Harden CI workflows and add a zizmor lint workflow to the CI#19914

Draft

dkasak wants to merge 28 commits into

developfrom

dkasak/ci-fixes

Commits on Jul 6, 2026

Fix broad permissions in the docs.yaml workflow
dkasak
committed

Commits on Jul 7, 2026

Fix broad permissions in the tests.yml workflow
dkasak
committed
Fix broad permissions in the twisted_trunk.yml workflow
dkasak
committed
Fix broad permissions in the triage-incoming.yml workflow
dkasak
committed
Fix broad permissions in the latest_deps.yml workflow
dkasak
committed
Fix broad permissions in the schema.yaml workflow
dkasak
committed
Fix broad permissions in the poetry_lockfile.yaml workflow
dkasak
committed
Fix broad permissions in the fix_lint.yaml workflow
dkasak
committed
Fix broad permissions in the docs-pr.yaml workflow
dkasak
committed
Make permissions block global in triage_labelled.yml
dkasak
committed
Globally restrict permissions in docker.yml and relax only at job level
dkasak
committed
Add a global read-only permission block to push_complement_image.yml
dkasak
committed
Fix code injection in the release-artifacts.yml workflow
dkasak
committed
Fix broad permissions in the release-artifacts.yml workflow
dkasak
committed
Avoid interpolating expressions into scripts in the release-artifacts.yml workflow
dkasak
committed
Don't persist git credentials after checkout in CI workflows
dkasak
committed
Explicitly ignore the artipacked zizmor lint for fix_lint.yaml
dkasak
committed
Avoid interpolating expressions into scripts in CI workflows
dkasak
committed
Pin the postgres image version in tests.yml
dkasak
committed
Skip the docker layer cache when building debs from a tag
dkasak
committed
Fix the mypy cache key in tests.yml
dkasak
committed
Add a documented exception for zizmor's cache-poisoning for tests.yml
dkasak
committed
Fix broad permissions in the fix_lint.yaml workflow
dkasak
committed
Remove an unused issues permission from the triage-incoming.yml workflow
dkasak
committed
Document the permissions blocks in CI workflows
dkasak
committed
Avoid the remaining expression interpolations in CI workflow scripts
dkasak
committed
Add a zizmor CI workflow to lint the GitHub Actions workflows
dkasak
committed
Add changelog entry
dkasak
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Harden CI workflows and add a zizmor lint workflow to the CI#19914

Harden CI workflows and add a zizmor lint workflow to the CI#19914
dkasak wants to merge 28 commits into
developfrom
dkasak/ci-fixes

Commits on Jul 6, 2026

Fix broad permissions in the docs.yaml workflow

Commits on Jul 7, 2026

Fix broad permissions in the tests.yml workflow

Fix broad permissions in the twisted_trunk.yml workflow

Fix broad permissions in the triage-incoming.yml workflow

Fix broad permissions in the latest_deps.yml workflow

Fix broad permissions in the schema.yaml workflow

Fix broad permissions in the poetry_lockfile.yaml workflow

Fix broad permissions in the fix_lint.yaml workflow

Fix broad permissions in the docs-pr.yaml workflow

Make permissions block global in triage_labelled.yml

Globally restrict permissions in docker.yml and relax only at job level

Add a global read-only permission block to push_complement_image.yml

Fix code injection in the release-artifacts.yml workflow

Fix broad permissions in the release-artifacts.yml workflow

Avoid interpolating expressions into scripts in the release-artifacts.yml workflow

Don't persist git credentials after checkout in CI workflows

Explicitly ignore the artipacked zizmor lint for fix_lint.yaml

Avoid interpolating expressions into scripts in CI workflows

Pin the postgres image version in tests.yml

Skip the docker layer cache when building debs from a tag

Fix the mypy cache key in tests.yml

Add a documented exception for zizmor's cache-poisoning for tests.yml

Fix broad permissions in the fix_lint.yaml workflow

Remove an unused issues permission from the triage-incoming.yml workflow

Document the permissions blocks in CI workflows

Avoid the remaining expression interpolations in CI workflow scripts

Add a zizmor CI workflow to lint the GitHub Actions workflows

Add changelog entry