Fix zizmor security issues in GitHub Actions workflows #361

jezdez · 2026-01-06T12:18:01Z

This PR addresses security issues identified by zizmor in the GitHub Actions workflows.

Changes

Added explicit permissions to workflows to follow the principle of least privilege
Pinned third-party actions to SHA hashes instead of tags for supply chain security
Added persist-credentials: false to checkout actions where appropriate
Fixed potential injection vulnerabilities by using environment variables instead of direct interpolation

Security Improvements

These changes help protect against:

Privilege escalation via overly permissive workflow tokens
Supply chain attacks from compromised action tags
Script injection attacks via untrusted input

Adds 7-day cooldown period to all Dependabot package ecosystem entries to prevent excessive update frequency and potential supply chain attacks through rapid dependency updates. Detected by: zizmor v1.20.0 (dependabot-cooldown rule)

Prevents Git credentials from being persisted in the workflow environment after checkout, reducing the risk of credential exposure through artifacts or subsequent steps. Affected files: - .github/workflows/labels.yml - .github/workflows/tests.yml (4 checkouts) - .github/workflows/update.yml - check-cla/action.yml Detected by: zizmor v1.20.0 (artipacked rule)

Apply least privilege principle by declaring minimal required permissions for each workflow instead of using default write-all. Detected by: zizmor v1.20.0 (excessive-permissions rule)

Replace direct template expansions with environment variables to prevent potential code injection attacks. Inputs are now passed via env vars which are properly escaped by the shell. Affected files: - canary-release/action.yml - combine-durations/action.yml - create-fork/action.yml - read-file/action.yml - template-files/action.yml - .github/workflows/update.yml Detected by: zizmor v1.20.0 (template-injection rule)

Use process.env and os.environ to access inputs instead of direct template expansion in JavaScript and Python code blocks. Affected files: - set-commit-status/action.yml - read-yaml/action.yml - check-cla/action.yml Detected by: zizmor v1.20.0 (template-injection rule)

Split the CLA workflow into two parts for improved security: 1. cla-trigger.yml: Runs on pull_request_target but only saves PR metadata (number, author, url, sha) to artifacts. No secrets used. 2. cla.yml: Runs on workflow_run after trigger completes. Downloads PR metadata from artifacts and uses secrets safely. This follows the recommended pattern for secure pull_request_target usage by separating untrusted PR context from secret access. Also adds zizmor.yml configuration file with documented suppressions for intentional dangerous trigger usage in: - cla-trigger.yml (saves metadata only, no secrets) - cla.yml (workflow_run with artifact-based PR context) - project.yml (no code checkout, only adds to project)

Permissions for issues:write and pull-requests:write are now defined at the job level (template-files and analyze jobs) rather than workflow level, following least privilege principle.

Use environment variables instead of direct template expansion: - stale.yml: Pass stale action outputs via STALE_OUTPUTS env var - tests.yml: Pass JSON/YAML content via env vars to Python script

for more information, see https://pre-commit.ci

conda-bot · 2026-01-06T12:18:42Z

Template Success

Warning

This is what the audit looks like when the templating has no errors.

Templating Audit

🔄 Fetching files from ./templates
- ✅ file1.txt → .github_cache/template-files/success/file1.txt
  - ✅ (used) stub1.txt
  - ✅ (used) stub2.txt
  - ❌ (missing) stub3.txt
- ⚠️ file2.txt → .github_cache/template-files/success/file2.txt
  - ✅ (used) stub2.txt
  - ❌ (missing) stub3.txt
  - 📚 (context) variable=value
  - ➕ (optional) optional=

Stub	State	Count
`stub1.txt`	✅ (used)	1
`stub2.txt`	✅ (used)	2
`stub3.txt`	❌ (missing)	2

Template Error

Warning

This is what the audit looks like when templating results in errors.

Templating Audit

🔄 Fetching files from ./templates
- ✅ file1.txt → .github_cache/template-files/error/file1.txt
  - ✅ (used) stub1.txt
  - ✅ (used) stub2.txt
  - ❌ (missing) stub3.txt
- ❌ Context missing file2.txt → .github_cache/template-files/error/file2.txt
  - ✅ (used) stub2.txt
  - ❌ (missing) stub3.txt
  - ❌ (missing) variable=
  - ➕ (optional) optional=

Stub	State	Count
`stub1.txt`	✅ (used)	1
`stub2.txt`	✅ (used)	2
`stub3.txt`	❌ (missing)	2

Got 1 error(s)

jezdez · 2026-01-06T14:18:07Z

The comment above is to be expected because of the change to the template-files action files.

dbast · 2026-01-08T15:46:56Z

@jezdez any reason not to add zizmor as pre-commit hook via?:

  - repo: https://github.com/zizmorcore/zizmor-pre-commit
    rev: v1.20.0
    hooks:
      - id: zizmor

dbast · 2026-01-08T15:58:07Z

as this is the central repo maybe adding actionlint is also of additional help to find things before they come to the consumers of the actions:

  - repo: https://github.com/rhysd/actionlint
    rev: v1.7.9
    hooks:
      - id: actionlint

jezdez · 2026-01-09T10:51:23Z

No, these are good ideas, you're right! But adding the actions wouldn't have made these changes

kenodegard · 2026-01-16T15:49:50Z

Cannot make changes to the following here (as they're synced from conda/infrastructure):

cla.yml
issues.yml
labels.yml
project.yml
stale.yml
update.yml

edit: but I'm starting to wonder if some of the workflows should be synced from here instead, e.g., it makes more sense for the cla workflow to live here alongside the cla action?

kenodegard · 2026-01-16T15:54:14Z

Can we combine cla-trigger with cla? Isn't it possible to define permissions per job instead of on the workflow level?

jezdez added 8 commits January 6, 2026 11:57

Add cooldown configuration to Dependabot updates

c2ec562

Adds 7-day cooldown period to all Dependabot package ecosystem entries to prevent excessive update frequency and potential supply chain attacks through rapid dependency updates. Detected by: zizmor v1.20.0 (dependabot-cooldown rule)

Add explicit permissions to workflow files

4520650

Apply least privilege principle by declaring minimal required permissions for each workflow instead of using default write-all. Detected by: zizmor v1.20.0 (excessive-permissions rule)

Move write permissions to job level in tests.yml

c037ba0

Permissions for issues:write and pull-requests:write are now defined at the job level (template-files and analyze jobs) rather than workflow level, following least privilege principle.

Fix remaining template injection findings

6cd1c66

Use environment variables instead of direct template expansion: - stale.yml: Pass stale action outputs via STALE_OUTPUTS env var - tests.yml: Pass JSON/YAML content via env vars to Python script

jezdez requested a review from a team as a code owner January 6, 2026 12:18

[pre-commit.ci] auto fixes from pre-commit.com hooks

ea2827a

for more information, see https://pre-commit.ci

conda-bot added this to 🔎 Review Jan 6, 2026

github-project-automation bot moved this to 🆕 New in 🔎 Review Jan 6, 2026

conda-bot added the cla-signed [bot] added once the contributor has signed the CLA label Jan 6, 2026

More hooks (#362)

208d3c8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix zizmor security issues in GitHub Actions workflows #361

Fix zizmor security issues in GitHub Actions workflows #361

Uh oh!

jezdez commented Jan 6, 2026

Uh oh!

conda-bot commented Jan 6, 2026 •

edited

Loading

Uh oh!

jezdez commented Jan 6, 2026

Uh oh!

dbast commented Jan 8, 2026 •

edited

Loading

Uh oh!

dbast commented Jan 8, 2026

Uh oh!

jezdez commented Jan 9, 2026 •

edited

Loading

Uh oh!

kenodegard commented Jan 16, 2026 •

edited

Loading

Uh oh!

kenodegard commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Fix zizmor security issues in GitHub Actions workflows #361

Are you sure you want to change the base?

Fix zizmor security issues in GitHub Actions workflows #361

Uh oh!

Conversation

jezdez commented Jan 6, 2026

Changes

Security Improvements

Uh oh!

conda-bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Template Success

Template Error

Uh oh!

jezdez commented Jan 6, 2026

Uh oh!

dbast commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dbast commented Jan 8, 2026

Uh oh!

jezdez commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kenodegard commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kenodegard commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

conda-bot commented Jan 6, 2026 •

edited

Loading

dbast commented Jan 8, 2026 •

edited

Loading

jezdez commented Jan 9, 2026 •

edited

Loading

kenodegard commented Jan 16, 2026 •

edited

Loading