Check GitHub actions with zizmor (SEA-2065)

Author: strfx

.github/workflows/docker-publish.yml

@@ -35,7 +35,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer

.github/workflows/stubtest.yml

@@ -5,9 +5,13 @@ on:
   schedule:
     - cron: '0 7 * * 1'  # run once a week on monday morning
 
+permissions: {}
+
 jobs:
   stubtest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
     - name: Install packages
@@ -30,10 +34,12 @@ jobs:
           postgresql-contrib
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
       with:
         python-version: '3.10'
 

.github/workflows/tests.yml

@@ -5,13 +5,17 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
 
   tests:
     strategy:
       fail-fast: false
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     name: Tests
@@ -37,7 +41,9 @@ jobs:
           postgresql-contrib
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     - name: Get branch name (merge)
       if: github.event_name != 'pull_request'
@@ -54,7 +60,7 @@ jobs:
              >> $GITHUB_ENV
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
       with:
         python-version: '3.10'
 

.github/workflows/zizmor.yml

@@ -0,0 +1,33 @@
+# https://docs.zizmor.sh/integrations/#github-actions
+name: Zizmor (GitHub Actions Security)
+
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # Required for private repos
+      actions: read # Required for private repos
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        with:
+          advanced-security: false

.pre-commit-config.yaml

@@ -55,3 +55,7 @@ repos:
         rev: v8.24.2
         hooks:
           - id: gitleaks
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.28.0
+    hooks:
+      - id: zizmor