From e30ef1de07acd00853dfe304fcb5306769a09f43 Mon Sep 17 00:00:00 2001 From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com> Date: Sat, 22 Aug 2026 07:16:10 -0700 Subject: [PATCH] ci: add shared security scanning workflow (#4465) * ci: add shared zizmor workflow * ci: remediate zizmor findings Add persist-credentials: false to checkout steps, set Dependabot cooldown, move step outputs into env instead of expanding them into run blocks, and replace the CMD shell with pwsh. --------- Co-authored-by: Doug Barker <3782873+dbarker@users.noreply.github.com> --- .github/dependabot.yml | 6 +++ .github/workflows/benchmark.yml | 3 ++ .github/workflows/ci.yml | 66 +++++++++++++++++++++++- .github/workflows/clang-tidy.yaml | 18 +++++-- .github/workflows/cmake_install.yml | 10 ++++ .github/workflows/codeql-analysis.yml | 1 + .github/workflows/cppcheck.yml | 1 + .github/workflows/dependencies_image.yml | 2 + .github/workflows/doxygen-tidy.yaml | 2 + .github/workflows/fossa.yml | 2 + .github/workflows/iwyu.yml | 1 + .github/workflows/zizmor.yml | 18 +++++++ 12 files changed, 124 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fdce2cfc0b..d0934e49f5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,11 +4,15 @@ updates: directory: "/" schedule: interval: daily + cooldown: + default-days: 7 - package-ecosystem: "devcontainers" directory: "/" schedule: interval: daily + cooldown: + default-days: 7 - package-ecosystem: "github-actions" directory: "/" @@ -16,4 +20,6 @@ updates: interval: "daily" labels: - "GHA" + cooldown: + default-days: 7 diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 7f3f861810..7a571e03a4 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -19,6 +19,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -60,6 +61,8 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # main March 2025 with: name: benchmark_results diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7ef84860f3..38f5420055 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -44,6 +44,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -66,6 +67,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -88,6 +90,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -110,6 +113,8 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: run cmake legacy options test run: ./ci/do_ci.ps1 cmake.legacy_options.test @@ -127,6 +132,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'false' - name: checkout googletest run: | @@ -157,6 +163,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -195,6 +202,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -233,6 +241,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -271,6 +280,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -302,6 +312,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -333,6 +344,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -369,6 +381,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -400,6 +413,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -428,6 +442,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -446,6 +461,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -466,6 +482,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -486,6 +503,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup env: @@ -512,6 +530,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -530,6 +549,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -557,6 +577,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -581,6 +602,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -605,6 +627,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup env: @@ -639,6 +662,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -663,6 +687,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup env: @@ -697,6 +722,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -726,6 +752,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -748,6 +775,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -770,6 +798,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -794,6 +823,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup env: @@ -818,6 +848,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -844,6 +875,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -870,6 +902,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -896,6 +929,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -922,6 +956,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -948,6 +983,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -974,6 +1010,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -1000,6 +1037,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -1026,6 +1064,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Install CMake env: @@ -1053,6 +1092,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Mount Bazel Cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -1085,6 +1125,8 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: install dependencies run: sudo ./ci/install_format_tools.sh - name: validate @@ -1100,6 +1142,8 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: setup run: sudo ./ci/install_format_tools.sh - name: run tests @@ -1115,6 +1159,8 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: check copyright run: ./tools/check_copyright.sh @@ -1129,6 +1175,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -1149,6 +1196,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -1171,6 +1219,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -1191,6 +1240,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -1211,6 +1261,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -1229,6 +1280,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup run: | @@ -1258,6 +1310,8 @@ jobs: - name: check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: install markdownlint-cli run: sudo npm install -g markdownlint-cli@0.46.0 @@ -1275,6 +1329,8 @@ jobs: - name: check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: install shellcheck run: sudo apt install --assume-yes shellcheck - name: run shellcheck @@ -1290,6 +1346,8 @@ jobs: - name: check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: install misspell run: | curl -L -o ./install-misspell.sh https://git.io/misspell @@ -1307,10 +1365,12 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: install docfx run: choco install docfx -y --version=2.58.5 - name: run ./ci/docfx.cmd - shell: cmd + shell: pwsh run: ./ci/docfx.cmd w3c_trace_context_compliance_v1: @@ -1325,6 +1385,7 @@ jobs: - name: Checkout open-telemetry/opentelemetry-cpp uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup env: @@ -1343,6 +1404,7 @@ jobs: - name: Checkout w3c/trace-context repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: w3c/trace-context path: trace-context - name: install dependencies @@ -1369,6 +1431,7 @@ jobs: - name: Checkout open-telemetry/opentelemetry-cpp uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup env: @@ -1387,6 +1450,7 @@ jobs: - name: Checkout w3c/trace-context repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: w3c/trace-context path: trace-context - name: install dependencies diff --git a/.github/workflows/clang-tidy.yaml b/.github/workflows/clang-tidy.yaml index c94d4a80c9..eca921447f 100644 --- a/.github/workflows/clang-tidy.yaml +++ b/.github/workflows/clang-tidy.yaml @@ -31,6 +31,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - name: Setup Environment @@ -72,10 +73,13 @@ jobs: - name: Analyze clang-tidy output id: analyze + env: + BUILD_LOG: ${{ steps.build.outputs.build_log }} + CMAKE_OPTIONS: ${{ matrix.cmake_options }} run: | SCRIPT_OUTPUT=$(python3 ./ci/create_clang_tidy_report.py \ - --build_log ${{ steps.build.outputs.build_log }} \ - --output ./clang_tidy_report-${{ matrix.cmake_options }}.md) + --build_log "$BUILD_LOG" \ + --output "./clang_tidy_report-${CMAKE_OPTIONS}.md") export $SCRIPT_OUTPUT echo "Found $TOTAL_WARNINGS unique warnings" echo "clang-tidy report generated at $REPORT_PATH" @@ -96,11 +100,15 @@ jobs: path: ${{ steps.analyze.outputs.report_path }} - name: Check Warning Limits + env: + WARNING_COUNT: ${{ steps.analyze.outputs.warning_count }} + WARNING_LIMIT: ${{ matrix.warning_limit }} + CMAKE_OPTIONS: ${{ matrix.cmake_options }} run: | - readonly COUNT="${{ steps.analyze.outputs.warning_count }}" - readonly LIMIT="${{ matrix.warning_limit }}" + readonly COUNT="$WARNING_COUNT" + readonly LIMIT="$WARNING_LIMIT" - echo "clang-tidy reported ${COUNT} unique warning(s) with preset '${{ matrix.cmake_options }}'" + echo "clang-tidy reported ${COUNT} unique warning(s) with preset '${CMAKE_OPTIONS}'" echo "Limit is ${LIMIT}" if [ "$COUNT" -gt "$LIMIT" ]; then diff --git a/.github/workflows/cmake_install.yml b/.github/workflows/cmake_install.yml index 9acd4e0469..b0ab565c8d 100644 --- a/.github/workflows/cmake_install.yml +++ b/.github/workflows/cmake_install.yml @@ -25,6 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Build dependencies with vcpkg submodule run: | @@ -49,6 +50,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Build dependencies with vcpkg submodule run: | @@ -73,6 +75,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Setup CI Environment run: | @@ -107,6 +110,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Setup CI Environment run: | @@ -139,6 +143,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Setup CI Environment run: | @@ -174,6 +179,7 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Setup CI Environment run: | @@ -209,6 +215,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Free Disk Space run: ./ci/free_disk_space.sh @@ -250,6 +257,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Free Disk Space run: ./ci/free_disk_space.sh @@ -292,6 +300,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Install CMake run: | @@ -326,6 +335,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Install Dependencies with Homebrew run: | diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 3124a88359..8e2d8fd255 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -30,6 +30,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Install dependencies run: | diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml index c0df8b5a59..bda237b3a8 100644 --- a/.github/workflows/cppcheck.yml +++ b/.github/workflows/cppcheck.yml @@ -20,6 +20,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: Set up dependencies diff --git a/.github/workflows/dependencies_image.yml b/.github/workflows/dependencies_image.yml index 175ae2a66e..ebff0da65a 100644 --- a/.github/workflows/dependencies_image.yml +++ b/.github/workflows/dependencies_image.yml @@ -20,6 +20,8 @@ jobs: - name: checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up QEMU uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 diff --git a/.github/workflows/doxygen-tidy.yaml b/.github/workflows/doxygen-tidy.yaml index 42cb00dbd2..17db7d6844 100644 --- a/.github/workflows/doxygen-tidy.yaml +++ b/.github/workflows/doxygen-tidy.yaml @@ -18,6 +18,8 @@ jobs: DOXYFILE_NAME: 'Doxyfile.lint' steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install doxygen run: | sudo apt-get update diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index d3c29c3fdb..4693bee020 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -18,6 +18,8 @@ jobs: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0 with: diff --git a/.github/workflows/iwyu.yml b/.github/workflows/iwyu.yml index 5e23f9198c..90d1c90a95 100644 --- a/.github/workflows/iwyu.yml +++ b/.github/workflows/iwyu.yml @@ -32,6 +32,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: 'recursive' - name: setup dependencies diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000000..5da178d494 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,18 @@ +name: Zizmor + +on: + push: + branches: [main] + pull_request: + schedule: + - cron: '14 19 * * 4' # weekly at 19:14 UTC on Thursday + workflow_dispatch: + +permissions: {} + +jobs: + zizmor: + permissions: + contents: read # for actions/checkout + security-events: write # for zizmor to upload SARIF results + uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@d9b812f9924a121c6a8276ea2f9e6f5b622cdd4d # v0.10.0