zizmor findings backlog: pins, expressions and checkout credentials

[ChrisJBurns]

zizmor runs in CI as a blocking check (#6251 added it advisory, #6274 made it gate at medium). This issue tracked working through what it reported.

111 findings at the start → 0.

GH_TOKEN=$(gh auth token) pipx run zizmor==1.29.0 --persona=regular .github/
No findings to report. Good job!

zizmor defaults to offline mode — run it with GH_TOKEN set or the numbers won't match, since offline hides some rules and rates artipacked higher than it deserves.

What landed

PR	What
#6251	Adopt zizmor (advisory); stop running each security scan twice per PR
#6254	unpinned-uses ×11, ref-version-mismatch ×4
#6255	artipacked ×20 across 12 CI workflows
#6258	template-injection ×16, artipacked ×7, excessive-permissions ×1
#6259	Size labeler no longer takes its target from an artifact a pull request controls
#6260	@claude gated on write access rather than contribution history
#6261	Removed the now-unread PR number from the size artifact
#6262	Four findings suppressed, each with its reasoning in the workflow
#6263	releaser.yml permissions scoped; tag expression bound
#6266	Release app token scoped to contents + pull-requests
#6269	Test workflows receive one named secret instead of every repository secret
#6270	helm-publish.yml GHCR credentials and chart version bound
#6272	The last two app tokens scoped; commit trailer bound
#6274	The check now blocks, at medium
#6275	helm-publish.yml cleared entirely
#6281	The last 13 — create-release-tag.yml, releaser.yml, create-release-pr.yml

Every rule reached zero: unpinned-uses, ref-version-mismatch, template-injection, artipacked, secrets-inherit, github-app, excessive-permissions, dangerous-triggers.

The four that are suppressed rather than fixed (#6262)

Each carries its justification inline, so the reasoning sits with the code:

• pr-size-label-apply.yml, release-notes.yml — dangerous-triggers. The workflow_run trigger cannot be dropped in either case; the weakness that made the first dangerous was fixed in Derive PR number from the triggering run in the size labeler #6259, and the second checks out the default branch rather than an event-supplied ref.
• claude.yml — artipacked. contents: write exists so Claude can push commits; the credential is in use. Do not "fix" this one.
• api-compat.yml — artipacked. Cannot push, runs a git fetch, and is the repository's only required status check.

Things worth remembering

• --format=sarif suppresses zizmor's findings exit code. The zizmor action's documented Advanced Security usage therefore reports without gating. security-scan.yml calls the action twice for that reason: once to report at every severity and upload SARIF, once with advanced-security: false to gate.
• workflow_run consumers always run the copy of the workflow on the default branch. A pull request can change a producer but not the consumer reading its output, which is why Derive PR number from the triggering run in the size labeler #6259 and Stop writing the PR number into the size label artifact #6261 had to be split.
• workflow_run.pull_requests is empty for fork pull requests — and for most same-repository ones. Measured over 30 runs before relying on it.
• A job's permissions: is the reliable test for whether a checkout needs its credential, far more so than grepping for git push. A job with contents: read cannot push whatever it runs.
• arduino/setup-task@v2 was a branch, not a tag. Worth checking before assuming a @vN reference is immutable.

Follow-up

The gate sits at medium. With nothing left for it to catch, it could drop to low or lower — worth doing once a release has passed through the changed release workflows unchanged, rather than stacking two untested changes on the same release.

actionlint is still not in CI, which is how #6265 went unnoticed.

[ChrisJBurns]

Status update — PRs in flight:

PR	Covers	Result
#6251	zizmor adoption + 1 ref-version-mismatch + duplicate-scan removal	—
#6254	unpinned-uses ×11, ref-version-mismatch ×4	both rules reach 0 once #6251 also merges
#6255	artipacked ×18 (CI workflows), stacked on #6254	37 → 19

Two corrections to the numbers first posted here, both from the same mistake — measuring on a feature branch rather than main:

• ref-version-mismatch is 5 on main, not 6. The 6th only exists on the Add zizmor to CI and stop double-running the security scan #6251 branch, which adds a second upload-sarif reference.
• artipacked is 37 on main, not 38. The 38th was the zizmor job’s own checkout, before that PR set persist-credentials: false on it in response to a code scanning finding.

Also corrected in §4: #6251 does not fix either security-scan.yml artipacked finding. Those two are the Grype and govulncheck checkouts and are untouched — they are held back purely to avoid a branch conflict, so they are the cheapest thing to pick up once #6251 lands.

[ChrisJBurns]

#6255 merged. Measured against main at b20cb9f:

Rule	Originally	Now	Left
unpinned-uses	11	0	✅
ref-version-mismatch	5	0	✅
artipacked	37	17	#6258 takes it to 10
template-injection	45	45	#6258 takes it to 29

Two findings worth flagging from re-checking the remainder:

• issue-triage.yml declares contents: read, so its artipacked finding is provably safe to fix — no job in it can push. That is now the cheapest thing left on the list.
• claude.yml declares contents: write, so it genuinely can push and is the one agent workflow that needs thought rather than a one-line change.

Checking permissions: turned out to be the reliable test throughout — far more dependable than reading the steps for git push. It is what made release-notes.yml safe to include in #6258 despite it running claude-code-action.

[ChrisJBurns]

Situation report — measured against main at aa1628e.

111 → 47. #6259 and #6260 have merged, so this issue now carries the complete inventory: dangerous-triggers, github-app, secrets-inherit and excessive-permissions were previously held back while the weaknesses they pointed at were unfixed, and are folded in above.

Two rules are fully cleared — unpinned-uses (11 → 0) and ref-version-mismatch (5 → 0).

What changed in the shape of the problem: the backlog is no longer spread across the repository. 39 of the remaining 47 are in the four release workflows, and 8 of the 10 remaining High-severity findings are there. Everything outside them is either one investigation (secrets-inherit), two justified suppressions, or two accepted findings.

One correction worth recording: the two dangerous-triggers findings are now mitigated rather than fixable — zizmor flags the workflow_run trigger itself, which is not going away in either workflow. They need # zizmor: ignore[dangerous-triggers] with the reasoning written down, not a code change. Suppressing them without that would defeat the point of the gate.