Harden scheduled/downstream build workflows against zizmor findings - #6544
Merged
bmribler merged 4 commits intoAug 4, 2026
Merged
Conversation
Fix all zizmor static-analysis findings in the scheduled/downstream build
workflows without changing behavior:
- template-injection: move ${{ }} expressions out of run: script bodies
into step-level env: blocks referenced as shell variables
- artipacked: add persist-credentials: false to actions/checkout steps
(none of these jobs push to git)
- excessive-permissions: add top-level 'permissions: contents: read' to
macos-26-matrix.yml (other files already restrict permissions)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
mkitti
requested review from
glennsong09,
hyoklee,
jhendersonHDF and
lrknox
as code owners
July 20, 2026 21:33
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Hardens several scheduled/downstream GitHub Actions workflows to address zizmor findings (template injection, artipacked, and excessive permissions) without changing behavior.
Changes:
- Moves
${{ ... }}expressions out ofrun:bodies into stepenv:and references via shell vars. - Adds
persist-credentials: falseto flaggedactions/checkoutsteps. - Adds a top-level
permissions: contents: readto the macOS matrix workflow.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/netcdf.yml | Adds persist-credentials: false to checkouts; switches ${{ runner.workspace }} usage to env var. |
| .github/workflows/macos-26-matrix.yml | Adds top-level reduced permissions; hardens checkout and ${{ runner.workspace }} usage via env. |
| .github/workflows/linkchecker.yml | Hardens checkout; moves step outcome expression to env var for job summary publishing. |
| .github/workflows/hdfeos5.yml | Adds persist-credentials: false; uses RUNNER_WORKSPACE env var in build steps. |
| .github/workflows/daily-schedule.yml | Moves needs/steps/secrets expressions into env vars; uses them in shell. |
| .github/workflows/daily-build.yml | Moves input/output expressions into env vars for run: echo steps. |
| .github/workflows/cve.yml | Uses RUNNER_WORKSPACE env var for build dir; adds persist-credentials: false to repo checkout. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+30
to
+33
| env: | ||
| DAILY_BUILD_FILE_BASE: ${{ needs.daily-build.outputs.file_base }} | ||
| run: | | ||
| FILE_NAME_BASE=$(echo "${{ needs.daily-build.outputs.file_base }}") | ||
| FILE_NAME_BASE=$(echo "$DAILY_BUILD_FILE_BASE") |
Comment on lines
+57
to
+59
| - env: | ||
| HDF5_NAME_BASE: ${{ steps.gethdf5base.outputs.HDF5_NAME_BASE }} | ||
| run: echo "hdf5 base name is $HDF5_NAME_BASE." |
| INPUTS_USE_IGNORE: ${{ inputs.use_ignore }} | ||
| run: | | ||
| echo "INPUTS_IGNORE=${{ inputs.use_ignore }}" >> $GITHUB_OUTPUT | ||
| echo "INPUTS_IGNORE=$INPUTS_USE_IGNORE" >> $GITHUB_OUTPUT |
Contributor
- Drop unnecessary command substitution in daily-schedule.yml's FILE_NAME_BASE assignment - Name the two env-block steps in daily-build.yml that previously ran unnamed (easier to scan in logs) - Quote $GITHUB_OUTPUT in the getinputs step Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
Author
|
Addressed the 3 Copilot review comments in db8ea95:
|
hyoklee
previously approved these changes
Jul 23, 2026
lrknox
approved these changes
Aug 4, 2026
github-project-automation
Bot
moved this from To be triaged
to Done
in HDF5 - TRIAGE & TRACK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens the scheduled/downstream build workflows against all
zizmorv1.25.2 static-analysis findings. No behavioral change:${{ }}expressions moved out ofrun:bodies are referenced identically via shell env vars, andpersist-credentials: falseonly prevents the checkout token from being written to the git config (none of these jobs push to git).Findings fixed per file
Remediation patterns
${{ runner.workspace }},${{ steps.*.outputs.* }},${{ inputs.use_ignore }},${{ needs.*.outputs.* }},${{ steps.lychee.outcome }}, and${{ secrets.AWS_S3_BUCKET }}were moved into step-levelenv:blocks and referenced as$NAMEin the scripts.persist-credentials: falseadded to each flaggedactions/checkoutstep. No job in these files pushes to git, so all were safe to harden.macos-26-matrix.ymllacked a top-levelpermissions:block; addedpermissions: contents: read. The other six files already restrict permissions.Verified:
zizmorreports zero findings across all seven files, and all files pass YAML validation.🤖 Generated with Claude Code