From a69e8b0bece1b5f4f7e56879402b146c47fbbfa8 Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Thu, 3 Sep 2026 12:46:45 +0200 Subject: [PATCH 1/2] ci: harden GitHub Actions workflows and add zizmor scan Backport of IntelPython/dpctl#2374. - Narrow top-level `permissions: read-all` to `contents: read`. - Add `persist-credentials: false` to all actions/checkout steps. - Add a 7-day cooldown to the dependabot update entries. - Add a zizmor workflow that scans .github/ for supply-chain and privilege-escalation issues in GitHub Actions workflows. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 4 ++ .github/workflows/build-docs.yml | 3 +- .github/workflows/build-with-clang.yml | 4 +- .../workflows/build-with-standard-clang.yml | 4 +- .github/workflows/build_pip.yml | 4 +- .github/workflows/conda-package-cf.yml | 6 ++- .github/workflows/conda-package.yml | 5 ++- .github/workflows/coverity.yml | 2 + .github/workflows/openssf-scorecard.yml | 3 +- .github/workflows/pre-commit.yml | 4 +- .github/workflows/zizmor.yml | 39 +++++++++++++++++++ 11 files changed, 70 insertions(+), 8 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b840d80a..b404563e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,8 @@ updates: schedule: interval: "weekly" day: "saturday" + cooldown: + default-days: 7 rebase-strategy: "disabled" labels: ["autoupdate"] groups: @@ -16,6 +18,8 @@ updates: schedule: interval: "weekly" day: "saturday" + cooldown: + default-days: 7 rebase-strategy: "disabled" labels: ["autoupdate"] groups: diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml index a1e8e0c2..e83e8cbf 100644 --- a/.github/workflows/build-docs.yml +++ b/.github/workflows/build-docs.yml @@ -5,7 +5,8 @@ on: push: branches: [master] -permissions: read-all +permissions: + contents: read env: PACKAGE_NAME: mkl_random diff --git a/.github/workflows/build-with-clang.yml b/.github/workflows/build-with-clang.yml index 45137e15..6826c1a0 100644 --- a/.github/workflows/build-with-clang.yml +++ b/.github/workflows/build-with-clang.yml @@ -4,7 +4,8 @@ on: push: branches: [master] -permissions: read-all +permissions: + contents: read jobs: build-with-clang: @@ -49,6 +50,7 @@ jobs: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Install mkl_random dependencies diff --git a/.github/workflows/build-with-standard-clang.yml b/.github/workflows/build-with-standard-clang.yml index 783057e2..2a903b50 100644 --- a/.github/workflows/build-with-standard-clang.yml +++ b/.github/workflows/build-with-standard-clang.yml @@ -5,7 +5,8 @@ on: push: branches: [master] -permissions: read-all +permissions: + contents: read jobs: build-with-standard-clang: @@ -43,6 +44,7 @@ jobs: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Install mkl_random dependencies diff --git a/.github/workflows/build_pip.yml b/.github/workflows/build_pip.yml index f02747bd..0a145d11 100644 --- a/.github/workflows/build_pip.yml +++ b/.github/workflows/build_pip.yml @@ -6,7 +6,8 @@ on: - master pull_request: -permissions: read-all +permissions: + contents: read jobs: build: @@ -23,6 +24,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 diff --git a/.github/workflows/conda-package-cf.yml b/.github/workflows/conda-package-cf.yml index 0fb666eb..74c670ec 100644 --- a/.github/workflows/conda-package-cf.yml +++ b/.github/workflows/conda-package-cf.yml @@ -5,7 +5,8 @@ on: push: branches: [master] -permissions: read-all +permissions: + contents: read env: PACKAGE_NAME: mkl_random @@ -39,6 +40,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Set pkgs_dirs @@ -111,6 +113,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 @@ -348,6 +351,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 diff --git a/.github/workflows/conda-package.yml b/.github/workflows/conda-package.yml index a9333f6c..7a4fbe21 100644 --- a/.github/workflows/conda-package.yml +++ b/.github/workflows/conda-package.yml @@ -5,7 +5,8 @@ on: push: branches: [master] -permissions: read-all +permissions: + contents: read env: PACKAGE_NAME: mkl_random @@ -41,6 +42,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Set pkgs_dirs @@ -127,6 +129,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 22e4d37e..d03c123f 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -42,6 +42,8 @@ jobs: steps: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 diff --git a/.github/workflows/openssf-scorecard.yml b/.github/workflows/openssf-scorecard.yml index b1399edd..095f38b9 100644 --- a/.github/workflows/openssf-scorecard.yml +++ b/.github/workflows/openssf-scorecard.yml @@ -16,7 +16,8 @@ on: branches: [ "master" ] # Declare default permissions as read only. -permissions: read-all +permissions: + contents: read jobs: analysis: diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 1791f921..11635bf9 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -5,7 +5,8 @@ on: push: branches: [master] -permissions: read-all +permissions: + contents: read jobs: pre-commit: @@ -15,6 +16,7 @@ jobs: - name: Checkout repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false # use commit hash to make "no-commit-to-branch" check passing ref: ${{ github.sha }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..826e7016 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,39 @@ +name: Security scan of GitHub Actions workflows (zizmor) + +on: + push: + branches: + - master + pull_request: + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + zizmor: + name: Scan GitHub Actions workflows + + runs-on: ubuntu-latest + timeout-minutes: 10 + + permissions: + contents: read # needed to clone the repo + + steps: + - name: Checkout mkl_random repo + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3 + with: + # Low/informational template-injection notes come from internally-defined + # values (no external input), so they are reported as annotations but do not gate CI + min-severity: medium + advanced-security: false + annotations: true + inputs: .github/ From d806f22b941ce658fafcb5c047c230ba546d0fda Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Thu, 3 Sep 2026 12:51:09 +0200 Subject: [PATCH 2/2] ci: match cancel-workflow-action version comment to real tag zizmor's stale-action-refs audit flagged the styfle/cancel-workflow-action pins: the SHA is correct, but its tag is `0.13.1` (no `v` prefix), so the `# v0.13.1` comment resolved to an unknown ref. Drop the `v` to match the actual tag and let the zizmor scan pass. --- .github/workflows/build-docs.yml | 2 +- .github/workflows/build-with-clang.yml | 2 +- .github/workflows/conda-package-cf.yml | 6 +++--- .github/workflows/conda-package.yml | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml index e83e8cbf..2f338399 100644 --- a/.github/workflows/build-docs.yml +++ b/.github/workflows/build-docs.yml @@ -20,7 +20,7 @@ jobs: pull-requests: write steps: - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # v0.13.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }} - name: Add Intel repository diff --git a/.github/workflows/build-with-clang.yml b/.github/workflows/build-with-clang.yml index 6826c1a0..15d15578 100644 --- a/.github/workflows/build-with-clang.yml +++ b/.github/workflows/build-with-clang.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # v0.13.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }} diff --git a/.github/workflows/conda-package-cf.yml b/.github/workflows/conda-package-cf.yml index 74c670ec..b76793d6 100644 --- a/.github/workflows/conda-package-cf.yml +++ b/.github/workflows/conda-package-cf.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # v0.13.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }} @@ -107,7 +107,7 @@ jobs: steps: - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # v0.13.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }} @@ -345,7 +345,7 @@ jobs: steps: - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # v0.13.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }} diff --git a/.github/workflows/conda-package.yml b/.github/workflows/conda-package.yml index 7a4fbe21..c45bf389 100644 --- a/.github/workflows/conda-package.yml +++ b/.github/workflows/conda-package.yml @@ -36,7 +36,7 @@ jobs: steps: - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # v0.13.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }} @@ -123,7 +123,7 @@ jobs: steps: - name: Cancel Previous Runs - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # v0.13.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }}