From 12536ac34b2f99106092a69462dd22416fa54a9b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?P=C3=A9ter=20Garamv=C3=B6lgyi?= Date: Sat, 15 Mar 2025 13:49:30 +0100 Subject: [PATCH] ci: add zizmor (#1146) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * ci: add zizmor * trigger ci * adjust permissions * typo * adjust * adjust * chore: auto version bump [bot] * adjust * adjust * fix * chore: auto version bump [bot] * undo bump version * fix branch --------- Co-authored-by: Thegaram <7571518+Thegaram@users.noreply.github.com> --- .github/workflows/bump_version.yml | 14 ++++++++---- .github/workflows/docker-arm64.yaml | 3 +++ .github/workflows/docker.yaml | 2 ++ .github/workflows/l2geth_ci.yml | 11 ++++++++-- .github/workflows/semgrep.yml | 1 + .github/workflows/zizmor.yml | 34 +++++++++++++++++++++++++++++ 6 files changed, 59 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/bump_version.yml b/.github/workflows/bump_version.yml index 39bdbc979f..fd5fc98b1f 100644 --- a/.github/workflows/bump_version.yml +++ b/.github/workflows/bump_version.yml @@ -14,12 +14,18 @@ jobs: try-to-bump: if: contains(github.event.pull_request.labels.*.name, 'bump-version') runs-on: ubuntu-latest + permissions: + # Give the default GITHUB_TOKEN write permission to commit and push the + # added or changed files to the repository. + contents: write + steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: ref: ${{ github.head_ref }} - persist-credentials: false + # note: this is needed by git-auto-commit-action below + persist-credentials: true - name: check diff id: check_diff @@ -29,7 +35,7 @@ jobs: # fetch develop branch so that we can diff against later git fetch origin develop - echo 'checking verion changes in diff...' + echo 'checking version changes in diff...' # check if version changed in version.go # note: the grep will fail if use \d instead of [0-9] @@ -59,7 +65,7 @@ jobs: run: node .github/scripts/bump_version_dot_go.mjs # Commits made by this Action do not trigger new Workflow runs - - uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a + - uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5.1.0 if: steps.check_diff.outputs.result == 'bump' with: skip_fetch: true # already did fetch in check diff diff --git a/.github/workflows/docker-arm64.yaml b/.github/workflows/docker-arm64.yaml index 55c299d6a2..9962e17bab 100644 --- a/.github/workflows/docker-arm64.yaml +++ b/.github/workflows/docker-arm64.yaml @@ -11,6 +11,8 @@ on: jobs: build-and-push-arm64-image: runs-on: ubuntu-latest + permissions: {} + strategy: matrix: arch: @@ -32,6 +34,7 @@ jobs: uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 with: cache-binary: false + - name: Login to Docker Hub uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0 with: diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml index 46ad8e00d7..3f1f5f3ad7 100644 --- a/.github/workflows/docker.yaml +++ b/.github/workflows/docker.yaml @@ -10,6 +10,8 @@ on: jobs: build-and-push: runs-on: ubuntu-latest + permissions: {} + steps: - name: Checkout code uses: actions/checkout@v2 diff --git a/.github/workflows/l2geth_ci.yml b/.github/workflows/l2geth_ci.yml index f7efb4d9ac..8cb0541926 100644 --- a/.github/workflows/l2geth_ci.yml +++ b/.github/workflows/l2geth_ci.yml @@ -1,3 +1,5 @@ +name: CI + on: push: branches: # we keep this to avoid triggering `push` & `pull_request` every time we update a PR @@ -11,12 +13,12 @@ on: - reopened - synchronize - ready_for_review -name: CI -jobs: +jobs: build-mock-ccc-geth: # build geth with mock circuit capacity checker if: github.event.pull_request.draft == false runs-on: ubuntu-latest + permissions: {} steps: - name: Install Go uses: actions/setup-go@v2 @@ -35,6 +37,7 @@ jobs: build-geth: # build geth with circuit capacity checker if: github.event_name == 'push' # will only be triggered when pushing to main & staging & develop & alpha runs-on: ubuntu-latest + permissions: {} steps: - name: Install Go uses: actions/setup-go@v2 @@ -62,6 +65,7 @@ jobs: check: if: github.event.pull_request.draft == false runs-on: ubuntu-latest + permissions: {} steps: - name: Install Go uses: actions/setup-go@v2 @@ -81,6 +85,7 @@ jobs: goimports-lint: if: github.event.pull_request.draft == false runs-on: ubuntu-latest + permissions: {} steps: - name: Install Go uses: actions/setup-go@v2 @@ -107,6 +112,7 @@ jobs: go-mod-tidy-lint: if: github.event.pull_request.draft == false runs-on: ubuntu-latest + permissions: {} steps: - name: Install Go uses: actions/setup-go@v2 @@ -130,6 +136,7 @@ jobs: test: if: github.event.pull_request.draft == false runs-on: ubuntu-latest + permissions: {} steps: - name: Install Go uses: actions/setup-go@v2 diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 0e8e8fba03..d889f76141 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -15,6 +15,7 @@ jobs: semgrep: name: semgrep/ci runs-on: ubuntu-20.04 + permissions: {} env: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} container: diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000000..689f2e66ca --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,34 @@ +name: zizmor GA Security Analysis + +on: + push: + branches: ["develop"] + pull_request: + branches: ["**"] + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + permissions: + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Install the latest version of uv + uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1 + + - name: Run zizmor + run: uvx zizmor --format sarif . > results.sarif + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif + category: zizmor