ci: Add zizimor as workflow to get GH-native alerts#930
Conversation
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds a new GitHub Actions job lint-github-actions to .github/workflows/ci-cd.yml, invoking a reusable workflow pinned to a specific commit, with security-events: write permissions and an inline yamllint line-length disable. No existing jobs modified or removed. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub
participant WF as CI Workflow (ci-cd.yml)
participant Lint as Job: lint-github-actions
participant Reuse as Reusable Workflow (zizmor)
participant Sec as Security Events
Dev->>GH: Push/PR event
GH->>WF: Trigger workflow
WF->>Lint: Start job
Lint->>Reuse: Invoke reusable workflow (pinned commit)
Reuse->>Reuse: Lint GitHub Actions definitions
alt Findings reported
Reuse-->>Sec: Write security events (permission: write)
end
Reuse-->>Lint: Job status
Lint-->>WF: Result
WF-->>GH: CI status update
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
There was a problem hiding this comment.
Pull Request Overview
Adds a security-focused workflow to lint GitHub Actions using the zizmorcore/workflow reusable workflow, which integrates with GitHub's native security alerts system.
- Introduces a new
lint-github-actionsjob with security-events write permissions - Uses a pinned commit hash for the external reusable workflow
- Includes a yamllint disable comment for the long workflow reference line
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/ci-cd.yml (2)
509-515: Decide whether this job should gate the branch-protection “check”.Right now, the “check” aggregator doesn’t include this job in needs, so failures won’t block merges. If intentional, ignore. If not, add it to needs and allowed-skips.
check: # This job does nothing and is only used for the branch protection @@ - needs: - - lint - - tests + needs: + - lint + - tests + - lint-github-actions @@ - && 'lint, tests' + && 'lint, tests, lint-github-actions'
514-514: Yamllint disable is fine here.uses: must be single-line; disabling line-length locally is the right call. Consider adding a brief comment “long SHA pin” for future readers.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/ci-cd.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: 🧪 Tests / pytest@🐍3.11@macos-13
- GitHub Check: 🧪 Tests / pytest@🐍3.13@macos-14
- GitHub Check: 🧪 Tests / pytest@🐍3.9@macos-14
- GitHub Check: 🧪 Tests / pytest@🐍3.9@macos-13
- GitHub Check: pre-commit
|
This PR is included in version 1.100.1 🎉 |
Description of your changes
Another bit of security improvements.
Addressing #818 (comment)
Workflow body: https://github.com/zizmorcore/workflow/blob/main/.github/workflows/reusable-zizmor.yml