actions/trivy-action
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci(test): add zizmor security linter for GitHub Actions (#502)

Browse Source 
* ci: add zizmor security linter for GitHub Actions

* ci: disable advanced-security for zizmor

* ci: pin all actions to commit hashes

* ci: fix zizmor linter errors in workflows

- Add explicit permissions blocks to all workflows
- Set persist-credentials: false for checkout actions
- Fix template injection by using env variables in run blocks

* fix: address zizmor template injection warnings in action.yaml

- Move inputs to env block to prevent template injection
- Add ignore comment for github-env false positive

* ci: fix remaining zizmor linter errors

- Add permissions and persist-credentials to test.yaml
- Fix ignore comment placement for github-env in action.yaml
This commit is contained in:
DmitriyLewen
2026-02-20 15:24:24 -07:00
committed by GitHub
parent c1824fd6ed
commit e368e32897
6 changed files with 104 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/bump-trivy.yaml
+15 -6
View File
@@ -13,8 +13,12 @@ run-name: Bump trivy to v${{ inputs.trivy_version }}
jobs:
bump:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: Update Trivy versions
env:
@@ -23,11 +27,13 @@ jobs:
- name: Setup Bats and bats libs
id: setup-bats
uses: bats-core/bats-action@3.0.1
uses: bats-core/bats-action@42fcc8700f773c075a16a90eb11674c0318ad507 # 3.0.1
- name: Install Trivy
env:
TRIVY_VERSION: ${{ inputs.trivy_version }}
run: |
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v${{ inputs.trivy_version }}
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${TRIVY_VERSION}"
trivy --version
- name: Update golden files
@@ -42,7 +48,7 @@ jobs:
- name: Create PR
id: create-pr
uses: peter-evans/create-pull-request@v5
uses: peter-evans/create-pull-request@4e1beaa7521e8b457b572c090b25bd3db56bf1c5 # v5
with:
token: ${{ secrets.ORG_REPO_TOKEN }}
title: "chore(deps): Update trivy to v${{ inputs.trivy_version }}"
@@ -54,6 +60,9 @@ jobs:
delete-branch: true
- name: Check outputs
env:
PR_NUMBER: ${{ steps.create-pr.outputs.pull-request-number }}
PR_URL: ${{ steps.create-pr.outputs.pull-request-url }}
run: |
echo "Pull Request Number - ${{ steps.create-pr.outputs.pull-request-number }}"
echo "Pull Request URL - ${{ steps.create-pr.outputs.pull-request-url }}"
echo "Pull Request Number - ${PR_NUMBER}"
echo "Pull Request URL - ${PR_URL}"
.github/workflows/sync-trivy-checks.yaml
+9 -4
View File
@@ -9,14 +9,19 @@ env:
jobs:
sync-trivy-checks:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: setup-oras
uses: oras-project/setup-oras@v1.2.3
uses: oras-project/setup-oras@8d34698a59f5ffe24821f0b48ab62a3de8b64b20 # v1.2.3
- name: Login to GitHub Packages Container registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
@@ -24,4 +29,4 @@ jobs:
- name: Copy Trivy Checks
run: |
oras cp ghcr.io/aquasecurity/trivy-checks:2 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
oras cp ghcr.io/aquasecurity/trivy-checks:2 "${REGISTRY}/${IMAGE_NAME}:latest"
.github/workflows/sync-trivy-db.yaml
+9 -4
View File
@@ -9,14 +9,19 @@ env:
jobs:
sync-trivy-db:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: setup-oras
uses: oras-project/setup-oras@v1.2.3
uses: oras-project/setup-oras@8d34698a59f5ffe24821f0b48ab62a3de8b64b20 # v1.2.3
- name: Login to GitHub Packages Container registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
@@ -24,4 +29,4 @@ jobs:
- name: Copy Trivy DB
run: |
oras cp ghcr.io/aquasecurity/trivy-db:2 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
oras cp ghcr.io/aquasecurity/trivy-db:2 "${REGISTRY}/${IMAGE_NAME}:latest"
.github/workflows/sync-trivy-java-db.yaml
+9 -4
View File
@@ -9,14 +9,19 @@ env:
jobs:
sync-trivy-db:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: setup-oras
uses: oras-project/setup-oras@v1.2.3
uses: oras-project/setup-oras@8d34698a59f5ffe24821f0b48ab62a3de8b64b20 # v1.2.3
- name: Login to GitHub Packages Container registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
@@ -24,4 +29,4 @@ jobs:
- name: Copy Trivy Java DB
run: |
oras cp ghcr.io/aquasecurity/trivy-java-db:1 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
oras cp ghcr.io/aquasecurity/trivy-java-db:1 "${REGISTRY}/${IMAGE_NAME}:latest"
.github/workflows/test.yaml
+20 -2
View File
@@ -10,14 +10,32 @@ env:
BATS_LIB_PATH: '/usr/lib/'
jobs:
lint:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: Run zizmor
uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
with:
advanced-security: false
test:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: Setup Bats and bats libs
id: setup-bats
uses: bats-core/bats-action@3.0.1
uses: bats-core/bats-action@42fcc8700f773c075a16a90eb11674c0318ad507 # 3.0.1
- name: Install Trivy
run: |