Merged
Conversation
The if: condition used two separate ${{ }} expansions with == outside
the expression context, causing the condition to always evaluate to
true. Move the comparison inside a single expression so it is properly
evaluated by the GitHub Actions expression engine.
Reported by zizmor (unsound-condition).
Pass github.base_ref through an environment variable instead of interpolating it directly into the run block. Direct interpolation of attacker-controllable context values into shell commands allows code injection. Reported by zizmor (template-injection).
Prevent the checked-out git repository from retaining the GITHUB_TOKEN in the git credential store. This reduces the risk of credential leakage through artifacts or subsequent steps. Reported by zizmor (artipacked).
Pin all action references to their full commit hashes instead of mutable tags. This prevents supply-chain attacks where a compromised tag could point to malicious code. The original tag is preserved in a trailing comment for maintainability. Reported by zizmor (unpinned-uses).
Add explicit empty permissions at the workflow level and grant only the required permissions at the job level. check-pr-labels needs no permissions beyond metadata. label-pr moves contents:read and pull-requests:write from workflow level to only the jobs that need them. Reported by zizmor (excessive-permissions).
…curity issue The semver job in label-pr.yaml checked out untrusted PR code and executed it (make go-version, go-apidiff) with access to a GITHUB_TOKEN that had pull-requests:write permissions. An attacker could modify the Makefile to exfiltrate the token. Split into two workflows following GitHub's recommended pattern: - semver.yaml: triggered by pull_request (read-only permissions), runs the analysis and uploads the result as an artifact. - label-pr.yaml: the semver-label job is triggered by workflow_run (when semver.yaml completes), downloads the artifact, and applies labels with write permissions. It never checks out untrusted code. The edits job stays in label-pr.yaml with pull_request_target as before (it only runs actions/labeler, no code checkout). Reported-by: Christopher Lusk <clusk@redhat.com>
This workflow has no permissions, checks out no code, and accesses no secrets. It only reads the event payload to check for the hold label. pull_request is sufficient and avoids the security concerns of pull_request_target.
Suppress remaining zizmor findings that are intentional: - dangerous-triggers in backport.yaml: only runs on merged PRs, never checks out code. - dangerous-triggers in label-pr.yaml: pull_request_target only runs actions/labeler (no code checkout), workflow_run never executes untrusted code. - secrets-outside-env in backport.yaml, container_image.yaml, release_image.yaml, website.yaml: requires GitHub Environments which is an infrastructure change outside workflow files.
Run zizmor via the official zizmorcore/zizmor-action on pushes to main and pull requests that modify workflow files. Results are uploaded as SARIF to GitHub's Code Scanning / Security tab.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Contributor
|
LGTM |
eshulman2
approved these changes
Mar 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Various fixes for github actions, spotted by zizmor and Christopher Lusk via his Fluxgate tool (https://github.com/north-echo/fluxgate).
Also add a new zizmor github action to scan for potential security risks on workflow changes.