From 9c9ead612d626eb20423f8c8096fdba2ea1c106b Mon Sep 17 00:00:00 2001 From: Kunal Mehta Date: Wed, 15 Jul 2026 16:59:36 -0400 Subject: [PATCH 1/4] Update zizmor to 1.27.0 --- .../requirements/develop-requirements.in | 2 +- .../requirements/develop-requirements.txt | 27 +++++++++---------- 2 files changed, 13 insertions(+), 16 deletions(-) diff --git a/securedrop/requirements/develop-requirements.in b/securedrop/requirements/develop-requirements.in index 7bc1618287..fbbe615a8c 100644 --- a/securedrop/requirements/develop-requirements.in +++ b/securedrop/requirements/develop-requirements.in @@ -39,4 +39,4 @@ pytest-testinfra>=5.3.1 translate-toolkit uv>=0.11.15 yamllint -zizmor +zizmor>=1.27 diff --git a/securedrop/requirements/develop-requirements.txt b/securedrop/requirements/develop-requirements.txt index b12bb5b37e..7c50146cb3 100644 --- a/securedrop/requirements/develop-requirements.txt +++ b/securedrop/requirements/develop-requirements.txt @@ -1493,19 +1493,16 @@ zipp==3.23.0 \ --hash=sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e \ --hash=sha256:a07157588a12518c9d4034df3fbbee09c814741a33ff63c05fa29d26a2404166 # via importlib-metadata -zizmor==0.10.0 \ - --hash=sha256:01743f434d8dacd3d4009999e92ddf2952c2138bfc10ab2eb1e2e592f31cb0a2 \ - --hash=sha256:1c64fcd25149107aa6a5435fa2cf909b8fd92af2a7dfb8650aad59a1eb10f35e \ - --hash=sha256:20eb70b037116ef29f4b90f298801f3cccb54f0a04e3454ae0ee31e70d554d77 \ - --hash=sha256:4894141e6f0adb4821d377aad91cbcb699c88ae5c816267189926b2d40becdd3 \ - --hash=sha256:514c5f0e104008884e4e0a2cdd1ad4cc63fc280791f43a8521f3fb96a7f264af \ - --hash=sha256:7bbf8275ac411682200217a60a3f8ce8bf3b545ff9a1ea3c2d26436ad4ca81e1 \ - --hash=sha256:7d74d430feb5c0a28fba3a200eac1ae6ce7e7ecbf593f386149f9c41fa02aeea \ - --hash=sha256:85da4c1dd42b031aad3550024c6f9d2525668f04285b4280454c278153383e59 \ - --hash=sha256:948eda1c8a33ac28946972f4672fddd09dd9ad793934b6f5d572b74acce1ec15 \ - --hash=sha256:b88048c5b11af489ff37ff064fdd9a9cad6ea9cc34e8c25a9d2e196819859cf1 \ - --hash=sha256:c9319af1c1806525aa18501488be2f9ba9f03b16ce8cb1c10e98b563e89aacfc \ - --hash=sha256:d74ec6b1547f529756315238805fdfb58b59b09b6b7b85b49d38a68dc96aa706 \ - --hash=sha256:ecac7a28aef6c7e058e0292da6f04345cfd21d36def7acff0038500544bd48c1 \ - --hash=sha256:ffdacfddbb4eb4cbb0126e3875eb21a453414be47fe423824fdf1946fff9cc02 +zizmor==1.27.0 \ + --hash=sha256:0bba3eff43f919b04b9b6365b4ef17437649e11eafb73f603407873b65ad01dd \ + --hash=sha256:0de272b6c19910f5bc6965ac7d4566af26db31571e983e3b567298389d0c84c7 \ + --hash=sha256:138e65d560e3875dbbbec50eae56a9e14707f8f4e006112174e4752155c01db9 \ + --hash=sha256:90004342c3c5122d7e4e8e27ac6d3c462b878da0ea3d408ff45fa7d768139a76 \ + --hash=sha256:afb28123882d2b8248f1e480bf6cc6d1af102e0d3fbe22a40f7f795b1aa9d435 \ + --hash=sha256:b70697ebe555a28fbd3deaa259936f059f64b9f8531020f5b1f3d99087d4f62a \ + --hash=sha256:cc94158472428e04298b879ef36cb94360b753ece38fa2303464dd7dae07bc68 \ + --hash=sha256:debc723721172c170d5922171a40eaebf5787a02ff3e69d30597dafdb66a21ba \ + --hash=sha256:e1042dd14fb4597a1e3007c7ef3f5a017305ca50cfacf43d603f3ae870c65eb1 \ + --hash=sha256:fe8947f635c925b83ef83fcd66de5f89a012b22784bb86fcd7e2a1f4e7648c9d \ + --hash=sha256:ffaf8e1bb39447e643592d669761bfbc2aa636875db9079614f6a6c81cec60c8 # via -r requirements/develop-requirements.in From bbea944415bee8b42e000d6fa55569e0f0639f5f Mon Sep 17 00:00:00 2001 From: Kunal Mehta Date: Wed, 15 Jul 2026 17:12:01 -0400 Subject: [PATCH 2/4] Set explicit permissions on every GHA workflow --- .github/workflows/build.yml | 3 +++ .github/workflows/cargo-vet.yml | 3 +++ .github/workflows/ci.yml | 3 +++ .github/workflows/demo-test.yml | 3 +++ .github/workflows/security.yml | 3 +++ .github/workflows/staging.yml | 3 +++ .github/workflows/translation.yml | 3 +++ 7 files changed, 21 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6c0376723c..a37866641b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -15,6 +15,9 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: build-debs: strategy: diff --git a/.github/workflows/cargo-vet.yml b/.github/workflows/cargo-vet.yml index 1b58d8d287..bf0e6f0f94 100644 --- a/.github/workflows/cargo-vet.yml +++ b/.github/workflows/cargo-vet.yml @@ -9,6 +9,9 @@ on: types: ["opened", "synchronize"] merge_group: +permissions: + contents: read + jobs: cargo-vet: name: Vet Dependencies diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 330376a308..b1f1ebdc2f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,9 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: lint: runs-on: ubuntu-latest diff --git a/.github/workflows/demo-test.yml b/.github/workflows/demo-test.yml index 97b06b7559..e2ec196197 100644 --- a/.github/workflows/demo-test.yml +++ b/.github/workflows/demo-test.yml @@ -12,6 +12,9 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: build: name: Build Demo diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 0defbb9c81..4ba1df9068 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -8,6 +8,9 @@ on: schedule: - cron: '0 3 * * *' +permissions: + contents: read + jobs: rust-audit: runs-on: ubuntu-latest diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml index 110d159c03..69e02bbc90 100644 --- a/.github/workflows/staging.yml +++ b/.github/workflows/staging.yml @@ -7,6 +7,9 @@ on: schedule: - cron: '0 3 * * *' +permissions: + contents: read + jobs: staging: strategy: diff --git a/.github/workflows/translation.yml b/.github/workflows/translation.yml index 269c128f9e..4c91833f5c 100644 --- a/.github/workflows/translation.yml +++ b/.github/workflows/translation.yml @@ -13,6 +13,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith( github.ref, 'refs/heads/release/' ) }} +permissions: + contents: read + jobs: locales: runs-on: ubuntu-latest From 09a6a5f4c41d218ee1142b0777bbfac2e655166c Mon Sep 17 00:00:00 2001 From: Kunal Mehta Date: Mon, 10 Aug 2026 12:37:50 -0400 Subject: [PATCH 3/4] Ignore cache-poisoning lint for cargo-vet.yml This lint is primarily for publish workflows that could use a poisoned cache for release artifacts, but our cargo-vet workflow isn't that sensitive so keeping the caching is worth it. --- .github/zizmor.yml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000000..17a626ec79 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + cache-poisoning: + ignore: + # not used for releases / sensitive artifacts + - cargo-vet.yml From 01f4079b5d8875b042fd9408ebaf7c369ca6edcf Mon Sep 17 00:00:00 2001 From: Kunal Mehta Date: Wed, 15 Jul 2026 16:59:27 -0400 Subject: [PATCH 4/4] Switch to hash-pinned GitHub Actions Done using `GH_TOKEN=$(gh auth token) zizmor . --fix=all`. --- .github/workflows/build.yml | 8 ++++---- .github/workflows/cargo-vet.yml | 4 ++-- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/demo-test.yml | 4 ++-- .github/workflows/dependency-review.yml | 4 ++-- .github/workflows/security.yml | 6 +++--- .github/workflows/staging.yml | 2 +- .github/workflows/translation.yml | 6 +++--- .github/zizmor.yml | 5 +++++ 9 files changed, 28 insertions(+), 23 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a37866641b..cbf2b256f6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -31,10 +31,10 @@ jobs: outputs: artifact_id: ${{ steps.upload.outputs.artifact-id }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.versions.python }} - name: Build SecureDrop packages @@ -46,7 +46,7 @@ jobs: - name: Build admin packages run: | OS_VERSION=${{ matrix.versions.ubuntu }} WHAT=admin ./builder/build-debs.sh - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 id: upload with: name: ${{ matrix.versions.ubuntu }}-${{ matrix.build }} @@ -66,7 +66,7 @@ jobs: run: | apt-get update && apt-get install --yes diffoscope-minimal xz-utils \ --no-install-recommends - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: "${{ matrix.ubuntu_version }}-*" - name: diffoscope diff --git a/.github/workflows/cargo-vet.yml b/.github/workflows/cargo-vet.yml index bf0e6f0f94..a0472af244 100644 --- a/.github/workflows/cargo-vet.yml +++ b/.github/workflows/cargo-vet.yml @@ -21,10 +21,10 @@ jobs: env: CARGO_VET_VERSION: 0.10.2 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/cache@v6.1.0 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 id: cache-vet with: path: /usr/local/cargo/bin/cargo-vet diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b1f1ebdc2f..033373fe1d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,7 +28,7 @@ jobs: - name: Install Git run: | apt-get update && apt-get install --yes git - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install dependencies @@ -55,7 +55,7 @@ jobs: ubuntu_version: - noble steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build image @@ -73,7 +73,7 @@ jobs: ubuntu_version: - noble steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build image @@ -91,7 +91,7 @@ jobs: ubuntu_version: - noble steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build image @@ -112,7 +112,7 @@ jobs: # Keep version in sync with rust-toolchain.toml container: rust:1.96.0 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install dependencies @@ -127,7 +127,7 @@ jobs: admin-tests: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run tests diff --git a/.github/workflows/demo-test.yml b/.github/workflows/demo-test.yml index e2ec196197..c7aa2b3961 100644 --- a/.github/workflows/demo-test.yml +++ b/.github/workflows/demo-test.yml @@ -32,11 +32,11 @@ jobs: env: DOCKERIZE_VERSION: v0.6.1 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ needs.build.outputs.artifact-name }} - name: Restore container image diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 327bfa2c96..15677fc296 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -9,8 +9,8 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: 'Dependency Review' - uses: actions/dependency-review-action@v5.0.0 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 4ba1df9068..a4a561431c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -17,7 +17,7 @@ jobs: # Keep version in sync with rust-toolchain.toml container: rust:1.96.0 steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Check Rust dependencies @@ -27,10 +27,10 @@ jobs: static-analysis: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - name: Install dependencies diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml index 69e02bbc90..f04d0e2804 100644 --- a/.github/workflows/staging.yml +++ b/.github/workflows/staging.yml @@ -21,7 +21,7 @@ jobs: GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }} UBUNTU_VERSION: ${{ matrix.ubuntu_version }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run staging tests on GCE diff --git a/.github/workflows/translation.yml b/.github/workflows/translation.yml index 4c91833f5c..e69bf40087 100644 --- a/.github/workflows/translation.yml +++ b/.github/workflows/translation.yml @@ -24,7 +24,7 @@ jobs: env: GITHUB_ACTOR: ${{ github.actor }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Generate locale list @@ -58,7 +58,7 @@ jobs: env: LOCALES: ${{ matrix.locale }} steps: - - uses: actions/checkout@v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build image @@ -68,7 +68,7 @@ jobs: run: | make translation-test - name: Save screenshots - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: screenshots-${{ matrix.locale }} path: securedrop/tests/functional/pageslayout/screenshots/ diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 17a626ec79..d69921e498 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -3,3 +3,8 @@ rules: ignore: # not used for releases / sensitive artifacts - cargo-vet.yml + unpinned-uses: + config: + policies: + freedomofpress/actionslib/.github/workflows/oci-build.yaml: any + freedomofpress/actionslib/.github/workflows/update-k8s-trigger.yaml: any