Skip to content

Commit 20a6d5a

Browse files
AlexanderBarabanovAlexanderBarabanov
authored
Addressing Zizmor and CodeQL findings (#2742)
* upgrade zizmor Signed-off-by: Barabanov <alexander.barabanov@intel.com> * address zizmor findings Signed-off-by: Barabanov <alexander.barabanov@intel.com> * address zizmor findings Signed-off-by: Barabanov <alexander.barabanov@intel.com> * address zizmor findings Signed-off-by: Barabanov <alexander.barabanov@intel.com> * address zizmor findings Signed-off-by: Barabanov <alexander.barabanov@intel.com> * address zizmor findings Signed-off-by: Barabanov <alexander.barabanov@intel.com> * limit permissions Signed-off-by: Barabanov <alexander.barabanov@intel.com> * limit permissions Signed-off-by: Barabanov <alexander.barabanov@intel.com> * limit permissions Signed-off-by: Barabanov <alexander.barabanov@intel.com> * fix permissions Signed-off-by: Barabanov <alexander.barabanov@intel.com> * fix permissions Signed-off-by: Barabanov <alexander.barabanov@intel.com> * fix permissions Signed-off-by: Barabanov <alexander.barabanov@intel.com> * fix permissions Signed-off-by: Barabanov <alexander.barabanov@intel.com> * fix permissions Signed-off-by: Barabanov <alexander.barabanov@intel.com> * added comments Signed-off-by: Barabanov <alexander.barabanov@intel.com> * added comments Signed-off-by: Barabanov <alexander.barabanov@intel.com> * remove unnecessary ignore Signed-off-by: Barabanov <alexander.barabanov@intel.com> * remove unnecessary ignore Signed-off-by: Barabanov <alexander.barabanov@intel.com> * fix bandit Signed-off-by: Barabanov <alexander.barabanov@intel.com> --------- Signed-off-by: Barabanov <alexander.barabanov@intel.com>
1 parent c7c25f0 commit 20a6d5a

20 files changed

+154
-41
lines changed

‎.github/actions/pytest/action.yaml

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,10 @@ runs:
117117
- name: Determine test scope
118118
id: test-scope
119119
shell: bash
120+
env:
121+
INPUTS_TEST_TYPE: ${{ inputs.test-type }}
120122
run: |
121-
case "${{ inputs.test-type }}" in
123+
case "$INPUTS_TEST_TYPE" in
122124
"unit")
123125
echo "path=tests/unit" >> $GITHUB_OUTPUT
124126
;;
@@ -135,23 +137,27 @@ runs:
135137
id: test-execution
136138
shell: bash
137139
continue-on-error: true
140+
env:
141+
INPUTS_DEVICE: ${{ inputs.device }}
142+
INPUTS_MAX_TEST_TIME: ${{ inputs.max-test-time }}
143+
STEPS_TEST_SCOPE_OUTPUTS_PATH: ${{ steps.test-scope.outputs.path }}
138144
run: |
139145
source .venv/bin/activate
140146
start_time=$(date +%s)
141147
142148
# Set device-specific pytest arguments
143-
if [ "${{ inputs.device }}" = "cpu" ]; then
149+
if [ "$INPUTS_DEVICE" = "cpu" ]; then
144150
marker="-m cpu" # Only run CPU tests
145151
else
146152
marker="" # Run all tests (both CPU and GPU marked tests)
147153
fi
148154
149155
# Run pytest
150-
PYTHONPATH=src pytest ${{ steps.test-scope.outputs.path }} \
156+
PYTHONPATH=src pytest "$STEPS_TEST_SCOPE_OUTPUTS_PATH" \
151157
--numprocesses=0 \
152158
--durations=10 \
153159
--durations-min=1.0 \
154-
--timeout=${{ inputs.max-test-time }} \
160+
--timeout="$INPUTS_MAX_TEST_TIME" \
155161
--verbosity=1 \
156162
--cov=src \
157163
--cov-report=xml \
@@ -194,13 +200,15 @@ runs:
194200
- name: Check test duration
195201
if: always()
196202
shell: bash
203+
env:
204+
INPUTS_MAX_TEST_TIME: ${{ inputs.max-test-time }}
205+
STEPS_TEST_EXECUTION_OUTPUTS_DURATION: ${{ steps.test-execution.outputs.duration }}
197206
run: |
198-
duration="${{ steps.test-execution.outputs.duration }}"
199-
if [ -n "$duration" ]; then
200-
echo "Test Duration: $duration seconds"
207+
if [ -n "$STEPS_TEST_EXECUTION_OUTPUTS_DURATION" ]; then
208+
echo "Test Duration: $STEPS_TEST_EXECUTION_OUTPUTS_DURATION seconds"
201209
202-
if [ "$duration" -gt "${{ inputs.max-test-time }}" ]; then
203-
echo "::warning::Test suite exceeded recommended duration of ${{ inputs.max-test-time }} seconds"
210+
if [ "$STEPS_TEST_EXECUTION_OUTPUTS_DURATION" -gt "$INPUTS_MAX_TEST_TIME" ]; then
211+
echo "::warning::Test suite exceeded recommended duration of $INPUTS_MAX_TEST_TIME seconds"
204212
fi
205213
else
206214
echo "Test Duration: Not available"
@@ -209,9 +217,14 @@ runs:
209217
- name: Upload coverage to Codecov
210218
if: success()
211219
shell: bash
220+
env:
221+
INPUTS_CODECOV_TOKEN: ${{ inputs.codecov-token }}
222+
INPUTS_TEST_TYPE: ${{ inputs.test-type }}
223+
INPUTS_PYTHON_VERSION: ${{ inputs.python-version }}
224+
212225
run: |
213226
source .venv/bin/activate
214-
codecov --token "${{ inputs.codecov-token }}" \
227+
codecov --token "$INPUTS_CODECOV_TOKEN" \
215228
--file coverage.xml \
216-
--flags "${{ inputs.test-type }}_py${{ inputs.python-version }}" \
217-
--name "${{ inputs.test-type }} tests (Python ${{ inputs.python-version }})"
229+
--flags "$INPUTS_TEST_TYPE_py$INPUTS_PYTHON_VERSION" \
230+
--name "$INPUTS_TEST_TYPE tests (Python $INPUTS_PYTHON_VERSION)"

‎.github/actions/security/bandit/action.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,8 @@ runs:
119119
INPUTS_CONFIDENCE_LEVEL: ${{ inputs.confidence-level }}
120120
INPUTS_OUTPUT_FORMAT: ${{ inputs.output-format }}
121121
INPUTS_FAIL_ON_FINDINGS: ${{ inputs.fail-on-findings }}
122-
run: |
122+
# zizmor ignore: all_changed_files is tj-actions/changed-files output
123+
run: | # zizmor: ignore[template-injection]
123124
set +e
124125
REPORT_FILE="bandit-report.$INPUTS_OUTPUT_FORMAT"
125126

‎.github/actions/security/semgrep/action.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,8 @@ runs:
108108
INPUTS_TIMEOUT: ${{ inputs.timeout }}
109109
INPUTS_OUTPUT_FORMAT: ${{ inputs.output-format }}
110110
INPUTS_FAIL_ON_FINDINGS: ${{ inputs.fail-on-findings }}
111-
run: |
111+
# zizmor ignore: all_changed_files is tj-actions/changed-files output
112+
run: | # zizmor: ignore[template-injection]
112113
set +e
113114
# Map standard severity levels to Semgrep's levels
114115
# Semgrep does not support hierarchy, levels must be set explicitly

‎.github/actions/security/trivy/action.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,8 @@ runs:
144144
INPUTS_GENERATE_SBOM: ${{ inputs.generate_sbom }}
145145
INPUTS_SBOM_FORMAT: ${{ inputs.sbom_format }}
146146

147-
run: |
147+
# zizmor ignore: all_changed_files is tj-actions/changed-files output
148+
run: | # zizmor: ignore[template-injection]
148149
# Create output directory
149150
mkdir -p reports
150151
REPORT_FILE="reports/trivy-$INPUTS_SCAN_TYPE-$INPUTS_SCANNERS.sarif"

‎.github/actions/security/zizmor/action.yaml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ inputs:
5151
zizmor-version:
5252
description: "Zizmor version"
5353
required: false
54-
default: "1.6.0"
54+
default: "1.9.0"
5555

5656
outputs:
5757
scan_result:
@@ -90,6 +90,7 @@ runs:
9090
INPUTS_OUTPUT_FORMAT: ${{ inputs.output-format }}
9191
INPUTS_FAIL_ON_FINDINGS: ${{ inputs.fail-on-findings }}
9292
ZIZMOR_VERSION: ${{ inputs.zizmor-version }}
93+
STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
9394

9495
# For changed scope: if changes in .github/** are detected, we rescan all files because
9596
# providing individual non-workflow files (even yaml) to Zizmor causes errors ("invalid GitHub Actions workflow").
@@ -103,7 +104,7 @@ runs:
103104
SEVERITY=$(echo "$INPUTS_SEVERITY_LEVEL" | tr '[:upper:]' '[:lower:]')
104105
CONFIDENCE=$(echo "$INPUTS_CONFIDENCE_LEVEL" | tr '[:upper:]' '[:lower:]')
105106
106-
if [[ "$INPUTS_SCAN_SCOPE" == "changed" && -n "${{ steps.changed-files.outputs.all_changed_files }}" ]]; then
107+
if [[ "$INPUTS_SCAN_SCOPE" == "changed" && -n "$STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES" ]]; then
107108
echo "There are some changes detected in .github/, checking with Zizmor"
108109
uvx zizmor=="$ZIZMOR_VERSION" \
109110
--min-confidence ${CONFIDENCE} \

‎.github/workflows/_reusable-artifact-builder.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,18 @@ on:
6969
description: "Name of the uploaded artifact"
7070
value: ${{ jobs.build.outputs.artifact-name }}
7171

72+
permissions:
73+
contents: read
74+
7275
jobs:
7376
build:
7477
runs-on: ubuntu-latest
7578
outputs:
7679
artifact-name: ${{ steps.set-artifact-name.outputs.name }}
7780
steps:
7881
- uses: actions/checkout@v4
82+
with:
83+
persist-credentials: false
7984
- uses: actions/setup-python@v5
8085
with:
8186
python-version: ${{ inputs.python-version }}

‎.github/workflows/_reusable-code-quality.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ on:
5454
type: string
5555
default: "3.10"
5656

57+
permissions:
58+
contents: read
59+
5760
jobs:
5861
pre-commit:
5962
runs-on: ubuntu-latest
@@ -63,6 +66,7 @@ jobs:
6366
with:
6467
fetch-depth: 0
6568
lfs: true
69+
persist-credentials: false
6670
- uses: ./.github/actions/code-quality/pre-commit
6771
with:
6872
python-version: ${{ inputs.python-version }}

‎.github/workflows/_reusable-production-release-process.yaml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,17 @@ on:
6161
pypi-token:
6262
required: true
6363

64+
permissions:
65+
contents: read
66+
6467
jobs:
6568
validate-release-readiness:
6669
runs-on: ubuntu-latest
6770
steps:
6871
- name: Check for approved RC
72+
env:
73+
VERSION: ${{ inputs.version }}
6974
run: |
70-
VERSION="${{ inputs.version }}"
7175
ARTIFACTS_JSON=$(curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
7276
"$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts")
7377
@@ -101,6 +105,8 @@ jobs:
101105
publish:
102106
needs: [prepare-release]
103107
uses: ./.github/workflows/_reusable-release-publisher.yaml
108+
permissions:
109+
contents: write # is required by action-gh-release (nested)
104110
with:
105111
version: ${{ inputs.version }}
106112
artifact-name: production-release-artifacts

‎.github/workflows/_reusable-rc-release-process.yaml

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,9 @@ on:
6666
test-pypi-token:
6767
required: true
6868

69+
permissions:
70+
contents: read
71+
6972
jobs:
7073
technical-review:
7174
environment:
@@ -139,14 +142,17 @@ jobs:
139142
fi
140143
env:
141144
VERSION: ${{ inputs.version }}
145+
STEPS_VALIDATE_DEPLOYMENT_OUTPUTS_STATUS: ${{ steps.validate-deployment.outputs.status }}
142146

143147
- name: Generate technical review report
148+
env:
149+
VERSION: ${{ inputs.version }}
144150
run: |
145151
cat << EOF > technical-review-report.md
146152
# Technical Review Report
147153
148154
## Version Information
149-
- Version: ${{ inputs.version }}
155+
- Version: "$VERSION"
150156
- Package Name: $(ls dist/*.whl | head -n 1 | xargs basename)
151157
152158
## Test Results
@@ -165,7 +171,7 @@ jobs:
165171
\`\`\`
166172
167173
## Test PyPI Deployment
168-
- Status: ${{ steps.validate-deployment.outputs.status }}
174+
- Status: "$STEPS_VALIDATE_DEPLOYMENT_OUTPUTS_STATUS"
169175
- URL: https://test.pypi.org/project/${PACKAGE_NAME}/${VERSION#v}/
170176
171177
EOF
@@ -195,11 +201,13 @@ jobs:
195201
path: qa-review
196202

197203
- name: Generate QA dashboard
204+
env:
205+
NEEDS_TECHNICAL_REVIEW_OUTPUTS_DEPLOYMENT_STATUS: ${{ needs.technical-review.outputs.deployment-status }}
198206
run: |
199207
echo "QA Review Dashboard"
200208
echo "==================="
201209
echo
202-
echo "Technical Review Status: ${{ needs.technical-review.outputs.deployment-status }}"
210+
echo "Technical Review Status: $NEEDS_TECHNICAL_REVIEW_OUTPUTS_DEPLOYMENT_STATUS"
203211
echo
204212
echo "Review the full technical report at: qa-review/technical-review-report.md"
205213
echo
@@ -222,8 +230,10 @@ jobs:
222230
name: technical-review-report
223231

224232
- name: Display release information
233+
env:
234+
VERSION: ${{ inputs.version }}
225235
run: |
226-
echo "Release Information for ${{ inputs.version }}"
236+
echo "Release Information for $VERSION"
227237
echo "----------------------------------------"
228238
cat technical-review-report.md
229239
@@ -236,8 +246,9 @@ jobs:
236246
- name: Record approval
237247
env:
238248
APPROVER: ${{ github.actor }}
249+
VERSION: ${{ inputs.version }}
239250
run: |
240251
echo "RC Approval Record:"
241-
echo "- Version: ${{ inputs.version }}"
252+
echo "- Version: $VERSION"
242253
echo "- Timestamp: $(date -u +"%Y-%m-%dT%H:%M:%SZ")"
243254
echo "- Approver: $APPROVER"

‎.github/workflows/_reusable-release-publisher.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,14 @@ on:
7474
required: false
7575
description: "Test PyPI token for pre-releases"
7676

77+
permissions: {} # default permissions only on workflow level
78+
7779
jobs:
7880
publish:
7981
runs-on: ubuntu-latest
8082
environment: ${{ inputs.is-prerelease && 'staging' || 'production' }}
83+
permissions:
84+
contents: write # is required by action-gh-release
8185
steps:
8286
- uses: actions/download-artifact@v4
8387
with:

0 commit comments

Comments
 (0)