ci: Integrate zizmor checks to repo#818
Conversation
|
Warning Rate limit exceeded@MaxymVlasov has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 14 minutes and 30 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (3)
📝 WalkthroughSummary by CodeRabbit
Summary by CodeRabbit
WalkthroughThe pull request adds a new repository entry for the Changes
Suggested reviewers
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.pre-commit-config.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (9)
- GitHub Check: 🧪 Tests / pytest@🐍3.9@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.12@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.11@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.12@macos-13
- GitHub Check: 🧪 Tests / pytest@🐍3.11@macos-13
- GitHub Check: 🧪 Tests / pytest@🐍3.10@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.10@macos-13
- GitHub Check: 🧹 Linters / pre-commit@🐍3.13@ubuntu-latest
- GitHub Check: pre-commit
🔇 Additional comments (1)
.pre-commit-config.yaml (1)
68-72: LGTM! Good addition to the security tooling.The integration of Zizmor as a pre-commit hook complements the existing security checks (gitleaks, detect-aws-credentials, detect-private-key) and provides additional coverage alongside CodeQL, specifically for GitHub Actions analysis.
|
Oh, I see, there a bunch of issues in workflows needed to be fixed first |
yermulnik
left a comment
yermulnik
left a comment
There was a problem hiding this comment.
Hope at some point we won't end up running several dozens of GH actions over the handful of scripts that we maintain here 🤣
This comment was marked as resolved.
This comment was marked as resolved.
github-actions
bot
added
stale
MaxymVlasov
added
the
on-hold
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.pre-commit-config.yaml (1)
50-55: Verify Zizmor hook version and streamline its scope
- Ensure that
rev: v1.9.0is the intended stable release and free of known security or compatibility issues by checking the GitHub Releases page or querying the API.- (Optional) Restrict the hook to only run on GitHub Actions workflow files to improve performance and reduce noise:
- id: zizmor files: '^\.github/workflows/.*\.(ya?ml)$'
MaxymVlasov
removed
the
on-hold
MaxymVlasov
force-pushed
the
MaxymVlasov-patch-2
branch
from
c087300 to
e50d2e0
Compare
MaxymVlasov
force-pushed
the
MaxymVlasov-patch-2
branch
from
2192c00 to
dea6ba1
Compare
yermulnik
left a comment
yermulnik
left a comment
There was a problem hiding this comment.
Approved as technically there seem to be no issues.
Please consider comments and commit suggestions as you think they worth it.
|
|
||
| # Github Action static analysis tool | ||
| - repo: https://github.com/woodruffw/zizmor-pre-commit | ||
| rev: v1.9.0 |
There was a problem hiding this comment.
Tag and not commit hash? I thought you tend to trust commits rather than tags 🤔
There was a problem hiding this comment.
We need to switch out from Renovate to pre-commit-freeze then.
I'll do it as separate PR
There was a problem hiding this comment.
I think native pre-commit autoupdate can do the same.
Co-authored-by: George L. Yermulnik <yz@yz.kiev.ua>
Co-authored-by: George L. Yermulnik <yz@yz.kiev.ua>
Co-authored-by: George L. Yermulnik <yz@yz.kiev.ua>
https://github.com/antonbabenko/pre-commit-terraform/actions/runs/15473791768 Invalid workflow file: .github/workflows/scheduled-runs.yml#L41 The workflow is not valid. .github/workflows/scheduled-runs.yml (Line: 41, Col: 22): Invalid secret, CODECOV_TOKEN is not defined in the referenced workflow.
yermulnik
left a comment
yermulnik
left a comment
There was a problem hiding this comment.
A mug of weird black magic for me 🤣 Overall looks good to me in those bits that I was able to understand =)))
|
GitHub failed to run workflows or what -_- Ah, I see |
|
This PR is included in version 1.99.2 🎉 |
There was a problem hiding this comment.
@MaxymVlasov FYI, I got a reusable workflow that integrates with GitHub's security reporting interfaces natively: https://github.com/zizmorcore/workflow/blob/3bb5e95068d0f44b6d2f3f7e91379bed1d2f96a8/.github/workflows/reusable-zizmor.yml. If you add it, you'll get inline alerts right inside PRs.
4 participants
That PR integrate one more static analysis tool, as CodeQL is good, but it not cover all cases
Here is an article about zizmor value - https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection
zizmor repo - https://github.com/woodruffw/zizmor