fix(security-scan): grant actions:read to codeql + zizmor jobs#20
Merged
Conversation
github/codeql-action's init/analyze and upload-sarif each call
`GET /repos/{owner}/{repo}/actions/runs/{run_id}` for telemetry. The
workflow-level `permissions:` block grants `contents: read`,
`security-events: write`, `pull-requests: read` — but not
`actions: read`. Result: every PR run on every org caller emits
##[error]Resource not accessible by integration
at the telemetry call and fails the step. Verified against
resq-software/research PR #8 across multiple consecutive runs.
Add `actions: read` at the job level for codeql and zizmor (the two
jobs that surface the issue). `actions: read` is read-only and
grants no write capability beyond the existing inherited scopes.
Other jobs in this workflow (gitleaks, osv-scanner, dependency-review,
actionlint, semgrep, snyk) don't make the telemetry call and don't
need the scope; leaving their permissions inherited.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR adds ChangesWorkflow Security Permissions
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 60 minutes.Comment |
4 tasks
WomB0ComB0
added a commit
to resq-software/programs
that referenced
this pull request
Jun 1, 2026
Root cause of the security-workflow startup_failure (every run since 2026-05-04, 0 jobs executed): the reusable security-scan.yml's CodeQL and zizmor jobs request `actions: read` (added in resq-software/.github#20, 2026-05-04 — exactly when the failures began). A reusable workflow's jobs cannot request a permission the caller did not grant; GitHub rejects the entire run at startup. The prior #30 SHA-pin and the secrets-inherit removal did not fix it because neither granted actions:read. Add it to the scan job's permissions.
WomB0ComB0
added a commit
to resq-software/programs
that referenced
this pull request
Jun 2, 2026
#32) * ci(security): harden security workflow — clear zizmor alerts #10 & #11 Resolves both open code-scanning alerts on .github/workflows/security.yml (zizmor 1.24.1, verified locally with `zizmor --persona=auditor`): - #11 secrets-inherit (warning): replace `secrets: inherit` — which hands the reusable workflow ALL of this repo's secrets — with named forwarding of just SEMGREP_APP_TOKEN (the only enabled token-consuming scanner). Enabled by resq-software/.github#21, which declares the secret under workflow_call.secrets; re-pinned to that workflow's new SHA (b48036af, #21). - #10 unpinned-uses (error): already SHA-pinned in #30; carried forward. Also clears two latent findings the stale scan predates: - excessive-permissions: drop workflow-level `permissions` to `{}` and move contents/security-events/pull-requests scopes onto the `scan` job, so they apply only to the reusable call. - undocumented-permissions: every scope now carries an explanatory comment. `zizmor --no-online-audits` reports "No findings" on the result. NOTE: this does not by itself explain the separate scheduled-run startup_failure (which persisted after the #30 pin); switching off `secrets: inherit` is the leading remaining hypothesis and this PR tests it. * fix(ci): grant actions:read so the security reusable can start Root cause of the security-workflow startup_failure (every run since 2026-05-04, 0 jobs executed): the reusable security-scan.yml's CodeQL and zizmor jobs request `actions: read` (added in resq-software/.github#20, 2026-05-04 — exactly when the failures began). A reusable workflow's jobs cannot request a permission the caller did not grant; GitHub rejects the entire run at startup. The prior #30 SHA-pin and the secrets-inherit removal did not fix it because neither granted actions:read. Add it to the scan job's permissions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every org caller of
security-scan.ymlis currently failing thecodeql/*andzizmorjobs with:github/codeql-action'sinit/analyze/upload-sarifeach callGET /repos/{owner}/{repo}/actions/runs/{run_id}for telemetry. The workflow-levelpermissions:block grantscontents: read/security-events: write/pull-requests: read— but notactions: read. Result: every PR run fails the step.Fix
Add
actions: readat the job level for the two jobs that surface the issue (codeql + zizmor).actions: readis read-only and grants no write capability beyond the existing inherited scopes. Other jobs (gitleaks, osv-scanner, dependency-review, actionlint, semgrep, snyk) don't make the telemetry call.Repro
resq-software/research PR #8 — three consecutive CI runs (commits
847986c,2ddf8f9,bc97019) all show the same error on the same two job names. Other security scans in the same workflow (semgrep, dependency-review, actionlint, CodeQL (actions)) pass on every run.Test plan
security.ymlto point at the merged commitscan / CodeQL (javascript-typescript)andscan / zizmorgo green on the next PR runNotes
actions: readis the minimum scope; could be wider (e.g.actions: write) but read-only matches the principle of least privilege.requiredaggregators don't include thescan/*checks. PR fix(security): bump Go toolchain to stable #8 in research caught it because the user explicitly asked to verify failing CI.Summary by CodeRabbit