Harden CI workflows and add a zizmor lint workflow to the CI#19914
Draft
dkasak wants to merge 28 commits into
Draft
Harden CI workflows and add a zizmor lint workflow to the CI#19914dkasak wants to merge 28 commits into
dkasak wants to merge 28 commits into
Conversation
`github.context` isn't defined in this context, so the entire `github.context.sha` expression evaluates to an empty string. As the comment above it says, the recipe was cribbed from a TypeScript script where `github.context` *is* defined, unlike within a GHA workflow file. The correct replacement in a workflow file is `github.sha`.
dkasak
changed the title
Member
Author
|
Ah oops, seems I have to re-run while giving zizmor some more access so it can detect some unpinned deps so converting to draft again while I sort that out. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Checklist
EventStoretoEventWorkerStore.".code blocks.Signed-off-by: Denis Kasak dkasak@termina.org.uk
Notes for reviewers
This should be reviewable commit by commit. I generally attempted to go one workflow file at a time, except when I forgot something and then went back, or in the case of
persist-credentials: falsewhich is noisy enough so I did it all at once.In
triage-incoming.ymlI removedissues: writebecause it seems to me that the write permission is never used forGITHUB_TOKEN. Instead the workflow calls thetriage-incoming.ymlreuseable workflow frommatrix-org/backend-metaand passes itELEMENT_BOT_TOKENdirectly.Another thing of note is that
tests.ymlwas using an unpinnedpostgresimage which I believe defaulted tolatest, but I chosepostgres:17instead because that's the latest explicitly tested version in that file. Not sure if that's correct.I generally replaced all interpolated expressions with a variant that passes them through an env var, regardless of whether they would be at all controllable by an attacker or not, because I think this pattern is the better practice. It automatically demonstrates that there's no way for shell injection to happen rather than having to reason through each interpolation spot.
Apart from fixing Zizmor and CodeQL lints regarding workflows, this also fixes a cache key which was using
github.context.sha, which is undefined in GHA, instead ofgithub.sha