Skip to content

Set up zizmor-action - #1816

Merged
msridhar merged 2 commits into
uber:masterfrom
ZedingZhang:issue-1793-zizmor-action
Sep 6, 2026
Merged

Set up zizmor-action#1816
msridhar merged 2 commits into
uber:masterfrom
ZedingZhang:issue-1793-zizmor-action

Conversation

@ZedingZhang

@ZedingZhang ZedingZhang commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Set up a dedicated zizmor workflow to audit the repository's GitHub Actions configuration on pushes to master and on all pull requests.

The workflow follows the upstream GitHub code scanning integration, grants only the required security-events: write permission, disables persisted checkout credentials, and pins both actions to full commit SHAs.

Validation:

  • actionlint v1.7.12 passes for all workflows.
  • zizmor 1.30.0 reports no findings in both offline and authenticated online audits.
  • git diff --check passes.

Repository configuration required:

  • The initial zizmor run is blocked at startup by the current GitHub Actions allowlist. A repository, organization, or enterprise administrator must allow zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 before this workflow can run. See GitHub's documentation for allowing selected actions.

Fixes #1793.

I used Codex to implement and validate the zizmor-action workflow. I manually reviewed the changes and understand all changes in this pull request.

Assisted-by: Codex (gpt-5)

@ZedingZhang
Set up zizmor-action
74a1d4d 
Run zizmor on pushes to master and all pull requests, upload findings to GitHub code scanning with minimal permissions, and pin each action to a full commit SHA.

Assisted-by: Codex (gpt-5)
@CLAassistant

CLAassistant commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@coderabbitai

coderabbitai Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 90602f0a-21f8-433e-b401-1c52ff7ad2d7

📥 Commits

Reviewing files that changed from the base of the PR and between 519a1bb and 74a1d4d.

📒 Files selected for processing (1)
  • .github/workflows/zizmor.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

Added a GitHub Actions workflow that runs zizmor on pushes to master and on pull requests. The workflow uses restricted default permissions, grants security-events: write, disables checkout credential persistence, and pins the checkout and zizmor action versions.

Merge Risk: ⚪ Minimal · up to e9d05

This adds automated GitHub Actions security auditing for pushes and pull requests with restricted workflow privileges and credential-free checkout. No merge-blocking risk is currently identified.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The workflow satisfies issue #1793 by adding zizmor-action to audit the repository's GitHub Actions configuration on pushes to master and pull requests.
Out of Scope Changes check ✅ Passed The changes are limited to the zizmor security workflow and directly support issue #1793. No unrelated code changes are identified.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check ✅ Passed The title clearly and concisely identifies the main change: setting up zizmor-action for repository workflow auditing.
Description check ✅ Passed The description directly explains the zizmor workflow, its security configuration, validation results, repository setup requirement, and linked issue.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.68%. Comparing base (519a1bb) to head (e9d058b).

Additional details and impacted files 
@@            Coverage Diff            @@
##             master    #1816   +/-   ##
=========================================
  Coverage     87.68%   87.68%           
  Complexity     3434     3434           
=========================================
  Files           110      110           
  Lines         11413    11413           
  Branches       2340     2340           
=========================================
  Hits          10008    10008           
  Misses          654      654           
  Partials        751      751

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-advanced-security

github-advanced-security AI commented Sep 6, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

msridhar
msridhar approved these changes Sep 6, 2026
View reviewed changes

@msridhar msridhar left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@msridhar
msridhar enabled auto-merge (squash) September 6, 2026 18:57
@msridhar
msridhar merged commit e97f8ff into uber:master Sep 6, 2026
17 checks passed
@ZedingZhang
ZedingZhang deleted the issue-1793-zizmor-action branch September 17, 2026 08:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@msridhar msridhar msridhar approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Set up zizmor-action

4 participants

@ZedingZhang @CLAassistant @github-advanced-security @msridhar