Add zizmor for GHA security analysis - #2201
Conversation
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
matthiask
left a comment
There was a problem hiding this comment.
Thanks. I think it's a good idea to try this out.
|
We were discussing this in django-commons/best-practices#13 and decided on limiting it to only run based on |
- Pin all third-party actions to full-length commit SHAs instead of tags - Add `persist-credentials: false` to all actions/checkout steps to prevent credential exposure - Add explicit permissions declarations - Pin mariadb Docker image to specific version (11.8) instead of using floating `latest` tag - Replace template expressions with environment variables where possible
9543fc6 to
bba2c50
Compare
| run: >- | ||
| gh release create | ||
| '${{ github.ref_name }}' | ||
| '${GITHUB_REF_NAME}' |
There was a problem hiding this comment.
JFYI, I think this will cause a failure in your release process -- it's still single quoted so the shell variable won't be expanded correctly 🙂
(i.e. it needs to be double-quoted instead.)
| run: >- | ||
| gh release upload | ||
| '${{ github.ref_name }}' dist/** | ||
| '${GITHUB_REF_NAME}' dist/** |
|
Sorry for being nosey on this PR, but I was looking at downstream users of (And thanks for trying out zizmor!) |
|
Thank you for the spot check! I knew I needed to test the release, but didn't get around to it. I really need to automate that 😅 |
Code sourced from: https://docs.zizmor.sh/integrations/#github-actions
Checklist:
docs/changes.rst.