Skip to content

[zizmor] Security fixes for workflow vulnerabilities + zizmor workflow #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Vombato wants to merge 5 commits into
base: main
Choose a base branch
from
+30 −2
Open

[zizmor] Security fixes for workflow vulnerabilities + zizmor workflow #105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2f0d862
fix: template-injection vulnerability
Vombato Oct 15, 2025
9c5f7ca
fix: Security fixes for Zizmor findings
Vombato Oct 17, 2025
8c83483
Merge branch 'main' into fix/zizmor-security-fixes-20251017-113942
Vombato Nov 27, 2025
f99ec61
fix: permission at job level
Vombato Nov 27, 2025
ffd6950
feat: add zizmor workflow
Vombato Nov 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/run-e2e-tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,14 @@ on:

permissions:
checks: write
pull-requests: write

jobs:
e2e_tests:
name: Run E2E Tests
runs-on: ubuntu-latest
permissions:
checks: write
pull-requests: write
environment: ${{ inputs.environment || 'default-private' }}
steps:
- name: Checkout code
Expand Down Expand Up @@ -92,7 +94,7 @@ jobs:
run: yarn docker:logs

- name: Publish Results
uses: dorny/test-reporter@v1
uses: dorny/test-reporter@d61b558e8df85cb60d09ca3e5b09653b4477cea7 # v1
id: test-reporter
if: ${{ github.repository == 'vechain/thor-e2e-tests' && (success() || failure()) }}
with:
Expand Down
26 changes: 26 additions & 0 deletions .github/workflows/scan-workflows.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: Zizmor Scan

on:
push:
branches: ["main"]
pull_request:
branches: ["**"]
paths: ['.github/workflows/**']

permissions: {}

jobs:
zizmor:
uses: vechain/github-actions-public/.github/workflows/scan-workflows.yaml@77660aeff2fac9bbb704b3a2ce786814d0b632fa # v.1.1.0
with:
persona: 'auditor'
min_severity: 'high'
min_confidence: 'high'
permissions:
contents: read
actions: read
checks: write
issues: write
pull-requests: write
secrets:
ZIZMOR_TOKEN: ${{ secrets.ZIZMOR_TOKEN }}
Loading