ci(security): resolve zizmor findings + fix security workflow startup - #34
Merged
Merged
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Resolves zizmor code-scanning alerts #29-#43: security.yml - Pin reusable security-scan.yml from @main to a SHA (alert #42) - Replace `secrets: inherit` with explicit SEMGREP_APP_TOKEN pass (alert #43) - Add `actions: read` to top-level permissions so CodeQL/zizmor telemetry (`GET /actions/runs/{id}`) can execute under the inherited token. This fixes the recurring startup_failure on main since 2026-05-04. publish.yml - Drop top-level write permissions to `contents: read`; lift `contents: write` only onto the two semantic-release jobs that actually need it (alerts #38-#41). - Add `persist-credentials: false` to all five checkouts so uploaded artifacts can never carry the workflow's git credentials (alerts #33-#37). The release jobs still pass GITHUB_TOKEN explicitly to python-semantic-release. ci.yml - Add `persist-credentials: false` to lint/typecheck/test/build checkouts (alerts #29-#32). Verified locally with `zizmor v1.24.1`: "No findings to report."
WomB0ComB0
force-pushed
the
feat/ci-governance-adoption
branch
from
May 9, 2026 13:58
ae7fb9c to
7b75559
Compare
This was referenced May 9, 2026
WomB0ComB0
added a commit
that referenced
this pull request
May 10, 2026
Two workflows have been failing on every push to main since #34 landed. security.yml — startup_failure The fix in #34 replaced `secrets: inherit` with an explicit `SEMGREP_APP_TOKEN: ${{ ... }}` mapping to address zizmor's `secrets-inherit` warning. The upstream reusable workflow at `resq-software/.github/.github/workflows/security-scan.yml` does not declare a `workflow_call.secrets:` contract, and GitHub Actions rejects callers that try to pass named secrets to a workflow with no declared secrets surface — the run terminates as `startup_failure` before any job starts. Revert to `secrets: inherit` and pin the rationale in a comment. Add `.github/zizmor.yml` to ignore the `secrets-inherit` finding on `security.yml` only, with a TODO pointing to the upstream workflow update needed to make explicit secret passing valid again. publish.yml — `Release` failure `python-semantic-release` pushes the version-bump commit + tag back to main directly. The `default-branch-baseline` ruleset (id 15191038) requires every change to main to come through a PR; bypass mode is `pull_request`, so even bypass actors cannot push directly. The bot's push is rejected with remote: error: GH013: Repository rule violations found remote: - Changes must be made through a pull request. remote: - Required status check "required" is expected. Drop the `push: branches: [main]` trigger so the workflow no longer fires on every commit. `workflow_dispatch` remains, so releases can still be cut manually from the Actions tab or with `gh workflow run Release.yml`. Long-term, restore automation by either adding a bot to ruleset bypass with `bypass_mode: always` or restructuring to a PR-based release flow (semantic-release with `commit: false, push: false` + `peter-evans/create-pull- request`). The workflow file's header comment captures both paths.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ci.yml,publish.yml,security.yml.securityworkflowstartup_failureonmain(since 2026-05-04) by grantingactions: readto the inherited token, which the upstream reusable workflow needs for CodeQL/zizmor telemetry.Changes by file
.github/workflows/security.yml(alerts #42, #43, plus startup fix)resq-software/.github/.github/workflows/security-scan.ymlfrom@main→ SHAee2001974be1e5610cff3a2c669cfab95c7415e7 # main(alert ci: add docstring coverage gate via interrogate #42 – unpinned action reference).secrets: inheritwith explicitSEMGREP_APP_TOKENpass (alert ci(api-docs): sync workflow from resq-software/docs #43 – secrets unconditionally inherited).SEMGREP_APP_TOKENis the only secret the called workflow actually consumes givenenable-semgrep: true.actions: readto top-level permissions. CodeQL + zizmor jobs in the upstream reusable workflow callGET /repos/{owner}/{repo}/actions/runs/{run_id}for telemetry; without this scope the inherited token can't satisfy that, which is what's been killing the schedule + push runs since the upstreamee20019change..github/workflows/publish.yml(alerts #33-#41)permissions:fromcontents/id-token/attestations/packages: writetocontents: read(alerts ci(docs): splice _pages.json into docs.json nav #38-ci(api-docs): cross-link package overview re-export stubs #41 – overly broad permissions).contents: writeto job-level onmcp-releaseanddsa-releaseonly — those are the jobs that need it forpython-semantic-release.mcp-attest,dsa-attest,mcp-publish,dsa-publish, andmcp-dockeralready had appropriate job-level permissions; addedcontents: readtomcp-dockerfor completeness.persist-credentials: falseto all five checkouts (lines 27, 49, 111, 141, 163 — alerts fix(ci): walk submodules + alphabetize README #33-ci: emit README.mdx + plaintext package list #37). The release jobs still passGITHUB_TOKENexplicitly via thetoken:input topython-semantic-release, so functionality is unchanged; this just prevents the credential from being persisted in.git/configwhere uploaded artifacts could leak it..github/workflows/ci.yml(alerts #29-#32)persist-credentials: falseto all four checkouts (lint, typecheck, test, build).Validation
YAML syntax verified with
pyyaml.Out of scope (separate follow-up)
The
Releaseworkflow failure onc485af3(main) is not addressed here. Root cause: thedefault-branch-baselineruleset onmainrequires PR + therequiredstatus check, with bypass modepull_requestonly.python-semantic-releasetries to push the version-bump commit directly back tomainand getsGH013: Repository rule violations. Fixing this requires either:resq-sw(or a dedicated GitHub App) tobypass_actorswithbypass_mode: alwayson ruleset15191038, orpublish.ymlto PR-based releases (semantic-release withcommit: false, push: false, then a follow-up workflow on tag push).Both are larger changes that would obscure this security-focused PR.
Test plan
lint,typecheck,test,build) green on this branchsecurityworkflow goes green (no morestartup_failure)requiredstatus check green