,17 @@ build_apk: name: Build Android APK runs-on: ubuntu-latest + permissions: + contents: read defaults: run: working-directory: ./Android/src steps: - name: Checkout the source code - uses: actions/checkout@v3 - - uses: actions/setup-java@v4 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 + with: + persist-credentials: false + - uses: actions/setup-java@d7793b545071e98d581d3bf084a51c3213318a07 # v4 with: distribution: 'temurin' java-version: '21' diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml index d887f6e82..319e7490c 100644 --- a/.github/workflows/static.yml +++ b/.github/workflows/static.yml @@ -32,7 +32,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false # Create the nested directory structure - name: Prepare for nested deployment run: | @@ -40,12 +42,12 @@ jobs: # Move all files (except the staging folder itself) into the subdirectory rsync -rr --exclude='staging' ./skills/ staging/skills/ - name: Setup Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 with: # Upload entire repository path: 'staging/' - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000..f4387a40d --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,27 @@ +name: GitHub Actions Security Audit with zizmor + +on: + push: + branches: ["main"] + pull_request: + branches: ["*"] + +jobs: + zizmor: + name: zizmor latest via uv + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false + + - name: Install uv + uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5 + + - name: Run zizmor 🌈 + run: uvx zizmor . + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f708db422..b70acb680 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -2,3 +2,12 @@ The repository is not currently ready for code contributions. We will make a separate announcement when we are ready for OSS users to make contributions to it. +## Security Requirements + +To maintain a secure development environment, all GitHub Actions workflows and configuration changes are subject to security scanning using [Zizmor](https://github.com/woodruffw/zizmor). + +When contributing to workflows, please ensure: +- All external GitHub Actions are pinned to a specific full-length commit SHA. +- `persist-credentials: false` is set for `actions/checkout` unless strictly required. +- Explicit permissions are defined for all jobs (avoid overly broad permissions). +- All workflows pass Zizmor security checks. From dda0b2c8d647b75d25612e01da6d800b03a3575e Mon Sep 17 00:00:00 2001 From: HarishPermal Date: Wed, 5 Aug 2026 14:00:32 +0530 Subject: [PATCH 2/3] removed CODEOWNERS as the repo doesn't have CODEOWNERS file --- .github/CODEOWNERS | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS deleted file mode 100644 index f9bda4a23..000000000 --- a/.github/CODEOWNERS +++ /dev/null @@ -1,2 +0,0 @@ -# Security and infrastructure team approval required for workflows -/.github/workflows/ @security-team @infrastructure-team From 20d75173049bfca30393245e4d70e452e876a103 Mon Sep 17 00:00:00 2001 From: HarishPermal Date: Wed, 5 Aug 2026 14:09:38 +0530 Subject: [PATCH 3/3] Updated the commit SHAs to latest --- .github/workflows/build_android.yaml | 4 ++-- .github/workflows/zizmor.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build_android.yaml b/.github/workflows/build_android.yaml index b43220fd4..62294091b 100644 --- a/.github/workflows/build_android.yaml +++ b/.github/workflows/build_android.yaml @@ -22,10 +22,10 @@ working-directory: ./Android/src steps: - name: Checkout the source code - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false - - uses: actions/setup-java@d7793b545071e98d581d3bf084a51c3213318a07 # v4 + - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4 with: distribution: 'temurin' java-version: '21' diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index f4387a40d..e87c5b84b 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -19,7 +19,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5 + uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5 - name: Run zizmor 🌈 run: uvx zizmor .