Summary
The .github/workflows/ YAML files generated from the templates in this repository have two security-related findings flagged by zizmor in linux-system-roles/ssh#239.
These findings apply to the template source used to generate the workflow files, so fixes should be made here.
Finding 1 — Credential persistence (artipacked)
Severity: Warning
Rule: artipacked
The actions/checkout step does not set persist-credentials: false. This means GitHub credentials (the GITHUB_TOKEN) are written to the local git config and remain available to all subsequent steps and any action invoked after checkout, which is a wider-than-necessary credential scope.
Suggested fix:
- name: Checkout code
uses: actions/checkout@<hash>
with:
persist-credentials: false
Finding 2 — Unpinned action reference (unpinned-uses)
Severity: Error
Rule: unpinned-uses
actions/checkout@v6 is referenced by a mutable tag rather than an immutable commit hash. A compromised or altered tag could introduce unexpected code into CI.
Suggested fix: Pin to the full commit SHA of the desired release, e.g.:
uses: actions/checkout@<full-sha> # v6
References
Summary
The
.github/workflows/YAML files generated from the templates in this repository have two security-related findings flagged by zizmor in linux-system-roles/ssh#239.These findings apply to the template source used to generate the workflow files, so fixes should be made here.
Finding 1 — Credential persistence (artipacked)
Severity: Warning
Rule:
artipackedThe
actions/checkoutstep does not setpersist-credentials: false. This means GitHub credentials (theGITHUB_TOKEN) are written to the local git config and remain available to all subsequent steps and any action invoked after checkout, which is a wider-than-necessary credential scope.Suggested fix:
Finding 2 — Unpinned action reference (unpinned-uses)
Severity: Error
Rule:
unpinned-usesactions/checkout@v6is referenced by a mutable tag rather than an immutable commit hash. A compromised or altered tag could introduce unexpected code into CI.Suggested fix: Pin to the full commit SHA of the desired release, e.g.:
References