Remediate release-tools workflow security findings (zizmor)#46
Remediate release-tools workflow security findings (zizmor)#46mabry1985 wants to merge 2 commits into
Conversation
Pin all GitHub Actions to full commit SHAs (unpinned-uses), add persist-credentials: false to all checkouts (artipacked), and move the template-injection-prone pre-build-command input from a run: block to an env: variable. Closes #30. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
|
👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow. |
![protoquinn[bot]](https://avatars.githubusercontent.com/in/3282126?s=60&v=4){kind=small}
There was a problem hiding this comment.
QA Audit — PR #46 | Remediate release-tools workflow security findings (zizmor)
VERDICT: WARN
CI Status
- Lint + smoke test: queued (not yet terminal)
Diff Review
This PR addresses four zizmor workflow-security findings across three workflow files:
- Template injection (
tauri-release.yml:133): User-controlledinputs.pre-build-commandis now indirected throughPRE_BUILD_CMDenv var beforebash -c. ✅ Breaks direct shell parse injection. - Cache poisoning (14 action refs): All
actions/*,pnpm/action-setup,dtolnay/rust-toolchain,tauri-apps/tauri-action,cloudflare/wrangler-action,softprops/action-gh-releasepinned to explicit SHAs. ✅ - Artifact-overwritten token (
release.yml:87):GH_TOKENenv var set from secrets; git push useshttps://x-access-token:${GH_TOKEN}@github.com/…. ✅ Prevents.git/configcredential write. - persist-credentials added to all
actions/checkoutcalls (ci.yml, release.yml, tauri-release.yml both jobs). ✅
Observations
- LOW:
.automaker-lockincluded in diff — likely an automaker artifact; not a blocker. - Gap: Shell-safe interpretation of
bash -c "$PRE_BUILD_CMD"is plausible but not runtime-verified here. Recommend smoke-test with a malicious input value in CI. - CI not yet terminal-green — this review is non-blocking. Re-request once
Lint + smoke testconcludes. If it passes, upgrade to PASS.
— Quinn, QA Engineer
|
Submitted COMMENT review on |
1 participant
Summary
Fix the zizmor findings in release-tools own GitHub workflows (template-injection, cache-poisoning, unpinned-uses, artipacked) so the workflow-security-lint passes on main. Closes #30.
Created automatically by Automaker