ci(security-scan): declare workflow_call.secrets so callers can pass by name#21
Conversation
…by name The reusable security-scan workflow consumes SEMGREP_APP_TOKEN, SNYK_TOKEN and GITLEAKS_LICENSE in its jobs but did not declare them under workflow_call, forcing callers to use `secrets: inherit` -- which forwards ALL of the caller's secrets and trips zizmor's `secrets-inherit` audit (e.g. resq-software/programs alert #11). Declare them explicitly (all required: false, each gated by its enable-* input). Backward-compatible.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
More reviews will be available in 4 minutes and 7 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
#32) * ci(security): harden security workflow — clear zizmor alerts #10 & #11 Resolves both open code-scanning alerts on .github/workflows/security.yml (zizmor 1.24.1, verified locally with `zizmor --persona=auditor`): - #11 secrets-inherit (warning): replace `secrets: inherit` — which hands the reusable workflow ALL of this repo's secrets — with named forwarding of just SEMGREP_APP_TOKEN (the only enabled token-consuming scanner). Enabled by resq-software/.github#21, which declares the secret under workflow_call.secrets; re-pinned to that workflow's new SHA (b48036af, #21). - #10 unpinned-uses (error): already SHA-pinned in #30; carried forward. Also clears two latent findings the stale scan predates: - excessive-permissions: drop workflow-level `permissions` to `{}` and move contents/security-events/pull-requests scopes onto the `scan` job, so they apply only to the reusable call. - undocumented-permissions: every scope now carries an explanatory comment. `zizmor --no-online-audits` reports "No findings" on the result. NOTE: this does not by itself explain the separate scheduled-run startup_failure (which persisted after the #30 pin); switching off `secrets: inherit` is the leading remaining hypothesis and this PR tests it. * fix(ci): grant actions:read so the security reusable can start Root cause of the security-workflow startup_failure (every run since 2026-05-04, 0 jobs executed): the reusable security-scan.yml's CodeQL and zizmor jobs request `actions: read` (added in resq-software/.github#20, 2026-05-04 — exactly when the failures began). A reusable workflow's jobs cannot request a permission the caller did not grant; GitHub rejects the entire run at startup. The prior #30 SHA-pin and the secrets-inherit removal did not fix it because neither granted actions:read. Add it to the scan job's permissions.
1 participant
Summary
The reusable
security-scan.ymlconsumesSEMGREP_APP_TOKEN,SNYK_TOKEN, andGITLEAKS_LICENSEinside its jobs but does not declare them underworkflow_call. With no declaration, the only way a caller can supply them issecrets: inherit— which forwards all of the caller's secrets, not just the three this workflow needs. That trips zizmor'ssecrets-inheritaudit (e.g.resq-software/programscode-scanning alert #11).This PR declares the three secrets explicitly under
workflow_call.secrets, allrequired: false(each is already gated by its matchingenable-*input).Why it's safe
secrets: inheritkeep working unchanged.Follow-up (dependent change)
After this merges,
resq-software/programsPR #30 will be updated to pin the newsecurity-scan.ymlSHA and replacesecrets: inheritwith named forwarding ofSEMGREP_APP_TOKEN, clearing alert #11. PR #30 already clears alert #10 (unpinned-uses) independently.Test plan
SEMGREP_APP_TOKENby name resolves and semgrep still runs.