Add Static Security Analysis of GitHub Actions Workflows by Bibo-Joshi · Pull Request #4606 · python-telegram-bot/python-telegram-bot · GitHub
Skip to content

Add Static Security Analysis of GitHub Actions Workflows#4606

Merged
Bibo-Joshi merged 7 commits intomasterfrom
zizmor
Dec 13, 2024
Merged

Add Static Security Analysis of GitHub Actions Workflows#4606
Bibo-Joshi merged 7 commits intomasterfrom
zizmor

Conversation

@Bibo-Joshi
Copy link
Copy Markdown
Member

@Bibo-Joshi Bibo-Joshi commented Dec 13, 2024 •
edited
Loading

Inspired by

Edit:

  1. I tested that the modified pypi release workflows still work correctly
  2. I decided to set up a workflow for this instead of using pre-commit because
    1. this enables to use the online audits
    2. workflows are rarely updated so that adding a pre-commit hook for that seems like an unnecessary additional install step on local end to me
  3. As far as I see, dependabot is able to update actions that are pinned with a sha

@Bibo-Joshi Bibo-Joshi added ⚙️ security affected functionality: security 🔗 github-actions related technology: github-actions ⚙️ ci-cd affected functionality: ci-cd labels Dec 13, 2024
@github-advanced-security
Copy link
Copy Markdown

github-advanced-security AI commented Dec 13, 2024

github-advanced-security[bot]
github-advanced-security AI found potential problems Dec 13, 2024
View reviewed changes
Comment thread .github/workflows/gha_security.yml Fixed
@Bibo-Joshi Bibo-Joshi merged commit 4afe174 into master Dec 13, 2024
@Bibo-Joshi Bibo-Joshi deleted the zizmor branch December 13, 2024 21:16
@github-actions github-actions Bot locked and limited conversation to collaborators Dec 21, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

⚙️ ci-cd affected functionality: ci-cd 🔗 github-actions related technology: github-actions ⚙️ security affected functionality: security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Bibo-Joshi @github-advanced-security