🔒 ci(workflows): add zizmor security auditing by gaborbernat · Pull Request #131 · tox-dev/pre-commit-uv

gaborbernat · 2026-03-24T22:38:49Z

GitHub Actions workflows were vulnerable to several security issues including template injection, credential exposure, and permission over-scoping. These vulnerabilities could allow attackers to execute arbitrary code or access sensitive tokens.

This change adds zizmor as a pre-commit hook to continuously audit workflow security and fixes all existing vulnerabilities. The fixes include pinning actions to commit hashes, moving secrets to dedicated environments, isolating GitHub context from shell execution, and restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future workflow changes will be automatically checked before commit.

Add zizmor pre-commit hook to catch GitHub Actions security issues. Fix all existing findings: - template-injection: Move GitHub context to env vars - secrets-outside-env: Add environment declarations - dangerous-triggers: Replace pull_request_target with pull_request - bot-conditions: Use pull_request.user.login instead of github.actor - excessive-permissions: Move permissions to job level - superfluous-actions: Replace with native tools

gaborbernat · 2026-03-24T22:38:49Z

GitHub Actions workflows were vulnerable to several security issues including template injection, credential exposure, and permission over-scoping. These vulnerabilities could allow attackers to execute arbitrary code or access sensitive tokens.

This change adds zizmor as a pre-commit hook to continuously audit workflow security and fixes all existing vulnerabilities. The fixes include pinning actions to commit hashes, moving secrets to dedicated environments, isolating GitHub context from shell execution, and restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future workflow changes will be automatically checked before commit.

Add zizmor pre-commit hook to catch GitHub Actions security issues. Fix all existing findings: - template-injection: Move GitHub context to env vars - secrets-outside-env: Add environment declarations - dangerous-triggers: Replace pull_request_target with pull_request - bot-conditions: Use pull_request.user.login instead of github.actor - excessive-permissions: Move permissions to job level - superfluous-actions: Replace with native tools

gaborbernat · 2026-03-24T22:38:49Z

GitHub Actions workflows were vulnerable to several security issues including template injection, credential exposure, and permission over-scoping. These vulnerabilities could allow attackers to execute arbitrary code or access sensitive tokens.

This change adds zizmor as a pre-commit hook to continuously audit workflow security and fixes all existing vulnerabilities. The fixes include pinning actions to commit hashes, moving secrets to dedicated environments, isolating GitHub context from shell execution, and restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future workflow changes will be automatically checked before commit.

Add zizmor pre-commit hook to catch GitHub Actions security issues. Fix all existing findings: - template-injection: Move GitHub context to env vars - secrets-outside-env: Add environment declarations - dangerous-triggers: Replace pull_request_target with pull_request - bot-conditions: Use pull_request.user.login instead of github.actor - excessive-permissions: Move permissions to job level - superfluous-actions: Replace with native tools

gaborbernat · 2026-03-24T22:38:49Z

GitHub Actions workflows were vulnerable to several security issues including template injection, credential exposure, and permission over-scoping. These vulnerabilities could allow attackers to execute arbitrary code or access sensitive tokens.

This change adds zizmor as a pre-commit hook to continuously audit workflow security and fixes all existing vulnerabilities. The fixes include pinning actions to commit hashes, moving secrets to dedicated environments, isolating GitHub context from shell execution, and restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future workflow changes will be automatically checked before commit.

Add zizmor pre-commit hook to catch GitHub Actions security issues. Fix all existing findings: - template-injection: Move GitHub context to env vars - secrets-outside-env: Add environment declarations - dangerous-triggers: Replace pull_request_target with pull_request - bot-conditions: Use pull_request.user.login instead of github.actor - excessive-permissions: Move permissions to job level - superfluous-actions: Replace with native tools

gaborbernat · 2026-03-24T22:38:49Z

GitHub Actions workflows were vulnerable to several security issues including template injection, credential exposure, and permission over-scoping. These vulnerabilities could allow attackers to execute arbitrary code or access sensitive tokens.

This change adds zizmor as a pre-commit hook to continuously audit workflow security and fixes all existing vulnerabilities. The fixes include pinning actions to commit hashes, moving secrets to dedicated environments, isolating GitHub context from shell execution, and restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future workflow changes will be automatically checked before commit.

Add zizmor pre-commit hook to catch GitHub Actions security issues. Fix all existing findings: - template-injection: Move GitHub context to env vars - secrets-outside-env: Add environment declarations - dangerous-triggers: Replace pull_request_target with pull_request - bot-conditions: Use pull_request.user.login instead of github.actor - excessive-permissions: Move permissions to job level - superfluous-actions: Replace with native tools

gaborbernat · 2026-03-24T22:38:49Z

GitHub Actions workflows were vulnerable to several security issues including template injection, credential exposure, and permission over-scoping. These vulnerabilities could allow attackers to execute arbitrary code or access sensitive tokens.

This change adds zizmor as a pre-commit hook to continuously audit workflow security and fixes all existing vulnerabilities. The fixes include pinning actions to commit hashes, moving secrets to dedicated environments, isolating GitHub context from shell execution, and restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future workflow changes will be automatically checked before commit.

Add zizmor pre-commit hook to catch GitHub Actions security issues. Fix all existing findings: - template-injection: Move GitHub context to env vars - secrets-outside-env: Add environment declarations - dangerous-triggers: Replace pull_request_target with pull_request - bot-conditions: Use pull_request.user.login instead of github.actor - excessive-permissions: Move permissions to job level - superfluous-actions: Replace with native tools

gaborbernat · 2026-03-24T22:38:49Z

GitHub Actions workflows were vulnerable to several security issues including template injection, credential exposure, and permission over-scoping. These vulnerabilities could allow attackers to execute arbitrary code or access sensitive tokens.

This change adds zizmor as a pre-commit hook to continuously audit workflow security and fixes all existing vulnerabilities. The fixes include pinning actions to commit hashes, moving secrets to dedicated environments, isolating GitHub context from shell execution, and restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future workflow changes will be automatically checked before commit.

Add zizmor pre-commit hook to catch GitHub Actions security issues. Fix all existing findings: - template-injection: Move GitHub context to env vars - secrets-outside-env: Add environment declarations - dangerous-triggers: Replace pull_request_target with pull_request - bot-conditions: Use pull_request.user.login instead of github.actor - excessive-permissions: Move permissions to job level - superfluous-actions: Replace with native tools

gaborbernat · 2026-03-24T22:38:49Z

GitHub Actions workflows were vulnerable to several security issues including template injection, credential exposure, and permission over-scoping. These vulnerabilities could allow attackers to execute arbitrary code or access sensitive tokens.

This change adds zizmor as a pre-commit hook to continuously audit workflow security and fixes all existing vulnerabilities. The fixes include pinning actions to commit hashes, moving secrets to dedicated environments, isolating GitHub context from shell execution, and restricting permissions to the minimum required scope.

All workflows now pass security audit with zero findings. Future workflow changes will be automatically checked before commit.

Add zizmor pre-commit hook to catch GitHub Actions security issues. Fix all existing findings: - template-injection: Move GitHub context to env vars - secrets-outside-env: Add environment declarations - dangerous-triggers: Replace pull_request_target with pull_request - bot-conditions: Use pull_request.user.login instead of github.actor - excessive-permissions: Move permissions to job level - superfluous-actions: Replace with native tools

gaborbernat enabled auto-merge (squash) March 24, 2026 22:46

gaborbernat force-pushed the add-zizmor-pre-commit branch from 16438c8 to 2a5f803Compare March 24, 2026 23:07

gaborbernat merged commit 664a5c7 into tox-dev:mainMar 24, 2026
9 checks passed

gaborbernat changed the title ~~Add zizmor pre-commit hook and fix security issues~~🔒 ci(workflows): add zizmor security auditingMar 24, 2026