ci: add shared security scanning workflow - #2557
Closed
opentelemetrybot wants to merge 4 commits into
Closed
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
80 tasks
There was a problem hiding this comment.
Pull request overview
This PR adds repository-wide GitHub Actions security scanning via the OpenTelemetry shared zizmor reusable workflow, and applies related workflow hardening changes (credential persistence, safer shell interpolation, and tighter secret passing).
Changes:
- Add a new
.github/workflows/zizmor.ymlworkflow using the pinned OpenTelemetry shared zizmor workflow and uploading SARIF to code scanning. - Harden multiple workflows by disabling
actions/checkoutcredential persistence, avoidingsecrets: inheritwhere possible, and reducing risky expression interpolation in shell. - Add Dependabot cooldown configuration to reduce update PR churn.
Reviewed changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/zizmor.yml | Adds shared zizmor scanning workflow pinned to an immutable commit. |
| .github/workflows/release-layer-ruby.yml | Disables checkout credential persistence; narrows secrets passed to reusable workflows; improves shell quoting for gh. |
| .github/workflows/release-layer-python.yml | Disables checkout credential persistence; narrows secrets passed to reusable workflows; improves shell quoting for gh. |
| .github/workflows/release-layer-nodejs.yml | Disables checkout credential persistence; narrows secrets passed to reusable workflows; improves shell quoting for gh. |
| .github/workflows/release-layer-java.yml | Disables checkout credential persistence; narrows secrets passed to reusable workflows; improves shell quoting for gh. |
| .github/workflows/release-layer-collector.yml | Disables checkout credential persistence; narrows secrets passed to reusable workflows; improves shell quoting for gh. |
| .github/workflows/publish-layer-collector.yml | Hardens shell interpolation for dispatch inputs and build args; narrows secrets passed to layer publish workflow. |
| .github/workflows/pr-checks.yaml | Adds zizmor suppression comment for pull_request_target trigger and disables checkout credential persistence. |
| .github/workflows/layer-publish.yml | Declares workflow-call secrets; reduces risky interpolation by passing inputs via env in shell steps. |
| .github/workflows/integration-test.yml | Declares required workflow-call secret for AWS role; reduces risky interpolation by passing inputs via env; disables checkout credential persistence. |
| .github/workflows/fossa.yml | Disables checkout credential persistence. |
| .github/workflows/codeql.yml | Disables checkout credential persistence. |
| .github/workflows/ci-terraform.yml | Disables checkout credential persistence. |
| .github/workflows/ci-shellcheck.yml | Disables checkout credential persistence. |
| .github/workflows/ci-python.yml | Disables checkout credential persistence. |
| .github/workflows/ci-nodejs.yml | Disables checkout credential persistence. |
| .github/workflows/ci-java.yml | Disables checkout credential persistence. |
| .github/workflows/ci-collector.yml | Disables checkout credential persistence; improves shell quoting. |
| .github/workflows/check-links.yaml | Replaces read-all with explicit permissions; disables checkout credential persistence. |
| .github/dependabot.yml | Adds cooldown.default-days settings across ecosystems. |
| .github/actions/build-collector-layer/action.yml | Hardens shell interpolation for action inputs by passing via env and quoting. |
Suppressed comments (1)
.github/workflows/publish-layer-collector.yml:146
- The JSON emitted to
$GITHUB_OUTPUTforrelease_jobshas the same quoting issue: the inner double quotes aroundarchitecture/aws_regionare not escaped. This will break the shell quoting and/or produce invalid JSON, causingfromJSON(needs.prepare-release-jobs.outputs.release_jobs)to fail.
fi
echo "release_jobs={"architecture": ${architectures}, "aws_region": ${aws_regions}}" | tr -d '[:space:]' >> $GITHUB_OUTPUT
env:
GITHUB_EVENT_INPUTS_ARCHITECTURE: ${{ github.event.inputs.architecture }}
GITHUB_EVENT_INPUTS_AWS_REGION: ${{ github.event.inputs.aws-region }}
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+85
to
+89
| architectures="[\"${GITHUB_EVENT_INPUTS_ARCHITECTURE}\"]" | ||
| fi | ||
| echo "build_jobs={"architecture": ${architectures}}" | tr -d '[:space:]' >> $GITHUB_OUTPUT | ||
| env: | ||
| GITHUB_EVENT_INPUTS_ARCHITECTURE: ${{ github.event.inputs.architecture }} |
Comment on lines
+143
to
+146
| echo "release_jobs={"architecture": ${architectures}, "aws_region": ${aws_regions}}" | tr -d '[:space:]' >> $GITHUB_OUTPUT | ||
| env: | ||
| GITHUB_EVENT_INPUTS_ARCHITECTURE: ${{ github.event.inputs.architecture }} | ||
| GITHUB_EVENT_INPUTS_AWS_REGION: ${{ github.event.inputs.aws-region }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tracked in open-telemetry/sig-security#293.
Adds zizmor scanning through the OpenTelemetry shared workflow.
The workflow:
regularpersona on pull requests, pushes tomain, and a randomized weekly schedule;After merge
zizmorcode-scanning result.If enforcement unexpectedly blocks a valid change, restore
require_zizmor = falseinopen-telemetry/adminwhile leaving scanning enabled.