Resolve remaining zizmor code scanning alerts#28
Merged
Conversation
Fixes the 9 open alerts at https://github.com/rubyatscale/shared-config/security/code-scanning: - zizmor/ref-version-mismatch (8 alerts): stale version comments on already-pinned SHAs across ci.yml, stale.yml, and zizmor.yml. Floating major tags (v6, v1, v3, v10) move forward as new releases ship, so a comment written when a SHA was "the current v6" goes stale once v6 moves on. Same class of issue already fixed in cd.yml (#27). Updated each comment to the precise version currently tagged at that exact SHA (v7.0.0, v1.314.0, v3.0.3, v10.3.0 respectively) - the pinned SHAs themselves are unchanged. - zizmor/artipacked (1 alert): codeql.yml's checkout step didn't set persist-credentials: false. Unlike cd.yml's deploy job, this one only reads the repo for analysis and never pushes, so disabling persistence is correct here (no exception needed). Verified with `zizmor .github/workflows/`, both offline and --gh-token: 0 findings across every workflow in the repo.
3 tasks
dduugg
added a commit
that referenced
this pull request
Jul 25, 2026
Every consumer repo currently carries its own full copy of this file, differing only in the language matrix (ruby-only, js/ts-only, rust-only, or some mix, plus "actions" everywhere). That means fixes like the stale-version-comment cleanup in #28 have to be repeated by hand across ~20 repos instead of landing once here, same as ci.yml/cd.yml/stale.yml/ triage.yml already solved for their own workflows. Converts codeql.yml to workflow_call, taking the language list as a JSON-array input (e.g. '["actions","ruby"]') instead of a hardcoded matrix. build-mode is now unconditionally "none" for every language, since that's what every current caller already used (GA since CodeQL 2.23.3, including for Rust/C++). Since codeql.yml no longer has its own push/pull_request/schedule triggers, shared-config would otherwise stop scanning its own .github/workflows/ - added codeql-self-scan.yml to carry those triggers and call the reusable workflow locally (`uses: ./.github/workflows/ codeql.yml`, not @main, so a PR that edits codeql.yml is tested against its own in-PR version rather than whatever's already on main). Verified with zizmor (offline + --gh-token) and actionlint: 0 findings on both new/changed files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the 9 alerts open at https://github.com/rubyatscale/shared-config/security/code-scanning:
zizmor/ref-version-mismatch(8 alerts) acrossci.yml,stale.yml,zizmor.yml: stale version comments on already-pinned SHAs.actions/checkout,ruby/setup-ruby,slackapi/slack-github-action, andactions/staleall use floating major tags (v6,v1,v3,v10) that move forward as new releases ship — a comment written when a SHA was "the current v6" goes stale oncev6moves on to a newer commit. Same class of issue already fixed incd.ymlby Fix broken gem releases: restore persisted checkout credentials in cd.yml #27. Updated each comment to the precise version currently tagged at that exact SHA (v7.0.0,v1.314.0,v3.0.3,v10.3.0) — the pinned SHAs themselves are unchanged, only the human-readable labels.zizmor/artipacked(1 alert):codeql.yml's checkout step didn't setpersist-credentials: false. Unlikecd.yml'sdeployjob (which needs the persisted credential forgit push, per Fix broken gem releases: restore persisted checkout credentials in cd.yml #27), this job only reads the repo for CodeQL analysis and never pushes anything, so disabling persistence is the correct, safe default here — no exception needed.Test plan
zizmor .github/workflows/— 0 findings across every workflow in the repo, both offline and with--gh-token