From 420582efa17ab6092e304c0c0c4922c996e43ced Mon Sep 17 00:00:00 2001 From: Sanskar Singh Date: Thu, 6 Aug 2026 16:36:18 +0530 Subject: [PATCH] ci: pin govulncheck action and fix template injection #657 already pinned the actions in pr-workflow.yaml and scoped the token to contents: read, so this trims to just the zizmor findings that landing did not cover. - govulncheck.yaml: pin golang/govulncheck-action@v1 to 032d45514ae346b1db93c04b0c90b841c370344f (v1.1.0), the only remaining unpinned-uses finding. - pr-workflow.yaml: fix template-injection. Move ${{ matrix.ateapi-client-auth }} (Install / Deploy micro-VM steps) and ${{ needs.e2e-test-matrix.result }} (Check E2E matrix step) into env: vars and reference them as quoted shell variables so the expansion cannot inject code. Verified with zizmor v1.29.0: zero unpinned-uses and zero template-injection findings on both workflows. No functional change. --- .github/workflows/govulncheck.yaml | 2 +- .github/workflows/pr-workflow.yaml | 14 ++++++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml index 6422d54dc..5007caaf0 100644 --- a/.github/workflows/govulncheck.yaml +++ b/.github/workflows/govulncheck.yaml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest steps: - id: govulncheck - uses: golang/govulncheck-action@v1 + uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0 with: go-version-file: go.mod go-package: ./... diff --git a/.github/workflows/pr-workflow.yaml b/.github/workflows/pr-workflow.yaml index 14d0c1681..1d64ba75c 100644 --- a/.github/workflows/pr-workflow.yaml +++ b/.github/workflows/pr-workflow.yaml @@ -89,11 +89,15 @@ jobs: - name: Create cluster run: hack/create-kind-cluster.sh - name: Install Agent Substrate - run: hack/install-ate-kind.sh --deploy-ate-system --ateapi-client-auth=${{ matrix.ateapi-client-auth }} + env: + CLIENT_AUTH: ${{ matrix.ateapi-client-auth }} + run: hack/install-ate-kind.sh --deploy-ate-system --ateapi-client-auth="$CLIENT_AUTH" - name: Deploy micro-VM counter demo # Stages the (cached) assets into the cluster's rustfs and applies the # counter-microvm demo onto the control plane installed above. - run: hack/run-microvm-demo-kind.sh --ateapi-client-auth=${{ matrix.ateapi-client-auth }} + env: + CLIENT_AUTH: ${{ matrix.ateapi-client-auth }} + run: hack/run-microvm-demo-kind.sh --ateapi-client-auth="$CLIENT_AUTH" - name: Deploy gVisor counter demo run: hack/install-ate-kind.sh --deploy-demo-counter - name: Wait for micro-VM golden snapshot @@ -134,8 +138,10 @@ jobs: if: always() steps: - name: Check E2E matrix + env: + MATRIX_RESULT: ${{ needs.e2e-test-matrix.result }} run: | - if [ "${{ needs.e2e-test-matrix.result }}" != "success" ]; then - echo "e2e-test-matrix result: ${{ needs.e2e-test-matrix.result }}" + if [ "$MATRIX_RESULT" != "success" ]; then + echo "e2e-test-matrix result: $MATRIX_RESULT" exit 1 fi