ci: add ruff, zizmor, and CodeQL static analysis - #2
Merged
Conversation
Wire three static-analysis passes into CI and harden the workflows so they run clean against them: - ruff (pyflakes F rules) and zizmor (GitHub Actions security auditor) run in the ci.yml static job. CodeQL scans Python and the native C sources (the DLL injector, cryptbase RNG stub, and XCurl CA shim, cross-compiled with mingw so the extractor observes them) via a new codeql.yml. - Harden every workflow to pass zizmor: set persist-credentials: false on all actions/checkout steps, and stop expanding workflow_dispatch inputs (force_rebuild / publish / channel) inline in run blocks, binding them to env vars instead (the template-injection findings). - Drop an unused import ruff flagged in tests/test_auth_settings.py. Validated locally: ruff, zizmor, and actionlint all clean; 221 tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014pmkUWS6teoMZUUnMJG7Gr
codeql-action v3 is an annotated tag, so the git-ref API returns the tag object SHA (3b0bd1d), not a commit. zizmor's online impostor-commit audit correctly flags pinning to it as "a commit that doesn't belong to the repo". Pin the underlying commit (4187e74) the tag resolves to. This only surfaces with an API token, hence it passed locally (offline) but failed in CI where GH_TOKEN enables zizmor's online audits. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014pmkUWS6teoMZUUnMJG7Gr
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds three static-analysis passes and the workflow hardening needed to run them clean. Validated green on the fork (CI + CodeQL); CodeQL surfaced no alerts.
What
Frules) and zizmor (GitHub Actions security auditor) run in theci.ymlstatic job.codeql.yml, new) scans Python and the native C sources (the DLL injector, cryptbase RNG stub, and XCurl CA shim, cross-compiled with mingw so the extractor observes them).Hardening (surfaced by zizmor)
persist-credentials: falseon everyactions/checkout(verified: no workflow uses the persisted git token; releases go throughgh/softprops).workflow_dispatchinputs (force_rebuild/publish/channel) inline inrun:blocks, binding them toenv:vars instead (template-injection).codeql-actionto its commit SHA rather than the annotated-tag object (zizmorimpostor-commit).Also
tests/test_auth_settings.py.Local + CI results: ruff, zizmor, and actionlint clean; 221 tests pass; CodeQL green with 0 alerts.
Written with Claude Code