Skip to content

ci: add zizmor workflow security audits - #169

Open
Ben Challis (ben-challis) wants to merge 4 commits into
ben-challis/actionlint-cifrom
ben-challis/zizmor-ci
Open

ci: add zizmor workflow security audits#169
Ben Challis (ben-challis) wants to merge 4 commits into
ben-challis/actionlint-cifrom
ben-challis/zizmor-ci

Conversation

@ben-challis

@ben-challisBen Challis (ben-challis) commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Stack

This PR is stacked on the Actionlint PR: #168

Summary

  • run Zizmor v1.29.0 through the allow-listed official zizmorcore/zizmor-action
  • use least-privilege permissions and disable checkout credential persistence
  • narrow the release GitHub App token permissions

Verification

  • actionlint -color
  • local Zizmor 1.29.0 static audit: no findings
  • official Zizmor action CI audit
  • git diff --check

Comment thread.github/workflows/zizmor.yaml Outdated
Comment on lines +29 to +34
run: |
archive="$RUNNER_TEMP/zizmor.tar.gz"
curl -fsSL "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" -o "$archive"
echo "${ZIZMOR_SHA256} $archive" | sha256sum --check
tar -xzf "$archive" -C "$RUNNER_TEMP"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Binary, code or archive is pulled from a remote source without integrity verification - medium severity
A GitHub Actions Workflow was built using an artifact from a remote source without any integrity verification. If the remote artifact were silently replaced with a malicious version (for example, through a supply chain attack), the integrity and confidentiality of the environment in which the container is deployed could be compromised.

Show fix

Remediation: Validate the artifact against a trusted SHA-512 checksum in the CI/CD pipeline using sha512sum in check mode. Store the expected checksum in a file (e.g., artifact.sha512), then verify it with: sha512sum -c artifact.sha512. Enable strict error handling (for example, set -e in shell scripts) so the pipeline fails if verification fails or outputs errors.

Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

Copy link
Copy Markdown
CollaboratorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aikido Security (@AikidoSec) ignore: The downloaded Zizmor archive is already verified immediately after download with sha256sum --check against the pinned SHA-256 digest, before extraction.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Based on your feedback, we ignored this issue because of the following reason:

The downloaded Zizmor archive is already verified immediately after download with sha256sum --check against the pinned SHA-256 digest, before extraction.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@ben-challis