Fix: resolve zizmor auditor persona findings - #120
Merged
tykeal merged 1 commit intoJul 8, 2026
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR aims to clear zizmor “auditor” persona findings that block Dependabot merges by hardening workflows and reducing template-injection risk in the composite action.
Changes:
- Updated composite
action.yamlto hoist${{ inputs.* }}out ofrun:blocks and replace$GITHUB_ENVwrites with step outputs via$GITHUB_OUTPUT. - Added workflow-level
concurrencycontrols andpersist-credentials: falseto reduce credential persistence and improve workflow safety. - Replaced/tag-aligned release workflows with hardened-runner “block” mode and documented permission scopes.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| action.yaml | Reworks composite-action input handling and output propagation to address template-injection and $GITHUB_ENV findings. |
| .github/workflows/testing.yaml | Adds workflow concurrency and disables credential persistence on checkout steps. |
| .github/workflows/tag-push.yaml | Adds workflow concurrency and hardens runner egress policy using an allow-list + block mode. |
| .github/workflows/release-drafter.yaml | Adds workflow concurrency, hardens runner egress policy, and updates the release-drafter pin. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ModeSevenIndustrialSolutions
force-pushed
the
fix/zizmor-auditor-findings
branch
from
July 8, 2026 13:41
3afc34f to
99f3b01
Compare
Resolve the zizmor auditor-persona findings (min-severity low) that
fail the organisation's required "Audit Workflows" gate and block
Dependabot pull requests from merging.
- Replace the boilerplate `tag-push` and `release-drafter` workflows
with the canonical `actions-template` versions. This adds the
workflow-level `concurrency` group (`concurrency-limits`),
harden-runner block-mode egress via `harden-runner-block-action`,
and documented permission scopes (`undocumented-permissions`).
- testing.yaml: add a workflow-level `concurrency` group
(`concurrency-limits`) and set `persist-credentials: false` on both
checkout steps (`artipacked`).
- action.yaml: hoist all `${{ inputs.* }}` expressions out of `run:`
blocks into step-level environment variables and reference them as
quoted shell variables (`template-injection`). Replace the dangerous
`$GITHUB_ENV` writes with `$GITHUB_OUTPUT` step outputs
(`github-env`): the setup step now publishes `path_prefix` and the
dependency-install step publishes `kernel_flags` and `flags`;
downstream steps consume these via `steps.<id>.outputs.*` hoisted
into their own step environments. Shell behaviour (word splitting
of flags, glob expansion of the notebook path) is preserved.
Verified clean with:
zizmor --persona auditor --min-severity low
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
force-pushed
the
fix/zizmor-auditor-findings
branch
from
July 8, 2026 14:06
99f3b01 to
24e059d
Compare
tykeal
approved these changes
Jul 8, 2026
tykeal
left a comment
tykeal
left a comment
Contributor
There was a problem hiding this comment.
🤖 Dependamerge
Approved this pull request ✅
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the zizmor auditor persona findings (
min-severity: low)that fail the organisation's required "Audit Workflows" gate and block
Dependabot pull requests from merging.
Method
tag-push,release-drafter) thatcarried findings were replaced byte-for-byte with the canonical
versions from
actions-template. This adds the workflow-levelconcurrencygroup (concurrency-limits), harden-runner block-modeegress via
harden-runner-block-action, and documented permissionscopes (
undocumented-permissions).testing.yaml: added a workflow-levelconcurrencygroup(
concurrency-limits) andpersist-credentials: falseon bothcheckout steps (
artipacked).action.yaml: all${{ inputs.* }}expressions were hoisted outof
run:blocks into step-level environment variables and are nowreferenced as quoted shell variables (
template-injection). Thedangerous
$GITHUB_ENVwrites were replaced with$GITHUB_OUTPUTstep outputs (
github-env): the setup step publishespath_prefix,the dependency-install step publishes
kernel_flags/flags, anddownstream steps consume them via
steps.<id>.outputs.*hoisted intotheir own step environments. Shell behaviour (word splitting of flag
variables, glob expansion of the notebook path) is preserved.
Verified with
zizmor --persona auditor --min-severity low(clean),with no action pin downgrades.