diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index d6afd5da55c..e16300f120b 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -25,6 +25,8 @@ jobs: with: # history is needed to run git cherry-pick below fetch-depth: 0 + # zizmor: ignore[artipacked] Credentials are required by the branch push below. + persist-credentials: true - name: Use CLA approved github bot run: .github/scripts/use-cla-approved-bot.sh @@ -34,11 +36,12 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request env: NUMBER: ${{ github.event.inputs.number }} - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid) @@ -49,6 +52,7 @@ jobs: git checkout -b $branch git cherry-pick $commit git push --set-upstream origin $branch - gh pr create --title "[$GITHUB_REF_NAME] $title" \ - --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \ - --base $GITHUB_REF_NAME + gh pr create \ + --title "[$GITHUB_REF_NAME] $title" \ + --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \ + --base $GITHUB_REF_NAME diff --git a/.github/workflows/benchmark-tags.yml b/.github/workflows/benchmark-tags.yml index 5ece58dc83f..367dbc90e13 100644 --- a/.github/workflows/benchmark-tags.yml +++ b/.github/workflows/benchmark-tags.yml @@ -25,6 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ matrix.tag-version }} + persist-credentials: false - id: setup-java name: Set up Java for build diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index a766a4952fa..b9c1ad1523e 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -28,6 +28,8 @@ jobs: run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - id: setup-java name: Set up Java for build diff --git a/.github/workflows/build-daily.yml b/.github/workflows/build-daily.yml index 515bc42b2c0..06a604f311e 100644 --- a/.github/workflows/build-daily.yml +++ b/.github/workflows/build-daily.yml @@ -20,6 +20,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Java uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 diff --git a/.github/workflows/build-tracecontext-testsuite.yml b/.github/workflows/build-tracecontext-testsuite.yml index 348ae056fcb..1eb2b377a7b 100644 --- a/.github/workflows/build-tracecontext-testsuite.yml +++ b/.github/workflows/build-tracecontext-testsuite.yml @@ -21,6 +21,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Login to GitHub package registry uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 41e823ea71b..8a08332798c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -41,6 +41,8 @@ jobs: jmh-based-tests: true steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - id: setup-java-test name: Set up Java ${{ matrix.test-java-version }} for tests @@ -58,6 +60,8 @@ jobs: java-version: 21 - name: Set up gradle + # zizmor: ignore[cache-poisoning] This tests release branches but does not + # publish release artifacts. uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 with: # Keep one writer per OS because Gradle User Home caches are platform-specific. @@ -65,13 +69,15 @@ jobs: gradle-home-cache-excludes: >- ${{ secrets.DEVELOCITY_ACCESS_KEY != '' && github.ref_name == github.event.repository.default_branch && matrix.test-java-version == 25 && 'caches/build-cache-1' || '' }} - name: Build + shell: bash run: > ./gradlew build ${{ matrix.coverage && 'jacocoTestReport' || '' }} -PtestJavaVersion=${{ matrix.test-java-version }} - "-Porg.gradle.java.installations.paths=${{ steps.setup-java-test.outputs.path }}" + "-Porg.gradle.java.installations.paths=${TEST_JAVA_PATH}" "-Porg.gradle.java.installations.auto-download=false" env: + TEST_JAVA_PATH: ${{ steps.setup-java-test.outputs.path }} # JMH-based tests run only if this environment variable is set to true RUN_JMH_BASED_TESTS: ${{ matrix.jmh-based-tests }} DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} @@ -121,6 +127,8 @@ jobs: - 25 # renovate(graal-java-version) steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4 with: java-version: ${{ matrix.test-graal-version }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a97b151e944..abcdbce4c6c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Java 21 if: matrix.language == 'java' @@ -41,6 +43,8 @@ jobs: java-version: 21 - name: Set up gradle + # zizmor: ignore[cache-poisoning] This workflow analyzes release branches + # but does not build or publish release artifacts. if: matrix.language == 'java' uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 with: diff --git a/.github/workflows/detect-api-changes.yml b/.github/workflows/detect-api-changes.yml index a3fffc04a79..bc9862ec401 100644 --- a/.github/workflows/detect-api-changes.yml +++ b/.github/workflows/detect-api-changes.yml @@ -4,10 +4,10 @@ on: # pull_request_target is used instead of pull_request so that the workflow has write access # (to post comments and apply labels) even when triggered by fork PRs. # - # SECURITY: this workflow must never checkout or execute any code from the PR branch. - # Doing so would allow malicious PRs to exfiltrate secrets. All we use from the PR - # is github.event.pull_request.number (an integer), which is safe. pull_request_target: + # zizmor: ignore[dangerous-triggers] Required to label and comment on fork PRs; + # no PR code is checked out, and the PR number and head ref are passed through env + # and treated only as data. types: [opened, synchronize, reopened, ready_for_review] permissions: {} @@ -23,6 +23,8 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-issues: write + permission-pull-requests: read - name: Check for API changes and update PR env: diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index faf8892055f..2979c16207c 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0 with: diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml index c1ec5b7ea7e..560a75e8473 100644 --- a/.github/workflows/gradle-wrapper-validation.yml +++ b/.github/workflows/gradle-wrapper-validation.yml @@ -12,6 +12,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # this needs to be in its own workflow in order to make OSSF scorecard happy - uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 diff --git a/.github/workflows/issue-management-feedback-label.yml b/.github/workflows/issue-management-feedback-label.yml index 6af660e9f89..5a7caf7c515 100644 --- a/.github/workflows/issue-management-feedback-label.yml +++ b/.github/workflows/issue-management-feedback-label.yml @@ -19,6 +19,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Remove labels env: diff --git a/.github/workflows/javadoc-crawler.yml b/.github/workflows/javadoc-crawler.yml index d7943fda0df..fb314e6f0b2 100644 --- a/.github/workflows/javadoc-crawler.yml +++ b/.github/workflows/javadoc-crawler.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml index 258a2ecd2f8..3dcd6f2b2e0 100644 --- a/.github/workflows/prepare-patch-release.yml +++ b/.github/workflows/prepare-patch-release.yml @@ -12,6 +12,9 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # zizmor: ignore[artipacked] Credentials are required by the branch push below. + persist-credentials: true - run: | if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x$ ]]; then @@ -52,10 +55,11 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | message="Prepare release $VERSION" @@ -64,6 +68,7 @@ jobs: git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "[$GITHUB_REF_NAME] $message" \ - --body "$message." \ - --base $GITHUB_REF_NAME + gh pr create \ + --title "[$GITHUB_REF_NAME] $message" \ + --body "$message." \ + --base $GITHUB_REF_NAME diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml index 8733de2d322..bda03d5a68c 100644 --- a/.github/workflows/prepare-release-branch.yml +++ b/.github/workflows/prepare-release-branch.yml @@ -10,6 +10,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Verify prerequisites run: | @@ -35,6 +37,8 @@ jobs: # history is needed to allow fast-forward push below in case # re-running this workflow after merging additional PRs to main fetch-depth: 0 + # zizmor: ignore[artipacked] Credentials are required by the branch pushes below. + persist-credentials: true - name: Create release branch run: | @@ -68,10 +72,11 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against the release branch env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | message="Prepare release $VERSION" @@ -80,9 +85,10 @@ jobs: git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \ - --body "$message." \ - --base $RELEASE_BRANCH_NAME + gh pr create \ + --title "[$RELEASE_BRANCH_NAME] $message" \ + --body "$message." \ + --base $RELEASE_BRANCH_NAME create-pull-request-against-main: permissions: @@ -92,6 +98,9 @@ jobs: - prereqs steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # zizmor: ignore[artipacked] Credentials are required by the branch push below. + persist-credentials: true - name: Set environment variables run: | @@ -124,10 +133,11 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against main env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | message="Update version to $NEXT_VERSION" @@ -137,6 +147,7 @@ jobs: git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "$message" \ - --body "$body" \ - --base main + gh pr create \ + --title "$message" \ + --body "$body" \ + --base main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 32ded38d039..9d0b7d22af6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,6 +22,8 @@ jobs: fi - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: @@ -73,6 +75,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main + persist-credentials: false - name: Check that change log update was merged to main run: | @@ -89,6 +92,7 @@ jobs: with: # tags are needed for the generate-release-contributors.sh script fetch-depth: 0 + persist-credentials: false - name: Generate release notes env: @@ -148,6 +152,8 @@ jobs: # add change log sync (if any) into this PR since the apidiff update # is required before any other PR can be merged anyway - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Copy change log section from release branch env: @@ -159,6 +165,8 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main + # zizmor: ignore[artipacked] Credentials are required by the branch push below. + persist-credentials: true - name: Merge change log to main env: @@ -223,11 +231,12 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against main env: VERSION: ${{ needs.release.outputs.version }} - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | message="Post-release updates for $VERSION" @@ -237,6 +246,7 @@ jobs: git checkout -b $branch git commit -m "$message" git push --set-upstream origin $branch - gh pr create --title "$message" \ - --body "$body" \ - --base main + gh pr create \ + --title "$message" \ + --body "$body" \ + --base main diff --git a/.github/workflows/reusable-link-check.yml b/.github/workflows/reusable-link-check.yml index 5407c102d37..2db522da347 100644 --- a/.github/workflows/reusable-link-check.yml +++ b/.github/workflows/reusable-link-check.yml @@ -13,6 +13,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # needed for merge-base used in modified-files mode + persist-credentials: false - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 diff --git a/.github/workflows/sonatype-guide-dependency-audit-daily.yml b/.github/workflows/sonatype-guide-dependency-audit-daily.yml index 4872f38cdce..5cf5388852e 100644 --- a/.github/workflows/sonatype-guide-dependency-audit-daily.yml +++ b/.github/workflows/sonatype-guide-dependency-audit-daily.yml @@ -17,6 +17,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: diff --git a/.github/workflows/survey-on-merged-pr.yml b/.github/workflows/survey-on-merged-pr.yml index e7bf5d44449..e1030595960 100644 --- a/.github/workflows/survey-on-merged-pr.yml +++ b/.github/workflows/survey-on-merged-pr.yml @@ -1,7 +1,9 @@ name: Survey on Merged PR by Non-Member on: - pull_request_target: # zizmor: ignore[dangerous-triggers] — this workflow only calls the reusable shared workflow; no PR code is checked out or executed. + pull_request_target: + # zizmor: ignore[dangerous-triggers] This only calls the trusted reusable + # workflow; no PR code is checked out or executed. types: [closed] branches: [main] diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000000..d97b5797db1 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,20 @@ +name: Zizmor + +on: + push: + branches: + - main + - release/* + pull_request: + schedule: + - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday + workflow_dispatch: + +permissions: {} + +jobs: + zizmor: + permissions: + contents: read # for actions/checkout + security-events: write # for zizmor to upload SARIF results + uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0