diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index d6afd5da55c..e16300f120b 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -25,6 +25,8 @@ jobs: with: # history is needed to run git cherry-pick below fetch-depth: 0 + # zizmor: ignore[artipacked] Credentials are required by the branch push below. + persist-credentials: true - name: Use CLA approved github bot run: .github/scripts/use-cla-approved-bot.sh @@ -34,11 +36,12 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request env: NUMBER: ${{ github.event.inputs.number }} - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid) @@ -49,6 +52,7 @@ jobs: git checkout -b $branch git cherry-pick $commit git push --set-upstream origin $branch - gh pr create --title "[$GITHUB_REF_NAME] $title" \ - --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \ - --base $GITHUB_REF_NAME + gh pr create \ + --title "[$GITHUB_REF_NAME] $title" \ + --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \ + --base $GITHUB_REF_NAME diff --git a/.github/workflows/benchmark-tags.yml b/.github/workflows/benchmark-tags.yml index f43fda3bef3..f01de055978 100644 --- a/.github/workflows/benchmark-tags.yml +++ b/.github/workflows/benchmark-tags.yml @@ -25,6 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ matrix.tag-version }} + persist-credentials: false - id: setup-java name: Set up Java for build diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 258a22c2f9d..20b5145e378 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -28,6 +28,8 @@ jobs: run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - id: setup-java name: Set up Java for build diff --git a/.github/workflows/build-daily.yml b/.github/workflows/build-daily.yml index 15f3f8c03f1..70b9c6d3c8d 100644 --- a/.github/workflows/build-daily.yml +++ b/.github/workflows/build-daily.yml @@ -20,6 +20,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Java uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 diff --git a/.github/workflows/build-tracecontext-testsuite.yml b/.github/workflows/build-tracecontext-testsuite.yml index de7586806a6..5305506469d 100644 --- a/.github/workflows/build-tracecontext-testsuite.yml +++ b/.github/workflows/build-tracecontext-testsuite.yml @@ -21,6 +21,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Login to GitHub package registry uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ca3d8fab774..e0cc57dc811 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -41,6 +41,8 @@ jobs: jmh-based-tests: true steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - id: setup-java-test name: Set up Java ${{ matrix.test-java-version }} for tests @@ -58,15 +60,19 @@ jobs: java-version: 21 - name: Set up gradle + # zizmor: ignore[cache-poisoning] This tests release branches but does not + # publish release artifacts. uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 - name: Build + shell: bash run: > ./gradlew build ${{ matrix.coverage && 'jacocoTestReport' || '' }} -PtestJavaVersion=${{ matrix.test-java-version }} - "-Porg.gradle.java.installations.paths=${{ steps.setup-java-test.outputs.path }}" + "-Porg.gradle.java.installations.paths=${TEST_JAVA_PATH}" "-Porg.gradle.java.installations.auto-download=false" env: + TEST_JAVA_PATH: ${{ steps.setup-java-test.outputs.path }} # JMH-based tests run only if this environment variable is set to true RUN_JMH_BASED_TESTS: ${{ matrix.jmh-based-tests }} DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} @@ -116,6 +122,8 @@ jobs: - 25 # renovate(graal-java-version) steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1.6.3 with: java-version: ${{ matrix.test-graal-version }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c59bd531bef..14882a880f0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Java 21 if: matrix.language == 'java' @@ -41,6 +43,8 @@ jobs: java-version: 21 - name: Set up gradle + # zizmor: ignore[cache-poisoning] This workflow analyzes release branches + # but does not build or publish release artifacts. if: matrix.language == 'java' uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 diff --git a/.github/workflows/detect-api-changes.yml b/.github/workflows/detect-api-changes.yml index a3fffc04a79..bc9862ec401 100644 --- a/.github/workflows/detect-api-changes.yml +++ b/.github/workflows/detect-api-changes.yml @@ -4,10 +4,10 @@ on: # pull_request_target is used instead of pull_request so that the workflow has write access # (to post comments and apply labels) even when triggered by fork PRs. # - # SECURITY: this workflow must never checkout or execute any code from the PR branch. - # Doing so would allow malicious PRs to exfiltrate secrets. All we use from the PR - # is github.event.pull_request.number (an integer), which is safe. pull_request_target: + # zizmor: ignore[dangerous-triggers] Required to label and comment on fork PRs; + # no PR code is checked out, and the PR number and head ref are passed through env + # and treated only as data. types: [opened, synchronize, reopened, ready_for_review] permissions: {} @@ -23,6 +23,8 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-issues: write + permission-pull-requests: read - name: Check for API changes and update PR env: diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index 57331185724..dbf08425440 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0 with: diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml index 5eb702bacbf..4ea59a4014a 100644 --- a/.github/workflows/gradle-wrapper-validation.yml +++ b/.github/workflows/gradle-wrapper-validation.yml @@ -12,6 +12,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # this needs to be in its own workflow in order to make OSSF scorecard happy - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 diff --git a/.github/workflows/issue-management-feedback-label.yml b/.github/workflows/issue-management-feedback-label.yml index 6af660e9f89..5a7caf7c515 100644 --- a/.github/workflows/issue-management-feedback-label.yml +++ b/.github/workflows/issue-management-feedback-label.yml @@ -19,6 +19,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Remove labels env: diff --git a/.github/workflows/javadoc-crawler.yml b/.github/workflows/javadoc-crawler.yml index 886cc7cee3f..34ba75a8361 100644 --- a/.github/workflows/javadoc-crawler.yml +++ b/.github/workflows/javadoc-crawler.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml index 258a2ecd2f8..3dcd6f2b2e0 100644 --- a/.github/workflows/prepare-patch-release.yml +++ b/.github/workflows/prepare-patch-release.yml @@ -12,6 +12,9 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # zizmor: ignore[artipacked] Credentials are required by the branch push below. + persist-credentials: true - run: | if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x$ ]]; then @@ -52,10 +55,11 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | message="Prepare release $VERSION" @@ -64,6 +68,7 @@ jobs: git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "[$GITHUB_REF_NAME] $message" \ - --body "$message." \ - --base $GITHUB_REF_NAME + gh pr create \ + --title "[$GITHUB_REF_NAME] $message" \ + --body "$message." \ + --base $GITHUB_REF_NAME diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml index 8733de2d322..bda03d5a68c 100644 --- a/.github/workflows/prepare-release-branch.yml +++ b/.github/workflows/prepare-release-branch.yml @@ -10,6 +10,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Verify prerequisites run: | @@ -35,6 +37,8 @@ jobs: # history is needed to allow fast-forward push below in case # re-running this workflow after merging additional PRs to main fetch-depth: 0 + # zizmor: ignore[artipacked] Credentials are required by the branch pushes below. + persist-credentials: true - name: Create release branch run: | @@ -68,10 +72,11 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against the release branch env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | message="Prepare release $VERSION" @@ -80,9 +85,10 @@ jobs: git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \ - --body "$message." \ - --base $RELEASE_BRANCH_NAME + gh pr create \ + --title "[$RELEASE_BRANCH_NAME] $message" \ + --body "$message." \ + --base $RELEASE_BRANCH_NAME create-pull-request-against-main: permissions: @@ -92,6 +98,9 @@ jobs: - prereqs steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # zizmor: ignore[artipacked] Credentials are required by the branch push below. + persist-credentials: true - name: Set environment variables run: | @@ -124,10 +133,11 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against main env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | message="Update version to $NEXT_VERSION" @@ -137,6 +147,7 @@ jobs: git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "$message" \ - --body "$body" \ - --base main + gh pr create \ + --title "$message" \ + --body "$body" \ + --base main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2f1de71af56..59aff0b9898 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,6 +22,8 @@ jobs: fi - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: @@ -71,6 +73,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main + persist-credentials: false - name: Check that change log update was merged to main run: | @@ -87,6 +90,7 @@ jobs: with: # tags are needed for the generate-release-contributors.sh script fetch-depth: 0 + persist-credentials: false - name: Generate release notes env: @@ -146,6 +150,8 @@ jobs: # add change log sync (if any) into this PR since the apidiff update # is required before any other PR can be merged anyway - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Copy change log section from release branch env: @@ -157,6 +163,8 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main + # zizmor: ignore[artipacked] Credentials are required by the branch push below. + persist-credentials: true - name: Merge change log to main env: @@ -219,11 +227,12 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against main env: VERSION: ${{ needs.release.outputs.version }} - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows + # pull requests from secrets.GITHUB_TOKEN do not run workflows GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | message="Post-release updates for $VERSION" @@ -233,6 +242,7 @@ jobs: git checkout -b $branch git commit -m "$message" git push --set-upstream origin $branch - gh pr create --title "$message" \ - --body "$body" \ - --base main + gh pr create \ + --title "$message" \ + --body "$body" \ + --base main diff --git a/.github/workflows/reusable-link-check.yml b/.github/workflows/reusable-link-check.yml index 09f9b4bd61d..22094e08a85 100644 --- a/.github/workflows/reusable-link-check.yml +++ b/.github/workflows/reusable-link-check.yml @@ -13,6 +13,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # needed for merge-base used in modified-files mode + persist-credentials: false - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3 diff --git a/.github/workflows/sonatype-guide-dependency-audit-daily.yml b/.github/workflows/sonatype-guide-dependency-audit-daily.yml index 2f0334bff80..03b04b65095 100644 --- a/.github/workflows/sonatype-guide-dependency-audit-daily.yml +++ b/.github/workflows/sonatype-guide-dependency-audit-daily.yml @@ -17,6 +17,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: diff --git a/.github/workflows/survey-on-merged-pr.yml b/.github/workflows/survey-on-merged-pr.yml index 3523cc2756a..ab2e3d009a9 100644 --- a/.github/workflows/survey-on-merged-pr.yml +++ b/.github/workflows/survey-on-merged-pr.yml @@ -1,7 +1,9 @@ name: Survey on Merged PR by Non-Member on: - pull_request_target: # zizmor: ignore[dangerous-triggers] — this workflow only calls the reusable shared workflow; no PR code is checked out or executed. + pull_request_target: + # zizmor: ignore[dangerous-triggers] This only calls the trusted reusable + # workflow; no PR code is checked out or executed. types: [closed] branches: [main] diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000000..d97b5797db1 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,20 @@ +name: Zizmor + +on: + push: + branches: + - main + - release/* + pull_request: + schedule: + - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday + workflow_dispatch: + +permissions: {} + +jobs: + zizmor: + permissions: + contents: read # for actions/checkout + security-events: write # for zizmor to upload SARIF results + uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0