Automate GitHub workflow security audits with `zizmor` by namurphy · Pull Request #2975 · PlasmaPy/PlasmaPy

namurphy · 2025-03-25T22:51:35Z

zizmor is a static analysis tool to find common security issues in typical GitHub workflows. This PR:

Adds a Nox session to run zizmor
Fixes some security issues found by zizmor (like changing pull_request_target → pull_request, setting persist-credentials: false, and setting strict default permissions)
Sets up .github/zizmor.yml to ignore zizmor warnings and errors that are more difficult to fix.

The changes here are probably going to result in a bunch of conflicts in #2959, but it makes sense to merge this first.

Many thanks to the pyOpenSci community for helping me learn about zizmor in the first place!

Note

Several zizmor checks require a GitHub token, so running the zizmor Nox session locally will skip certain checks.

codecov · 2025-03-25T22:59:13Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.40%. Comparing base (5c17b8f) to head (91e046f).
⚠️ Report is 162 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2975      +/-   ##
==========================================
+ Coverage   94.61%   95.40%   +0.78%     
==========================================
  Files         107      107              
  Lines        9664     9664              
  Branches     1464     1464              
==========================================
+ Hits         9144     9220      +76     
+ Misses        327      257      -70     
+ Partials      193      187       -6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

namurphy · 2025-03-26T14:36:33Z

Following a helpful suggestion by our neighbors at SunPy in sunpy/sunpy#8134, I'm leaning towards putting this as a standalone Nox session that can be put into our CI workflow.

… pre-commit-zizmor

…izmor

namurphy · 2025-04-28T22:23:53Z

.github/workflows/changelog.yml

    needs: add-no-changelog-label
    steps:
-    - uses: scientific-python/action-towncrier-changelog@v1
+    - uses: scientific-python/action-towncrier-changelog@v1 # zizmor: ignore[unpinned-uses]


The unpinned-uses rule checks that actions used via uses are pinned to a specific commit rather than the version. We can ignore this check for actions that come from trusted publishers.

namurphy · 2025-04-28T22:27:39Z

.github/workflows/update-pinned-reqs.yml


    - name: Generate token
-      uses: tibdex/github-app-token@v2
+      uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0


It seems reasonable to pin actions by the commit hash (for extra security) if they are released by individuals or small organizations.

…izmor

namurphy · 2025-04-28T22:39:53Z

noxfile.py

-    uv_output: str | bool = session.run(*uv_lock_upgrade, silent=running_on_ci)
+    uv_output: str | bool = session.run(
+        *uv_lock_upgrade,
+        *session.posargs,


[unrelated change] Including *session.posargs here makes it so that we can pass flags to uv when running the Nox session (i.e., nox -s requirements -- -v).

namurphy · 2025-04-28T22:44:13Z

@rocco8773 — would you have a chance to review this in the next few days? With the changes merged and conflicts resolved from #2959, I don't think there should be anything controversion in this PR. Kind thanks!

rocco8773

Things looks good to me.

The only thing I go umm about is the use of # zimor: ignore[artipacked]. I'm not concerned about it being used, but more concerned a contributor might not know it exists and when to use it. I can just see myself updating a workflow in the future that causes a zizmor check to fail and I just forget that this inline comment exists.

I do not think adding a note about this to the documentation would help. The only thing I can think of doing is having a PR comment be made when zizmor check fails.

I do not think this needs to be resolved in the PR, but it is something to consider for a follow up PR.

namurphy · 2025-04-29T20:39:58Z

The only thing I go umm about is the use of # zimor: ignore[artipacked]. I'm not concerned about it being used, but more concerned a contributor might not know it exists and when to use it.

The only thing I can think of doing is having a PR comment be made when zizmor check fails.

That's an important point. ✅ It wouldn't be hard to have the Nox session for zizmor print out a troubleshooting message. 🤔

I do not think this needs to be resolved in the PR, but it is something to consider for a follow up PR.

If I don't fix this now, I probably won't remember to later... 😅

Do this ↑

Thanks for the helpful review!

For trusted publishers.

…izmor

Add zizmor as a pre-commit hook

78988b8

github-actions bot added CI Related to continuous integration linters Code linters and autoformatters labels Mar 25, 2025

namurphy mentioned this pull request Mar 25, 2025

Add zizmor as a pre-commit hook to find potential security vulnerabilities in GitHub Actions sunpy/sunpy#8134

Closed

namurphy added 2 commits March 25, 2025 19:49

Set persist-credentials: false

3c1e3b7

Change pull_request_target → pull_request

b60aabf

github-actions bot added testing GitHub Actions A continuous integration platform for automating tests and other tasks (see .github/ directory) packaging Related to packaging or distribution release Related to releasing a new version of PlasmaPy documentation infrastructure labels Mar 25, 2025

Begin a Nox session for zizmor

262af70

github-actions bot added python Pull requests that update Python code nox Related to the nox automation software labels Mar 26, 2025

namurphy mentioned this pull request Mar 31, 2025

Use setup-uv in GitHub workflows #2959

Merged

namurphy added 7 commits April 3, 2025 16:31

Add zizmor as a pre-commit hook

22b2020

Set persist-credentials: false

1fa6d12

Change pull_request_target → pull_request

d458153

Begin a Nox session for zizmor

a4d9c7f

Merge branch 'pre-commit-zizmor' of github.com:namurphy/PlasmaPy into…

fbd9916

… pre-commit-zizmor

Remove pre-commit hook for zizmor

62b07e3

Add permissions: {}

548f0dc

github-actions bot added the maintenance General updates to package infrastructure label Apr 3, 2025

namurphy changed the title ~~Add zizmor as a pre-commit hook to perform GitHub workflow security audits~~ Perform GitHub workflow security audits with zizmor during continuous integration tests Apr 7, 2025

namurphy added 2 commits April 7, 2025 14:51

Merge branch 'main' of github.com:PlasmaPy/PlasmaPy into pre-commit-z…

cface42

…izmor

pre-commit run --all-files

725cbdd

namurphy changed the title ~~Perform GitHub workflow security audits with zizmor during continuous integration tests~~ Automate GitHub workflow security audits with zizmor Apr 7, 2025

Temporarily ignore zizmor configuration problems with config file

ccc611f

namurphy added 4 commits April 28, 2025 17:21

Merge branch 'main' of github.com:PlasmaPy/PlasmaPy into pre-commit-z…

a45eaa3

…izmor

Allow unpinned 'uses' statements with trusted organizations

61556ac

Un-ignore zizmor errors for unpinned-uses by individual devs

b02e5a8

Use hashes for actions authored by individuals

98985ac

namurphy commented Apr 28, 2025

View reviewed changes

namurphy added 3 commits April 28, 2025 18:30

Merge branch 'main' of github.com:PlasmaPy/PlasmaPy into pre-commit-z…

46bc24f

…izmor

Stop ignoring some rules that got fixed in a separate PR

a9bc55a

Rename workflow

28091af

namurphy commented Apr 28, 2025

View reviewed changes

rocco8773 approved these changes Apr 29, 2025

View reviewed changes

namurphy added 9 commits April 29, 2025 17:18

Update header of zizmor.yml

c6c0a5a

Print out zizmor troubleshooting message in CI

600ca04

ruff-format

bd5a06b

Update zizmor configuration

9bd4bf0

Switch from # zizmor: ignore comments to config file

7596c1f

For trusted publishers.

Update docstring

20d2f11

Set more trusted publishers

ade0d47

Remove accidentally added files

250022d

Update info message

45f2c1e

namurphy mentioned this pull request May 1, 2025

Update usage of uv by Nox #2998

Merged

Merge branch 'main' of github.com:PlasmaPy/PlasmaPy into pre-commit-z…

91e046f

…izmor

github-actions bot added the run comprehensive tests Add this label to run comprehensive tests in CI label May 28, 2025

namurphy merged commit e98f696 into PlasmaPy:main May 28, 2025
21 checks passed

namurphy deleted the pre-commit-zizmor branch May 28, 2025 21:28

This was referenced May 28, 2025

Fix labeler workflow #3025

Merged

Revert changes to the workflow that posts the welcome comment #3029

Merged

Fix Math Rendering in HarrisSheet Docs #3028

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Automate GitHub workflow security audits with `zizmor`#2975

Automate GitHub workflow security audits with `zizmor`#2975
namurphy merged 41 commits intoPlasmaPy:mainfrom
namurphy:pre-commit-zizmor

namurphy commented Mar 25, 2025 •

edited

Loading

Uh oh!

codecov bot commented Mar 25, 2025 •

edited

Loading

Uh oh!

namurphy commented Mar 26, 2025

Uh oh!

namurphy Apr 28, 2025

Uh oh!

namurphy Apr 28, 2025

Uh oh!

namurphy Apr 28, 2025 •

edited

Loading

Uh oh!

namurphy commented Apr 28, 2025

Uh oh!

rocco8773 left a comment

Uh oh!

namurphy commented Apr 29, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

namurphy commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

namurphy commented Mar 26, 2025

Uh oh!

namurphy Apr 28, 2025

Choose a reason for hiding this comment

Uh oh!

namurphy Apr 28, 2025

Choose a reason for hiding this comment

Uh oh!

namurphy Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

namurphy commented Apr 28, 2025

Uh oh!

rocco8773 left a comment

Choose a reason for hiding this comment

Uh oh!

namurphy commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

namurphy commented Mar 25, 2025 •

edited

Loading

codecov bot commented Mar 25, 2025 •

edited

Loading

namurphy Apr 28, 2025 •

edited

Loading

namurphy commented Apr 29, 2025 •

edited

Loading