From 7adcbed727ad09aabbea65c1ed0f9dd7d5989026 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Mon, 2 Mar 2026 07:24:51 +0000 Subject: [PATCH] fix(ci): zizmor security improvements (#10207) --- .github/actions/trivy-scan/action.yml | 2 +- .github/workflows/api-tests.yml | 2 +- .github/workflows/backport.yml | 1 + .github/workflows/labeler.yml | 1 + .github/workflows/mcp-container-build-push.yml | 2 +- .github/workflows/mcp-pypi-release.yml | 6 +++++- .github/workflows/pr-conflict-checker.yml | 1 + .github/workflows/pr-merged.yml | 5 +++-- .github/workflows/sdk-container-build-push.yml | 2 +- .github/workflows/sdk-pypi-release.yml | 6 ++++-- .github/workflows/test-impact-analysis.yml | 18 ++++++++++-------- .github/workflows/ui-container-build-push.yml | 2 +- .github/workflows/ui-e2e-tests-v2.yml | 7 +++++-- .github/workflows/ui-tests.yml | 2 +- 14 files changed, 36 insertions(+), 21 deletions(-) diff --git a/.github/actions/trivy-scan/action.yml b/.github/actions/trivy-scan/action.yml index 5faf8cb118..d1aee6df94 100644 --- a/.github/actions/trivy-scan/action.yml +++ b/.github/actions/trivy-scan/action.yml @@ -126,7 +126,7 @@ runs: const comment = require('./.github/scripts/trivy-pr-comment.js'); // Unique identifier to find our comment - const marker = ''; + const marker = ``; const body = marker + '\n' + comment; // Find existing comment diff --git a/.github/workflows/api-tests.yml b/.github/workflows/api-tests.yml index 57190b76df..00bffc1952 100644 --- a/.github/workflows/api-tests.yml +++ b/.github/workflows/api-tests.yml @@ -43,7 +43,7 @@ jobs: services: postgres: - image: postgres + image: postgres:17@sha256:2cd82735a36356842d5eb1ef80db3ae8f1154172f0f653db48fde079b2a0b7f7 env: POSTGRES_HOST: ${{ env.POSTGRES_HOST }} POSTGRES_PORT: ${{ env.POSTGRES_PORT }} diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 974d919fc6..79e578ffae 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -1,6 +1,7 @@ name: 'Tools: Backport' on: + # zizmor: ignore[dangerous-triggers] - intentional: needs write access for backport PRs, no PR code checkout pull_request_target: branches: - 'master' diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 1f44080229..ac181ce350 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -1,6 +1,7 @@ name: 'Tools: PR Labeler' on: + # zizmor: ignore[dangerous-triggers] - intentional: needs write access to apply labels, no PR code checkout pull_request_target: branches: - 'master' diff --git a/.github/workflows/mcp-container-build-push.yml b/.github/workflows/mcp-container-build-push.yml index fe5f6bf11c..f5a677400b 100644 --- a/.github/workflows/mcp-container-build-push.yml +++ b/.github/workflows/mcp-container-build-push.yml @@ -167,7 +167,7 @@ jobs: - name: Install regctl if: always() - uses: regclient/actions/regctl-installer@main + uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main - name: Cleanup intermediate architecture tags if: always() diff --git a/.github/workflows/mcp-pypi-release.yml b/.github/workflows/mcp-pypi-release.yml index 0861f55b5a..31c22114ec 100644 --- a/.github/workflows/mcp-pypi-release.yml +++ b/.github/workflows/mcp-pypi-release.yml @@ -61,9 +61,13 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + with: + persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7 + with: + enable-cache: false - name: Set up Python ${{ env.PYTHON_VERSION }} uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0 diff --git a/.github/workflows/pr-conflict-checker.yml b/.github/workflows/pr-conflict-checker.yml index fde5107482..37dc5cc462 100644 --- a/.github/workflows/pr-conflict-checker.yml +++ b/.github/workflows/pr-conflict-checker.yml @@ -1,6 +1,7 @@ name: 'Tools: PR Conflict Checker' on: + # zizmor: ignore[dangerous-triggers] - intentional: needs write access for conflict labels/comments, checkout uses PR head SHA for read-only grep pull_request_target: types: - 'opened' diff --git a/.github/workflows/pr-merged.yml b/.github/workflows/pr-merged.yml index eb37d5aa8e..41856b0ede 100644 --- a/.github/workflows/pr-merged.yml +++ b/.github/workflows/pr-merged.yml @@ -1,6 +1,7 @@ name: 'Tools: PR Merged' on: + # zizmor: ignore[dangerous-triggers] - intentional: needs read access to merged PR metadata, no PR code checkout pull_request_target: branches: - 'master' @@ -26,7 +27,7 @@ jobs: id: vars run: | SHORT_SHA="${GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA}" - echo "SHORT_SHA=${SHORT_SHA::7}" >> $GITHUB_ENV + echo "short_sha=${SHORT_SHA::7}" >> $GITHUB_OUTPUT env: GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }} @@ -39,7 +40,7 @@ jobs: client-payload: | { "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}", - "PROWLER_COMMIT_SHORT_SHA": "${{ env.SHORT_SHA }}", + "PROWLER_COMMIT_SHORT_SHA": "${{ steps.vars.outputs.short_sha }}", "PROWLER_PR_NUMBER": "${{ github.event.pull_request.number }}", "PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }}, "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }}, diff --git a/.github/workflows/sdk-container-build-push.yml b/.github/workflows/sdk-container-build-push.yml index 39ec5aa89c..b0c00da53e 100644 --- a/.github/workflows/sdk-container-build-push.yml +++ b/.github/workflows/sdk-container-build-push.yml @@ -247,7 +247,7 @@ jobs: - name: Install regctl if: always() - uses: regclient/actions/regctl-installer@main + uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main - name: Cleanup intermediate architecture tags if: always() diff --git a/.github/workflows/sdk-pypi-release.yml b/.github/workflows/sdk-pypi-release.yml index 55ed7351d8..369bf582fb 100644 --- a/.github/workflows/sdk-pypi-release.yml +++ b/.github/workflows/sdk-pypi-release.yml @@ -60,6 +60,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + with: + persist-credentials: false - name: Install Poetry run: pipx install poetry==2.1.1 @@ -68,7 +70,6 @@ jobs: uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0 with: python-version: ${{ env.PYTHON_VERSION }} - cache: 'poetry' - name: Build Prowler package run: poetry build @@ -92,6 +93,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + with: + persist-credentials: false - name: Install Poetry run: pipx install poetry==2.1.1 @@ -100,7 +103,6 @@ jobs: uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0 with: python-version: ${{ env.PYTHON_VERSION }} - cache: 'poetry' - name: Install toml package run: pip install toml diff --git a/.github/workflows/test-impact-analysis.yml b/.github/workflows/test-impact-analysis.yml index b684ec4e09..c3f1ecf62f 100644 --- a/.github/workflows/test-impact-analysis.yml +++ b/.github/workflows/test-impact-analysis.yml @@ -82,13 +82,13 @@ jobs: else echo "has-sdk-tests=false" >> $GITHUB_OUTPUT fi - + if [[ -n "${STEPS_IMPACT_OUTPUTS_API_TESTS}" ]]; then echo "has-api-tests=true" >> $GITHUB_OUTPUT else echo "has-api-tests=false" >> $GITHUB_OUTPUT fi - + if [[ -n "${STEPS_IMPACT_OUTPUTS_UI_E2E}" ]]; then echo "has-ui-e2e=true" >> $GITHUB_OUTPUT else @@ -103,23 +103,25 @@ jobs: run: | echo "## Test Impact Analysis" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - + if [[ "${STEPS_IMPACT_OUTPUTS_RUN_ALL}" == "true" ]]; then echo "🚨 **Critical path changed - running ALL tests**" >> $GITHUB_STEP_SUMMARY else echo "### Affected Modules" >> $GITHUB_STEP_SUMMARY echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY - + echo "### Tests to Run" >> $GITHUB_STEP_SUMMARY echo "| Category | Paths |" >> $GITHUB_STEP_SUMMARY echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY - echo "| SDK Tests | \`${{ steps.impact.outputs.sdk-tests || 'none' }}\` |" >> $GITHUB_STEP_SUMMARY - echo "| API Tests | \`${{ steps.impact.outputs.api-tests || 'none' }}\` |" >> $GITHUB_STEP_SUMMARY - echo "| UI E2E | \`${{ steps.impact.outputs.ui-e2e || 'none' }}\` |" >> $GITHUB_STEP_SUMMARY + echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY + echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY + echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> $GITHUB_STEP_SUMMARY fi env: STEPS_IMPACT_OUTPUTS_RUN_ALL: ${{ steps.impact.outputs.run-all }} - + STEPS_IMPACT_OUTPUTS_SDK_TESTS: ${{ steps.impact.outputs.sdk-tests }} + STEPS_IMPACT_OUTPUTS_API_TESTS: ${{ steps.impact.outputs.api-tests }} + STEPS_IMPACT_OUTPUTS_UI_E2E: ${{ steps.impact.outputs.ui-e2e }} STEPS_IMPACT_OUTPUTS_MODULES: ${{ steps.impact.outputs.modules }} diff --git a/.github/workflows/ui-container-build-push.yml b/.github/workflows/ui-container-build-push.yml index 8cb803ca7e..81d4aa69cb 100644 --- a/.github/workflows/ui-container-build-push.yml +++ b/.github/workflows/ui-container-build-push.yml @@ -166,7 +166,7 @@ jobs: - name: Install regctl if: always() - uses: regclient/actions/regctl-installer@main + uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main - name: Cleanup intermediate architecture tags if: always() diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml index 7736887c69..0e8a146b26 100644 --- a/.github/workflows/ui-e2e-tests-v2.yml +++ b/.github/workflows/ui-e2e-tests-v2.yml @@ -15,6 +15,9 @@ on: - 'ui/**' - 'api/**' # API changes can affect UI E2E +permissions: + contents: read + jobs: # First, analyze which tests need to run impact-analysis: @@ -93,7 +96,7 @@ jobs: NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }} - name: Create k8s Kind Cluster - uses: helm/kind-action@v1 + uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1 with: cluster_name: kind @@ -154,7 +157,7 @@ jobs: node-version: '24.13.0' - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4 with: version: 10 run_install: false diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml index 9076f38d9f..4ee0658010 100644 --- a/.github/workflows/ui-tests.yml +++ b/.github/workflows/ui-tests.yml @@ -83,7 +83,7 @@ jobs: - name: Setup pnpm if: steps.check-changes.outputs.any_changed == 'true' - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4 with: version: 10 run_install: false