ci: add zizmor pre-commit hook - #732
Merged
Merged
Conversation
bschwedler
approved these changes
Aug 12, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Aug 12, 2026
ianpittwood
enabled auto-merge
August 17, 2026 16:24
ianpittwood
disabled auto-merge
August 17, 2026 16:24
Resolve the setup-goss/action.yml conflict by taking main's version. PR #731 refactored that action (pinned goss version plus result caching) and in doing so already moved every inputs.* reference into env: blocks, which supersedes this branch's separate injection fix for setup-goss.
Fourteen actions/checkout steps across the shared reusable workflows relied on the default persist-credentials: true, which writes the job token into the workspace .git/config. zizmor's artipacked audit flags this as a credential-exfiltration risk: if a later step uploads the workspace (including .git) as an artifact, the token leaks into a downloadable, retained location. None of these jobs run an authenticated git operation after checkout -- registry logins carry their own credentials, bakery reads the workspace read-only, and gh release / gh pr use the GH_TOKEN env var rather than git config. Setting persist-credentials: false therefore removes the token with no behavior change and resolves the finding at its source instead of suppressing it. The two checkouts that genuinely need the persisted credential -- product-release (git push and PR creation with an App token) and docs (gh-pages publish) -- keep their exemptions, now the only entries in the artipacked ignore list. Neither uploads .git as an artifact, so no leak path remains. This also drops the stale bakery-build-native.yml line-number exemptions, letting the zizmor pre-commit hook report no findings.
…ials Disable git credential persistence on checkouts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Testing
uvx pre-commit run --all-files