chore: add zizmor GitHub Actions security workflow by Copilot · Pull Request #518 · CycloneDX/cyclonedx-node-yarn

Copilot · 2026-05-05T15:39:48Z

Description

Adds .github/workflows/zizmor.yml to continuously audit all workflows in .github/workflows/** for security issues using zizmor.

Workflow behaviour

pull_request (path-filtered to .github/workflows/**): runs on every PR touching workflow files; job fails on any findings, blocking merge
push (path-filtered to .github/workflows/**): runs on every push touching workflow files
schedule: weekly full scan every Saturday 00:00 UTC regardless of changes

Implementation details

advanced-security: false — emits findings as workflow-command annotations (::error file=…) rather than uploading a SARIF report to GitHub's Security tab; produces a non-zero exit on findings (blocking). Uploading SARIF would require security-events: write and GitHub Advanced Security (GHAS), both of which are unnecessary here and would violate the least-privilege policy. The two modes are mutually exclusive: advanced-security must be false for annotations to take effect.
annotations: true — surfaces findings as GitHub PR annotations (up to 10 rendered inline; remainder in job log)
persist-credentials: false on checkout
Least-privilege: permissions: {} at workflow level, contents: read at job level only
timeout-minutes: 10
All action refs pinned to full commit SHAs with version comments, matching repo conventions

Also fixes all zizmor findings in the existing nodejs.yml and release.yml workflows:

Added persist-credentials: false to all checkout steps
Updated actions/setup-node SHA to current v6 tag (48b55a011bda)
Fixed DerLev/eslint-annotations impostor SHA → correct v2 SHA (a79ea65c1b45)
Replaced softprops/action-gh-release with gh release CLI commands

Resolves or fixes issue: none

AI Tool Disclosure

My contribution does not include any AI-generated content
My contribution includes AI-generated content, as disclosed below:
- AI Tools: GitHub Copilot
- LLMs and versions: Claude Sonnet 4.5
- Prompts: Create a zizmor GitHub Actions security workflow per the issue spec

Affirmation

My code follows the CONTRIBUTING.md guidelines

codacy-production · 2026-05-05T15:40:26Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-node-yarn/sessions/1e8571f1-a06d-4aca-a1f8-c20eeae239bb Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>

Co-authored-by: Jan Kowalleck <jan.kowalleck@gmail.com> Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck · 2026-05-05T16:04:16Z

zizmor has some fingsind

Status: Downloaded newer image for ghcr.io/zizmorcore/zizmor@sha256:128ebbe369a95f9d4427737e794537256095b55f779a247aebc960dc4ea1f7b3
 INFO zizmor: 🌈 zizmor v1.24.1
 WARN audit:audit{input=Workflow(file://./.github/workflows/nodejs.yml)}: zizmor::audit::impostor_commit: fast path impostor check failed for DerLev/eslint-annotations@e75c54a2984700c03d60c5252c9c6a203bf013f5: request error while accessing GitHub API
 INFO audit: zizmor: 🌈 completed ./.github/workflows/nodejs.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/release.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/zizmor.yml
Warning: nodejs.yml:35: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: nodejs.yml:81: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: nodejs.yml:127: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: nodejs.yml:156: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: nodejs.yml:186: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: nodejs.yml:229: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: nodejs.yml:299: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Error: nodejs.yml:110: commit with no history in referenced repository: uses a commit that doesn't belong to the specified org/repo
Warning: nodejs.yml:40: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: nodejs.yml:87: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: nodejs.yml:110: action's hash pin has mismatched or missing version comment: points to commit a79ea65c1b45
Warning: nodejs.yml:133: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: nodejs.yml:162: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: nodejs.yml:234: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: nodejs.yml:304: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: release.yml:44: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: release.yml:103: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: release.yml:150: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: release.yml:174: credential persistence through GitHub Actions artifacts: does not set persist-credentials: false
Warning: release.yml:59: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: release.yml:110: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: release.yml:181: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Warning: release.yml:225: action's hash pin has mismatched or missing version comment: points to commit 48b55a011bda
Notice: release.yml:293: action functionality is already included by the runner: use `gh release` in a script step
Error: Process completed with exit code 14.

@copilot fix the findings from zizmor

Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-node-yarn/sessions/7ead9f7c-d6d7-4111-8aa2-0564b8e1d73d Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>

Copilot · 2026-05-05T16:12:20Z

zizmor has some fingsind

...

Fixed in 3ebad30. Changes across nodejs.yml and release.yml:

persist-credentials: false added to all checkout steps; the bump job now sets the remote URL with GITHUB_TOKEN explicitly before git push instead of relying on persisted credentials
actions/setup-node SHA updated from v6.3.0 (53b83947) to the current v6 tag (48b55a011bda)
DerLev/eslint-annotations impostor SHA replaced with the correct v2 SHA (a79ea65c1b45)
softprops/action-gh-release replaced with gh release CLI commands

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck · 2026-05-05T16:40:43Z

@copilot the pr description does not follow the pullrequest template. fix this

jkowalleck · 2026-05-05T16:40:08Z

+          R_PRERELEASE: ${{ github.event.inputs.prerelease }}
+          R_TITLE: ${{ needs.bump.outputs.version_plain }}
+          R_VERSION: ${{ needs.bump.outputs.version }}
+        run: |


this needs manual testing

Copilot · 2026-05-05T16:42:12Z

@copilot the pr description does not follow the pullrequest template. fix this

Updated the PR description to follow the template with the required ### Description, ### AI Tool Disclosure, and ### Affirmation sections.

Initial plan

28d2a0d

Copilot AI assigned Copilot and jkowalleck May 5, 2026

Copilot started work on behalf of jkowalleck May 5, 2026 15:39 View session

Copilot AI linked an issue May 5, 2026 that may be closed by this pull request

chore: Harden all GitHub Workflows using Zizmor #517

Closed

chore: add zizmor GitHub Actions security workflow

f00fafd

Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-node-yarn/sessions/1e8571f1-a06d-4aca-a1f8-c20eeae239bb Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add Zizmor to harden all GitHub workflows~~ chore: add zizmor GitHub Actions security workflow May 5, 2026

Copilot finished work on behalf of jkowalleck May 5, 2026 15:43

Copilot AI requested a review from jkowalleck May 5, 2026 15:43

jkowalleck requested changes May 5, 2026

View reviewed changes

Comment thread .github/workflows/zizmor.yml

Comment thread .github/workflows/zizmor.yml

Comment thread .github/workflows/zizmor.yml Outdated

Copilot started work on behalf of jkowalleck May 5, 2026 16:02 View session

Apply suggestions from code review

86f82a1

Co-authored-by: Jan Kowalleck <jan.kowalleck@gmail.com> Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Copilot finished work on behalf of jkowalleck May 5, 2026 16:03

Copilot AI requested a review from jkowalleck May 5, 2026 16:03

Copilot started work on behalf of jkowalleck May 5, 2026 16:04 View session

fix: resolve all zizmor security findings in nodejs.yml and release.yml

3ebad30

Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-node-yarn/sessions/7ead9f7c-d6d7-4111-8aa2-0564b8e1d73d Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>

Copilot finished work on behalf of jkowalleck May 5, 2026 16:13

jkowalleck added 2 commits May 5, 2026 18:20

Update release.yml

1cf2496

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Update release.yml

11b87ed

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck marked this pull request as ready for review May 5, 2026 16:40

jkowalleck requested a review from a team as a code owner May 5, 2026 16:40

Copilot started work on behalf of jkowalleck May 5, 2026 16:40 View session

jkowalleck reviewed May 5, 2026

View reviewed changes

Copilot finished work on behalf of jkowalleck May 5, 2026 16:42

Copilot AI requested a review from jkowalleck May 5, 2026 16:42

jkowalleck merged commit b3bbf59 into main May 6, 2026
34 of 38 checks passed

jkowalleck deleted the copilot/add-zizmor-to-workflows branch May 6, 2026 08:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: add zizmor GitHub Actions security workflow#518

chore: add zizmor GitHub Actions security workflow#518
jkowalleck merged 6 commits intomainfrom
copilot/add-zizmor-to-workflows

Copilot AI commented May 5, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented May 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkowalleck commented May 5, 2026

Uh oh!

Copilot AI commented May 5, 2026

Uh oh!

jkowalleck commented May 5, 2026

Uh oh!

jkowalleck May 5, 2026

Uh oh!

Copilot AI commented May 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Copilot AI commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

AI Tool Disclosure

Affirmation

Uh oh!

codacy-production Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkowalleck commented May 5, 2026

Uh oh!

Copilot AI commented May 5, 2026

Uh oh!

jkowalleck commented May 5, 2026

Uh oh!

jkowalleck May 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented May 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented May 5, 2026 •

edited

Loading

codacy-production Bot commented May 5, 2026 •

edited

Loading