From aacbf3fd875d46566132c35311c415480b496e24 Mon Sep 17 00:00:00 2001 From: Alex Waygood Date: Fri, 28 Aug 2026 15:11:03 +0100 Subject: [PATCH 1/2] Add zizmor checks for GitHub Actions --- .github/workflows/daily.yml | 6 ++++++ .github/workflows/meta_tests.yml | 6 ++++++ .github/workflows/mypy_primer.yml | 1 + .github/workflows/mypy_primer_comment.yml | 4 +++- .github/workflows/stubsabot.yml | 11 +++++++---- .github/workflows/stubtest_stdlib.yml | 2 ++ .github/workflows/stubtest_third_party.yml | 3 ++- .github/workflows/tests.yml | 14 ++++++++++++++ .pre-commit-config.yaml | 6 ++++++ 9 files changed, 47 insertions(+), 6 deletions(-) diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 971051437762..ed097604d989 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -44,6 +44,8 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }} uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: @@ -68,6 +70,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" @@ -118,11 +122,13 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: path: typeshed + persist-credentials: false - name: Checkout stub_uploader uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: repository: typeshed-internal/stub_uploader path: stub_uploader + persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "typeshed/requirements-tests.txt" diff --git a/.github/workflows/meta_tests.yml b/.github/workflows/meta_tests.yml index 5dfd2b261284..486a584b6211 100644 --- a/.github/workflows/meta_tests.yml +++ b/.github/workflows/meta_tests.yml @@ -36,6 +36,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" @@ -57,6 +59,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" @@ -77,6 +81,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" diff --git a/.github/workflows/mypy_primer.yml b/.github/workflows/mypy_primer.yml index ad9dc3d45a20..4f7cdfac587c 100644 --- a/.github/workflows/mypy_primer.yml +++ b/.github/workflows/mypy_primer.yml @@ -29,6 +29,7 @@ jobs: with: path: typeshed_to_test fetch-depth: 0 + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" diff --git a/.github/workflows/mypy_primer_comment.yml b/.github/workflows/mypy_primer_comment.yml index 57aedb865c3c..a0b964c748f2 100644 --- a/.github/workflows/mypy_primer_comment.yml +++ b/.github/workflows/mypy_primer_comment.yml @@ -1,6 +1,8 @@ name: mypy_primer (comment) -on: +# workflow_run is needed to comment on PRs from forks. This workflow only reads +# artifacts as data; it never checks out or executes PR code. +on: # zizmor: ignore[dangerous-triggers] workflow_run: workflows: - mypy_primer diff --git a/.github/workflows/stubsabot.yml b/.github/workflows/stubsabot.yml index 3935eee29ed6..9996d6cab635 100644 --- a/.github/workflows/stubsabot.yml +++ b/.github/workflows/stubsabot.yml @@ -5,10 +5,7 @@ on: schedule: - cron: "0 0 * * *" -permissions: - contents: write - issues: write - pull-requests: write +permissions: {} env: FORCE_COLOR: 1 @@ -18,12 +15,16 @@ jobs: name: Upgrade stubs with stubsabot if: github.repository == 'python/typeshed' runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write # Create, update, and label PRs. steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: # use an ssh key so that checks automatically run on stubsabot PRs ssh-key: ${{ secrets.STUBSABOT_SSH_PRIVATE_KEY }} fetch-depth: 0 + persist-credentials: true # stubsabot needs the SSH key to push branches. - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" @@ -47,6 +48,8 @@ jobs: runs-on: ubuntu-latest needs: [stubsabot] if: ${{ github.repository == 'python/typeshed' && always() && (needs.stubsabot.result == 'failure') }} + permissions: + issues: write steps: - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: diff --git a/.github/workflows/stubtest_stdlib.yml b/.github/workflows/stubtest_stdlib.yml index 5587e4e67bde..cb6624a4bc4a 100644 --- a/.github/workflows/stubtest_stdlib.yml +++ b/.github/workflows/stubtest_stdlib.yml @@ -40,6 +40,8 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} on ${{ matrix.os }} uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: diff --git a/.github/workflows/stubtest_third_party.yml b/.github/workflows/stubtest_third_party.yml index e7d626572c79..e3763ae5de03 100644 --- a/.github/workflows/stubtest_third_party.yml +++ b/.github/workflows/stubtest_third_party.yml @@ -39,6 +39,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" @@ -54,7 +55,7 @@ jobs: # This only runs stubtest on changed stubs, because it is much faster. # Use the daily.yml workflow to run stubtest on all third party stubs. function find_stubs { - git diff --name-only origin/${{ github.base_ref }} HEAD | \ + git diff --name-only "origin/${GITHUB_BASE_REF}" HEAD | \ egrep ^stubs/ | cut -d "/" -f 2 | sort -u | \ (while read stub; do [ -d "stubs/$stub" ] && echo -n "$stub " || true; done) } diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 14d4fc0c6b8b..3f08dea1dc61 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -27,6 +27,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" @@ -48,6 +50,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} @@ -71,6 +75,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "requirements-tests.txt" @@ -95,6 +101,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.14" @@ -128,6 +136,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.14" @@ -162,6 +172,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" @@ -223,11 +235,13 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: path: typeshed + persist-credentials: false - name: Checkout stub_uploader uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: repository: typeshed-internal/stub_uploader path: stub_uploader + persist-credentials: false - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 with: version-file: "typeshed/requirements-tests.txt" diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 3444cf8bd4db..8a0d88fab958 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -43,6 +43,12 @@ repos: - repo: meta hooks: - id: check-hooks-apply + # zizmor detects security vulnerabilities in GitHub Actions workflows. + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: 451b56af716f9f0d0c2b816503a3fd0cf8b036fa # frozen: v1.29.0 + hooks: + - id: zizmor + priority: 0 ci: autofix_commit_msg: "[pre-commit.ci] auto fixes from pre-commit.com hooks" From 3138e91dd0b22be775b8b8bb168722fe8607f87c Mon Sep 17 00:00:00 2001 From: Alex Waygood Date: Fri, 28 Aug 2026 17:49:52 +0100 Subject: [PATCH 2/2] Update .pre-commit-config.yaml --- .pre-commit-config.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 8a0d88fab958..47dac83f561b 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -48,7 +48,6 @@ repos: rev: 451b56af716f9f0d0c2b816503a3fd0cf8b036fa # frozen: v1.29.0 hooks: - id: zizmor - priority: 0 ci: autofix_commit_msg: "[pre-commit.ci] auto fixes from pre-commit.com hooks"