CI hardening: dependabot coverage for pinned actions + zizmor config - #7258
Merged
stevebeattie merged 3 commits intoJun 26, 2026
Conversation
![depthfirst-app[bot]](https://avatars.githubusercontent.com/in/1021002?s=60&v=4){kind=small}
Refs: PSEC-923 Generated-By: claude-guard chain d2d47b92264e83c43634f08012f1073d Skills-Applied: zizmor-config Skills-Sha: e807467ba50afb365a042ab4ad88b49c0ad4a4644ff06e0396a2116307be8ac3 Image-Sha: sha256:7263f9b592131d79316129974effb2efc6a19a2cfea7c2c4dd445664550901bb
Pin wolfi-dev/actions/install-wolfictl from the floating @main ref to a 40-character commit SHA, closing the unpinned-uses supply-chain exposure (a push to wolfi-dev/actions main would otherwise run immediately in this job with id-token: write and the minted octo-sts token). The # main version comment is retained intentionally: dependabot github-actions (added in .github/dependabot.yml) tracks branch-pinned SHAs and opens PRs to advance the SHA as new commits land on main, preserving the maintainer's intent to follow the latest action while gating each bump through review. zizmor's residual stale-action-refs (Low) is accepted — the SHA does not resolve to a release tag because wolfi-dev/actions publishes none. Refs: PSEC-923
The repo SHA-pins external actions but has no dependabot or renovate configuration, so those pins are never monitored for updates and will go stale. Add a dependabot github-actions ecosystem (weekly, grouped minor/patch) with a 3-day cooldown matching the existing .github/zizmor.yml dependabot-cooldown threshold, so the pinned actions are tracked for updates while still leaving a short window for a freshly-published release to be caught before it is applied. Also add .github/dependabot.yml to the zizmor workflow's paths: triggers so edits to the dependabot config re-run the zizmor check. Refs: PSEC-923
stevebeattie
force-pushed
the
security/psec-923-test-remediation-packages
branch
from
June 26, 2026 19:39
d1e078b to
bf3a2f6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GitHub Actions supply-chain hardening surfaced by a
zizmoraudit of.github/.The repo SHA-pins its external actions but had no dependency-update configuration,
so those pins were never monitored for new releases. This adds that coverage and
tidies the
zizmorconfiguration.Changes
.github/dependabot.yml(new) — add agithub-actionsecosystem (weekly,minor/patch updates grouped,
open-pull-requests-limit: 10) with a 3-daycooldown. The repo's pinned actions now get monitored update PRs, and thecooldown matches the existing
dependabot-cooldownthreshold already declaredin
.github/zizmor.yml(previously a threshold with no dependabot config toapply it to). The short cooldown leaves a window for a freshly-published
release to be caught before it is applied. The
zizmorworkflow'spaths:triggers are extended to include
.github/dependabot.ymlso edits to thedependabot config re-run the check.
.github/workflows/delete-old-branches.yaml—install-wolfictlisintentionally referenced at
@main(per the inline comment, to always get thelatest action), and
wolfi-dev/actionspublishes no release tags to pinagainst. Rather than freeze it to a branch SHA, add a documented
zizmor: ignore[unpinned-uses]on that line so the deliberate exception isexplicit and the audit stays clean.
.github/zizmor.yml— disable the cosmetic pedantic-persona rulesanonymous-definition,undocumented-permissions, andconcurrency-limits.Testing
zizmor(whole repo): clean of actionable findings after the change.actionlint: clean.main; all workflows still parse.Refs: PSEC-923