Lint our GHA workflows #18
Comments
zizmor is a new tool to lint GitHub Actions workflows. For the most part our workflows are pretty low risk since we don't give it a bunch of credentials, but we can avoid issues in the future by locking them down now. Two overall issues needed to be fixed: * setting persist-credentials: false for actions/checkout, which we do everywhere except in the workflows that need to push. * Don't use template expansion when we can use a normal bash variable. While zizmor is written in Rust, it is also shipped as a prebuilt binary via PyPI, so we can set it as a poetry dependency and run it as part of our normal lint CI. Refs <freedomofpress/securedrop-tooling#18>.
|
I submitted an initial PR for securedrop-client since that repo isn't currently going through a release. Overall I found the explanations at https://woodruffw.github.io/zizmor/audits/ pretty useful in figuring out the solution. I think it's silly that actions/checkout does the insecure thing by default. One interesting part of zizmor is the "personas" configuration it has: https://woodruffw.github.io/zizmor/usage/#using-personas. When I use which I understand is a security risk in theory, but I don't think hash pinning is anything other than security theater since we're not even auditing the actions or checking what's changed. IMO it's more important that we only use actions we trust (i.e. official GitHub ones and similar). So I think sticking with the default persona is probably how we should go with to begin.
It's also built and published to PyPI as documented in https://woodruffw.github.io/zizmor/usage/#use-in-github-actions, so I think that's an easier way for us to integrate for now, and freedomofpress/securedrop-client#2331 demonstrates how trivial it was to add to poetry. P.S. It feels kind of stupid to add this type of linting to literally every repository we maintain that has CI, but at the same time once I think of them as just code instead of CI manifests, it seems more logical that all the code we use/ship should be linted. 🤷🏾 |
zizmor is a new tool to lint GitHub Actions workflows. For the most part our workflows are pretty low risk since we don't give it a bunch of credentials, but we can avoid issues in the future by locking them down now. The only issue that needed fixing was setting persist-credentials: false for actions/checkout, which we do everywhere except in the workflows that need to push. While zizmor is written in Rust, it is also shipped as a prebuilt binary via PyPI, so we can set it as a poetry dependency and run it as part of our normal lint CI. Refs <freedomofpress/securedrop-tooling#18>.
zizmor is a new tool to lint GitHub Actions workflows. For the most part our workflows are pretty low risk since we don't give it a bunch of credentials, but we can avoid issues in the future by locking them down now. Two overall issues needed to be fixed: * setting persist-credentials: false for actions/checkout, which we do everywhere except in the workflows that need to push. * Don't use template expansion when we can use a normal bash variable. While zizmor is written in Rust, it is also shipped as a prebuilt binary via PyPI, so we can set it as a pip dependency and run it as part of our normal lint CI. Refs <freedomofpress/securedrop-tooling#18>.
|
Thanks to Ro for reviewing and approving the client PR, I've submitted two more PRs for the workstation and server repos, and created a checklist in the issue description. |
We don't really have any credentials in CI, the main thing is that the client and workstation repos have push tokens for apt-test/yum-test/build-logs (the last one is probably the most sensitive).
https://woodruffw.github.io/zizmor/ is one I had seen previously on lobsters and now it's mentioned on https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/ so we should give it a shot.
It's written in Rust and the recommendation is to cargo install it, so we can do something like https://github.com/freedomofpress/securedrop/blob/develop/.github/workflows/cargo-vet.yml
Primary repositories
Docs repos
Package repositories
n.b. these don't have a Python toolchain setup
Misc
The text was updated successfully, but these errors were encountered: