From f1a13deb9d054dc94f6b78c7b0aca413d3eca96f Mon Sep 17 00:00:00 2001 From: Philipp Scheit Date: Tue, 16 Jun 2026 15:58:11 +0200 Subject: [PATCH 1/2] Add zizmor GitHub Actions security analysis Adds the zizmorcore/zizmor-action workflow to audit our Actions workflows for security issues (unpinned uses, excessive permissions, injection risks, etc). Mirrors the setup in private-packagist, with the path filter adapted to also match this repo's *.yaml workflow files. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/zizmor.yml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..30b7ce5 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,35 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: + - main + paths: + - '.github/workflows/*.yml' + - '.github/workflows/*.yaml' + pull_request: + paths: + - '.github/workflows/*.yml' + - '.github/workflows/*.yaml' + +permissions: + contents: read + +jobs: + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + with: + advanced-security: false + annotations: true + online-audits: false From cc6ad7b9a943eb08b033a1fa73d8ee9a5b9553ab Mon Sep 17 00:00:00 2001 From: Philipp Scheit Date: Tue, 16 Jun 2026 16:07:18 +0200 Subject: [PATCH 2/2] Harden CI workflow: restrict permissions, disable credential persistence Addresses the zizmor warnings on continuous-integration.yaml: - add a top-level `permissions: contents: read` block (the jobs only need read access) instead of relying on the broad default token - set `persist-credentials: false` on all checkout steps so the token is not written to the runner's git config Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/continuous-integration.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/continuous-integration.yaml b/.github/workflows/continuous-integration.yaml index 0031848..78a7d47 100644 --- a/.github/workflows/continuous-integration.yaml +++ b/.github/workflows/continuous-integration.yaml @@ -8,6 +8,9 @@ on: branches: - 'main' +permissions: + contents: read + jobs: code-style: runs-on: 'ubuntu-22.04' @@ -16,6 +19,8 @@ jobs: php: ['8.1'] steps: - uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # v4 + with: + persist-credentials: false - uses: 'shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45' # v2 with: coverage: 'none' @@ -44,6 +49,8 @@ jobs: php: ['8.1'] steps: - uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # v4 + with: + persist-credentials: false - uses: 'shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45' # v2 with: coverage: 'none' @@ -72,6 +79,8 @@ jobs: php: ['8.1'] steps: - uses: 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5' # v4 + with: + persist-credentials: false - uses: 'shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45' # v2 with: coverage: 'none'