Skip to content

tools: harden GitHub Actions workflows - #66013

Closed
panva wants to merge 4 commits into
nodejs:mainfrom
panva:zizmor-workflow-cleanup
Closed

tools: harden GitHub Actions workflows#66013
panva wants to merge 4 commits into
nodejs:mainfrom
panva:zizmor-workflow-cleanup

Conversation

@panva

@panva panva commented Sep 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Address easy actionable findings from zizmor, a static analysis tool that checks GitHub Actions workflows:

  • Pass dynamic values through environment variables instead of inserting them directly into shell scripts. Use arrays for benchmark categories and PR numbers.
  • Resolve local actions and reusable workflows from the running workflow commit using $/ references, removing redundant action checkouts.
  • Disable checkout credential persistence for CodeQL.
  • Correct Slack action version comments.

@panva
tools: make checkout credential use explicit
724b592 
Disable credential persistence for CodeQL.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
@panva
tools: correct Slack action version comments
7f68667 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
@panva
tools: use self-repository references
f36244a 
Resolve local actions and reusable workflows from the running
workflow commit with $/ references, independent of checkout paths.

Remove the tarball job's action-only checkout and the WPT action
checkout/copy workaround, which are no longer needed.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
@panva
tools: avoid workflow shell interpolation
7349f4d 
Pass input, output, and version values through environment variables
instead of expanding them into shell source. Split benchmark
categories and PR numbers into arrays to retain separate arguments.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
@panva
panva requested a review from aduh95 September 13, 2026 10:11
@panva panva added the commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. label Sep 13, 2026
@nodejs-github-bot

nodejs-github-bot commented Sep 13, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/actions
  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added the meta Issues and PRs related to the general management of the project. label Sep 13, 2026
@panva panva added the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Sep 13, 2026
@panva panva added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 14, 2026
nodejs-github-bot pushed a commit that referenced this pull request Sep 15, 2026
@panva @nodejs-github-bot
tools: make checkout credential use explicit
67868c7 
Disable credential persistence for CodeQL.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
@nodejs-github-bot

nodejs-github-bot commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

Landed in 11ed325...7203d9b

nodejs-github-bot pushed a commit that referenced this pull request Sep 15, 2026
@panva @nodejs-github-bot
tools: correct Slack action version comments
fe40b31 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
nodejs-github-bot pushed a commit that referenced this pull request Sep 15, 2026
@panva @nodejs-github-bot
tools: use self-repository references
96e769e 
Resolve local actions and reusable workflows from the running
workflow commit with $/ references, independent of checkout paths.

Remove the tarball job's action-only checkout and the WPT action
checkout/copy workaround, which are no longer needed.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
nodejs-github-bot pushed a commit that referenced this pull request Sep 15, 2026
@panva @nodejs-github-bot
tools: avoid workflow shell interpolation
7203d9b 
Pass input, output, and version values through environment variables
instead of expanding them into shell source. Split benchmark
categories and PR numbers into arrays to retain separate arguments.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 15, 2026
@panva
panva deleted the zizmor-workflow-cleanup branch September 15, 2026 10:34
aduh95 pushed a commit that referenced this pull request Sep 16, 2026
@panva @aduh95
tools: make checkout credential use explicit
66f182f 
Disable credential persistence for CodeQL.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
aduh95 pushed a commit that referenced this pull request Sep 16, 2026
@panva @aduh95
tools: correct Slack action version comments
d5880dc 
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
aduh95 pushed a commit that referenced this pull request Sep 16, 2026
@panva @aduh95
tools: use self-repository references
caf0ee0 
Resolve local actions and reusable workflows from the running
workflow commit with $/ references, independent of checkout paths.

Remove the tarball job's action-only checkout and the WPT action
checkout/copy workaround, which are no longer needed.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
aduh95 pushed a commit that referenced this pull request Sep 16, 2026
@panva @aduh95
tools: avoid workflow shell interpolation
a5b1659 
Pass input, output, and version values through environment variables
instead of expanding them into shell source. Split benchmark
categories and PR numbers into arrays to retain separate arguments.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes
@UlisesGascon UlisesGascon UlisesGascon approved these changes
@meixg meixg meixg approved these changes
@aduh95 aduh95 aduh95 approved these changes

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. meta Issues and PRs related to the general management of the project.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@panva @nodejs-github-bot @jasnell @UlisesGascon @meixg @aduh95