ci: Refine workflow linting (strict zizmor, workflow_run guard) - #58
Merged
Conversation
Drop the zizmor-action wrapper and run the pinned tool directly, so --strict-collection fails the job on a malformed collected file (an action.yml, dependabot.yml) instead of warning and skipping it. pipx is preinstalled on ubuntu-latest. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Reviewer's GuideThe PR tightens CI workflow security and linting by running pinned zizmor directly with strict collection enabled, adding CodeRabbit zizmor coverage, and pinning workflow_run deployment and documentation jobs to the successful triggering commit while rejecting fork-originated runs. Sequence diagram for guarded workflow_run deploymentsequenceDiagram
participant Build as Build any branch
participant Deploy as Deploy Snapshot
participant GitHub as GitHub repository
Build->>GitHub: complete(conclusion, head_sha, head_repository)
GitHub->>Deploy: workflow_run event
alt conclusion == success and head_repository.full_name == github.repository
Deploy->>GitHub: checkout(head_sha)
Deploy->>Deploy: deploy snapshot
else unsuccessful or fork-originated run
Deploy-->>GitHub: skip job
end
Sequence diagram for guarded workflow_run documentation publishsequenceDiagram
participant Build as Build any branch
participant Publish as Build site
participant GitHub as GitHub repository
Build->>GitHub: complete(conclusion, head_sha, head_repository)
GitHub->>Publish: workflow_run event
alt successful same-repository run
Publish->>GitHub: checkout(head_sha)
Publish->>Publish: publish documentation
else unsuccessful or fork-originated run
Publish-->>GitHub: skip workflow_run job
end
Flow diagram for strict workflow lintingflowchart LR
Files[.github workflows and collected files] --> Zizmor[pipx run zizmor==1.30.1]
Zizmor --> Strict[--strict-collection]
Strict --> Result{Lint passes?}
Result -->|yes| CI[Blocking Lint workflows job]
Result -->|no| Fail[Fail CI]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Warning Review limit reachedNext included review available in 51 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe workflows now restrict ChangesWorkflow security and lint enforcement
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~15 minutes Merge Risk: ⚪ Minimal · up to Deployment and documentation publishing now run only against validated same-repository commits, and workflow linting is stricter. No actionable current-head risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/publish-docs.yml" line_range="44" />
<code_context>
steps:
- uses: actions/checkout@v7
with:
+ ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
persist-credentials: false
- uses: ./.github/actions/jdk-setup
</code_context>
<issue_to_address>
**issue (broader_impact):** When the `workflow_run` is for `Record Dependabot update in changes.xml`, checkout uses that workflow's `head_sha`, which is the commit that triggered the pull-request-closed workflow rather than the new commit that the workflow appends to and pushes on `main`. The docs job therefore publishes a site from the pre-changelog or PR commit and omits the changelog update (and can publish code that was not merged).
**Triggers:** When the `Record Dependabot update in changes.xml` workflow completes for a merged Dependabot pull request.
**Suggested fix:** Use the repository's resulting default-branch commit for the Dependabot workflow_run case, or restrict the `head_sha` checkout behavior to `Build any branch` runs and resolve the post-update `main` commit explicitly.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and the workflow_run condition and checkout ref define which repository and commit are trusted for deployment and documentation publishing. If either is wrong, an untrusted or unintended commit could be executed or published before a revert can undo the resulting deployment or publication.
Blocking findings: .github/workflows/publish-docs.yml:44
jeffjensen
force-pushed
the
ci/workflow-linting-refinements
branch
from
September 10, 2026 22:29
6fa238d to
8491a20
Compare
Deploy Snapshot and the docs-publish build-site job run in the workflow_run context with a read/write token. Guard both with `head_repository.full_name == github.repository` so a fork branch named `main` cannot reach them (the branches filter alone does not exclude a fork whose branch happens to be named `main`). Deploy Snapshot additionally checks out `workflow_run.head_sha` -- the exact commit that passed CI -- instead of the default branch, so a commit landing on main after the green build cannot be deployed untested (the deploy skips tests). The docs publish keeps its default-branch checkout: it is also triggered by "Record Dependabot update in changes.xml", whose head_sha predates the changelog commit that workflow pushes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
Turn on CodeRabbit's zizmor integration alongside actionlint so it picks up .github/zizmor.yml, and extend the .github/** path instruction so prose review defers workflow syntax and security findings to actionlint and zizmor and does not re-raise the deliberate `# zizmor: ignore` suppressions, tag-pinned first-party actions, or workspace-relative action syntax. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
jeffjensen
force-pushed
the
ci/workflow-linting-refinements
branch
from
September 10, 2026 22:30
8491a20 to
a8d817c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the workflow linting up to the same shape the four database-audits /
java-service-archetype repos landed on after their review rounds.
ci: Run zizmor with --strict-collectionThe
zizmor-actionwrapper has no way to pass--strict-collection, so amalformed collected file (a broken
dependabot.yml, anaction.yml) is warnedabout and skipped rather than failing the job. Run the pinned tool directly
(
pipx run zizmor==1.30.1, pipx is preinstalled on ubuntu-latest).ci: Pin the workflow_run deploy jobs to the tested commitDeploy Snapshot and the docs publish checked out the default branch, so a commit
landing on
mainbetween a green build and the queuedworkflow_runjob couldbe deployed/published untested. Check out
workflow_run.head_sha(the committhat passed) and guard the job with
head_repository.full_name == github.repositoryso a fork branch namedmainstill can't reach it.
ci(coderabbit): Enable the zizmor tool and note workflow lintingTurn on CodeRabbit's built-in
zizmorintegration and extend the.github/**path instruction to cover it and the Lint workflows job.
Both linters pass clean locally.
🤖 Generated with Claude Code
https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ
Summary by Sourcery
Harden workflow validation and workflow_run job safety to prevent untested or fork-controlled code from being deployed or published.
Bug Fixes:
Enhancements:
CI:
Summary by CodeRabbit
Security
Bug Fixes
Chores