Skip to content

Commit 033ecf5

Browse files
AlexWaygoodAlexWaygood
authored
Also have zizmor check for low-severity security issues (#14893)
## Summary This PR changes our zizmor configuration to also flag low-severity security issues in our GitHub Actions workflows. It's a followup to #14844. The issues being fixed here were all flagged by [zizmor's `template-injection` rule](https://woodruffw.github.io/zizmor/audits/#template-injection): > Detects potential sources of code injection via template expansion. > > GitHub Actions allows workflows to define template expansions, which occur within special `${{ ... }}` delimiters. These expansions happen before workflow and job execution, meaning the expansion of a given expression appears verbatim in whatever context it was performed in. > > Template expansions aren't syntax-aware, meaning that they can result in unintended shell injection vectors. This is especially true when they're used with attacker-controllable expression contexts, such as `github.event.issue.title` (which the attacker can fully control by supplying a new issue title). [...] > To fully remediate the vulnerability, you should not use `${{ env.VARNAME }}`, since that is still a template expansion. Instead, you should use `${VARNAME}` to ensure that the shell itself performs the variable expansion. ## Test Plan I tested that this passes all zizmore warnings by running `pre-commit run -a zizmor` locally. The other test is obviously to check that the workflows all still run correctly in CI 😄
1 parent 5509a3d commit 033ecf5

File tree

5 files changed

+24
-37
lines changed

5 files changed

+24
-37
lines changed

‎.github/workflows/build-binaries.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,9 @@ jobs:
5353
args: --out dist
5454
- name: "Test sdist"
5555
run: |
56-
pip install dist/${{ env.PACKAGE_NAME }}-*.tar.gz --force-reinstall
57-
${{ env.MODULE_NAME }} --help
58-
python -m ${{ env.MODULE_NAME }} --help
56+
pip install dist/${PACKAGE_NAME}-*.tar.gz --force-reinstall
57+
"${MODULE_NAME}" --help
58+
python -m "${MODULE_NAME}" --help
5959
- name: "Upload sdist"
6060
uses: actions/upload-artifact@v4
6161
with:
@@ -125,7 +125,7 @@ jobs:
125125
args: --release --locked --out dist
126126
- name: "Test wheel - aarch64"
127127
run: |
128-
pip install dist/${{ env.PACKAGE_NAME }}-*.whl --force-reinstall
128+
pip install dist/${PACKAGE_NAME}-*.whl --force-reinstall
129129
ruff --help
130130
python -m ruff --help
131131
- name: "Upload wheels"
@@ -186,9 +186,9 @@ jobs:
186186
if: ${{ !startsWith(matrix.platform.target, 'aarch64') }}
187187
shell: bash
188188
run: |
189-
python -m pip install dist/${{ env.PACKAGE_NAME }}-*.whl --force-reinstall
190-
${{ env.MODULE_NAME }} --help
191-
python -m ${{ env.MODULE_NAME }} --help
189+
python -m pip install dist/${PACKAGE_NAME}-*.whl --force-reinstall
190+
"${MODULE_NAME}" --help
191+
python -m "${MODULE_NAME}" --help
192192
- name: "Upload wheels"
193193
uses: actions/upload-artifact@v4
194194
with:
@@ -236,9 +236,9 @@ jobs:
236236
- name: "Test wheel"
237237
if: ${{ startsWith(matrix.target, 'x86_64') }}
238238
run: |
239-
pip install dist/${{ env.PACKAGE_NAME }}-*.whl --force-reinstall
240-
${{ env.MODULE_NAME }} --help
241-
python -m ${{ env.MODULE_NAME }} --help
239+
pip install dist/${PACKAGE_NAME}-*.whl --force-reinstall
240+
"${MODULE_NAME}" --help
241+
python -m "${MODULE_NAME}" --help
242242
- name: "Upload wheels"
243243
uses: actions/upload-artifact@v4
244244
with:

‎.github/workflows/build-docker.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,10 @@ jobs:
8787
outputs: type=image,name=${{ env.RUFF_BASE_IMG }},push-by-digest=true,name-canonical=true,push=${{ inputs.plan != '' && !fromJson(inputs.plan).announcement_tag_is_implicit }}
8888

8989
- name: Export digests
90+
env:
91+
digest: ${{ steps.build.outputs.digest }}
9092
run: |
9193
mkdir -p /tmp/digests
92-
digest="${{ steps.build.outputs.digest }}"
9394
touch "/tmp/digests/${digest#sha256:}"
9495
9596
- name: Upload digests
@@ -143,7 +144,7 @@ jobs:
143144
run: |
144145
docker buildx imagetools create \
145146
$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
146-
$(printf '${{ env.RUFF_BASE_IMG }}@sha256:%s ' *)
147+
$(printf '${RUFF_BASE_IMG}@sha256:%s ' *)
147148
148149
docker-publish-extra:
149150
name: Publish additional Docker image based on ${{ matrix.image-mapping }}
@@ -182,7 +183,7 @@ jobs:
182183
# Generate Dockerfile content
183184
cat <<EOF > Dockerfile
184185
FROM ${BASE_IMAGE}
185-
COPY --from=${{ env.RUFF_BASE_IMG }}:latest /ruff /usr/local/bin/ruff
186+
COPY --from=${RUFF_BASE_IMG}:latest /ruff /usr/local/bin/ruff
186187
ENTRYPOINT []
187188
CMD ["/usr/local/bin/ruff"]
188189
EOF
@@ -288,4 +289,4 @@ jobs:
288289
docker buildx imagetools create \
289290
"${annotations[@]}" \
290291
$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
291-
$(printf '${{ env.RUFF_BASE_IMG }}@sha256:%s ' *)
292+
$(printf '${RUFF_BASE_IMG}@sha256:%s ' *)

‎.github/workflows/publish-docs.yml‎

Lines changed: 8 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,11 @@ jobs:
4949
5050
- name: "Set branch name"
5151
run: |
52-
version="${{ env.version }}"
53-
display_name="${{ env.display_name }}"
5452
timestamp="$(date +%s)"
5553
5654
# create branch_display_name from display_name by replacing all
5755
# characters disallowed in git branch names with hyphens
58-
branch_display_name="$(echo "$display_name" | tr -c '[:alnum:]._' '-' | tr -s '-')"
56+
branch_display_name="$(echo "${display_name}" | tr -c '[:alnum:]._' '-' | tr -s '-')"
5957
6058
echo "branch_name=update-docs-$branch_display_name-$timestamp" >> $GITHUB_ENV
6159
echo "timestamp=$timestamp" >> $GITHUB_ENV
@@ -93,22 +91,18 @@ jobs:
9391
run: mkdocs build --strict -f mkdocs.public.yml
9492

9593
- name: "Clone docs repo"
96-
run: |
97-
version="${{ env.version }}"
98-
git clone https://${{ secrets.ASTRAL_DOCS_PAT }}@github.com/astral-sh/docs.git astral-docs
94+
run: git clone https://${{ secrets.ASTRAL_DOCS_PAT }}@github.com/astral-sh/docs.git astral-docs
9995

10096
- name: "Copy docs"
10197
run: rm -rf astral-docs/site/ruff && mkdir -p astral-docs/site && cp -r site/ruff astral-docs/site/
10298

10399
- name: "Commit docs"
104100
working-directory: astral-docs
105101
run: |
106-
branch_name="${{ env.branch_name }}"
107-
108102
git config user.name "astral-docs-bot"
109103
git config user.email "176161322+astral-docs-bot@users.noreply.github.com"
110104
111-
git checkout -b $branch_name
105+
git checkout -b "${branch_name}"
112106
git add site/ruff
113107
git commit -m "Update ruff documentation for $version"
114108
@@ -117,12 +111,8 @@ jobs:
117111
env:
118112
GITHUB_TOKEN: ${{ secrets.ASTRAL_DOCS_PAT }}
119113
run: |
120-
version="${{ env.version }}"
121-
display_name="${{ env.display_name }}"
122-
branch_name="${{ env.branch_name }}"
123-
124114
# set the PR title
125-
pull_request_title="Update ruff documentation for $display_name"
115+
pull_request_title="Update ruff documentation for "${display_name}""
126116
127117
# Delete any existing pull requests that are open for this version
128118
# by checking against pull_request_title because the new PR will
@@ -131,12 +121,12 @@ jobs:
131121
xargs -I {} gh pr close {}
132122
133123
# push the branch to GitHub
134-
git push origin $branch_name
124+
git push origin "${branch_name}"
135125
136126
# create the PR
137-
gh pr create --base main --head $branch_name \
127+
gh pr create --base main --head "${branch_name}" \
138128
--title "$pull_request_title" \
139-
--body "Automated documentation update for $display_name" \
129+
--body "Automated documentation update for "${display_name}"" \
140130
--label "documentation"
141131
142132
- name: "Merge Pull Request"
@@ -145,9 +135,7 @@ jobs:
145135
env:
146136
GITHUB_TOKEN: ${{ secrets.ASTRAL_DOCS_PAT }}
147137
run: |
148-
branch_name="${{ env.branch_name }}"
149-
150138
# auto-merge the PR if the build was triggered by a release. Manual builds should be reviewed by a human.
151139
# give the PR a few seconds to be created before trying to auto-merge it
152140
sleep 10
153-
gh pr merge --squash $branch_name
141+
gh pr merge --squash "${branch_name}"

‎.github/workflows/sync_typeshed.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
with:
3232
repository: python/typeshed
3333
path: typeshed
34-
persist-credentials: true
34+
persist-credentials: false
3535
- name: Setup git
3636
run: |
3737
git config --global user.name typeshedbot

‎.pre-commit-config.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,6 @@ repos:
9595
# `release.yml` is autogenerated by `dist`; security issues need to be fixed there
9696
# (https://opensource.axo.dev/cargo-dist/)
9797
exclude: .github/workflows/release.yml
98-
# We could consider enabling the low-severity warnings, but they're noisy
99-
args: [--min-severity=medium]
10098

10199
- repo: https://github.com/python-jsonschema/check-jsonschema
102100
rev: 0.30.0

0 commit comments

Comments
 (0)