feat(lint-gha): add zizmor lint workflow for public repositories #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint GitHub Actions Files | |
| # This workflow is required to pass org-wide for public repositories | |
| # via a GitHub organization ruleset "required_workflows" rule. GitHub | |
| # runs it against pull requests opened in the repositories the ruleset | |
| # targets, checking out and scanning THAT repository's workflows, not | |
| # BitGoJS's own. | |
| # | |
| # Required workflows only support these events; see | |
| # https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-workflows-to-pass-before-merging | |
| on: | |
| pull_request: | |
| merge_group: | |
| permissions: | |
| contents: read | |
| jobs: | |
| zizmor: | |
| name: Run Zizmor | |
| runs-on: ${{ vars.BUILD_SYSTEM_MEDIUM_RUNNER || 'ubuntu-latest' }} | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| # Checks out the CALLING repo (the one the PR was opened against), | |
| # not BitGoJS -- this is standard ruleset-required-workflow | |
| # behavior: github.repository/actions/checkout resolve to the | |
| # target repo's PR head, exactly as if this workflow were defined | |
| # directly in that repo. | |
| - name: Checkout target repository | |
| uses: actions/checkout@v7 | |
| # zizmor's default config discovery only looks in the repo it's | |
| # scanning (the one just checked out above), and the target | |
| # repo's own policy, if any, is not ours. The policy is therefore | |
| # inlined here and written to a file that --config points at. | |
| # | |
| # Policy: | |
| # - GitHub-owned (actions/*, github/*) and the docker/* and | |
| # aws-actions/* orgs are exempt from hash-pinning -- | |
| # ref-pinning (a tag or branch) is enough; hash-pinning them | |
| # adds SHA-churn maintenance with no security benefit. | |
| # - The grandfathered lists came from a 2026-09-03 scan of | |
| # every non-archived public repository in the BitGo org for | |
| # uses: references not pinned to a full-length commit SHA | |
| # (INF-3420). Both lists are shrink-only: remove an entry | |
| # once every public-repository workflow that references it | |
| # pins it to a commit SHA -- do not add new entries. | |
| # - Everything else defaults to hash-pin ("*": hash-pin), so | |
| # new third-party actions must be pinned to a commit SHA | |
| # from day one. | |
| - name: Write zizmor policy | |
| env: | |
| ENABLE_ALL_GHA_LINT_CHECKS: ${{ vars.ENABLE_ALL_GHA_LINT_CHECKS }} | |
| run: | | |
| policy="${GITHUB_WORKSPACE}/.zizmor-ci-policy.yml" | |
| if [ "$ENABLE_ALL_GHA_LINT_CHECKS" = 'true' ]; then | |
| disabled_dest=/dev/null | |
| else | |
| disabled_dest="$policy" | |
| fi | |
| echo "rules:" > "$policy" | |
| cat >> "$disabled_dest" <<'DISABLED' | |
| adhoc-packages: | |
| disable: true | |
| anonymous-definition: | |
| disable: true | |
| archived-uses: | |
| disable: true | |
| artipacked: | |
| disable: true | |
| bot-conditions: | |
| disable: true | |
| cache-poisoning: | |
| disable: true | |
| concurrency-limits: | |
| disable: true | |
| dangerous-triggers: | |
| disable: true | |
| dependabot-cooldown: | |
| disable: true | |
| dependabot-execution: | |
| disable: true | |
| excessive-permissions: | |
| disable: true | |
| forbidden-uses: | |
| disable: true | |
| github-app: | |
| disable: true | |
| github-env: | |
| disable: true | |
| hardcoded-container-credentials: | |
| disable: true | |
| impostor-commit: | |
| disable: true | |
| insecure-commands: | |
| disable: true | |
| insecure-url-scheme: | |
| disable: true | |
| known-vulnerable-actions: | |
| disable: true | |
| misfeature: | |
| disable: true | |
| obfuscation: | |
| disable: true | |
| overprovisioned-secrets: | |
| disable: true | |
| ref-confusion: | |
| disable: true | |
| ref-version-mismatch: | |
| disable: true | |
| secrets-inherit: | |
| disable: true | |
| secrets-outside-env: | |
| disable: true | |
| self-hosted-runner: | |
| disable: true | |
| self-repository: | |
| disable: true | |
| stale-action-refs: | |
| disable: true | |
| superfluous-actions: | |
| disable: true | |
| template-injection: | |
| disable: true | |
| typosquat-uses: | |
| disable: true | |
| undocumented-permissions: | |
| disable: true | |
| unpinned-images: | |
| disable: true | |
| unpinned-tools: | |
| disable: true | |
| unredacted-secrets: | |
| disable: true | |
| unsound-condition: | |
| disable: true | |
| unsound-contains: | |
| disable: true | |
| unsound-ternary: | |
| disable: true | |
| use-trusted-publishing: | |
| disable: true | |
| DISABLED | |
| cat >> "$policy" <<'PINNING' | |
| unpinned-uses: | |
| config: | |
| policies: | |
| # Trusted orgs -- ref-pinning (a tag or branch) is | |
| # enough. Mirrors the org-level policy: GitHub-owned | |
| # (actions/*, github/*) and the docker/* and | |
| # aws-actions/* orgs. | |
| "actions/*": ref-pin | |
| "github/*": ref-pin | |
| "docker/*": ref-pin | |
| "aws-actions/*": ref-pin | |
| # Grandfathered internal (BitGo-owned) actions and | |
| # reusable workflows still referenced by a floating | |
| # tag/branch by at least one public repository as of | |
| # the INF-3420 scan. | |
| "BitGo/gha-renovate-bot/*": ref-pin | |
| "BitGo/install-github-release-binary/*": ref-pin | |
| "BitGo/semantic-release-github-actions/*": ref-pin | |
| # Grandfathered external third-party actions still | |
| # referenced by a floating tag/branch by at least one | |
| # public repository as of the INF-3420 scan. | |
| "actions-rs/toolchain": ref-pin | |
| "azure/setup-helm": ref-pin | |
| "codecov/codecov-action": ref-pin | |
| "dtolnay/rust-toolchain": ref-pin | |
| "helm/chart-releaser-action": ref-pin | |
| "ilammy/msvc-dev-cmd": ref-pin | |
| "ludeeus/action-shellcheck": ref-pin | |
| "peter-evans/create-pull-request": ref-pin | |
| "xresloader/upload-to-github-release": ref-pin | |
| # Everything else: every other action (including new | |
| # third-party actions, subpaths of grandfathered | |
| # third-party repos, and internal actions in repos | |
| # not listed above) must be pinned to a full commit | |
| # SHA. | |
| "*": hash-pin | |
| PINNING | |
| - name: Run zizmor | |
| uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3 | |
| with: | |
| config: .zizmor-ci-policy.yml | |
| # Online audits (e.g. ref-confusion) call the GitHub API to | |
| # inspect OTHER repos referenced by uses: clauses. The default | |
| # github.token is only scoped to the checked-out repo, so | |
| # those lookups fail fatally for any repo the token cannot | |
| # read. unpinned-uses (the only audit this policy relies on) | |
| # is fully offline-capable. | |
| online-audits: "false" | |
| # Advanced Security (SARIF + code scanning upload) needs a | |
| # paid feature target repos may not have; use plain | |
| # annotations so this works uniformly across every repository | |
| # the ruleset targets. | |
| advanced-security: "false" | |
| annotations: "true" | |
| fail-on-no-inputs: "false" |