espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-01 08:37:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[github-actions] resolve zizmor security findings across workflows (#13438)

Browse Source 
This commit resolves Zizmor static analysis security findings across
all workflow files in `.github/workflows/` to ensure the Zizmor
action scanning check passes cleanly without warnings or errors.

Specifically, this commit addresses the following rules:

- artipacked: Set `persist-credentials: false` on `actions/checkout`
  steps across 15 workflow files where credentials are not required
  after checkout, preventing potential credential exposure in logs
  and build artifacts.
- unpinned-uses: Pinned third-party GitHub actions in `fuzz.yml` and
  `nexus.yml` (`cifuzz`, `free-disk-space`, and `setup-emsdk`) from
  mutable branch or tag references to immutable commit SHAs.
- template-injection: Extracted inline expression interpolations from
  `run:` script blocks into intermediate `env:` variables in
  `monthly-release.yml` and `docker.yml`, eliminating script injection
  risks.
- dangerous-triggers: Added an inline suppression comment and
  justification for the `workflow_run` trigger in `size-report.yml`,
  which only downloads artifact reports to comment on pull requests
  from forks without checking out or executing untrusted code.
This commit is contained in:
Jonathan Hui
2026-07-27 18:55:55 -07:00
committed by GitHub
parent 553ba0763d
commit 803266d2f2
18 changed files with 70 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+14
View File
@@ -56,6 +56,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get update
@@ -78,6 +79,8 @@ jobs:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- name: Run linkspector
uses: umbrelladocs/action-linkspector@6c637d70424624231467a4ca918be54fa3b792d0 # v1.5.4
@@ -98,6 +101,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y build-essential ninja-build libreadline-dev libncurses-dev
@@ -117,6 +121,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y build-essential ninja-build libreadline-dev libncurses-dev
@@ -137,6 +142,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y build-essential ninja-build libreadline-dev libncurses-dev
@@ -177,6 +183,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get update
@@ -196,6 +203,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get update
@@ -215,6 +223,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev
@@ -272,6 +281,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
cd /tmp
@@ -305,6 +315,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get update
@@ -338,6 +349,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
wget https://apt.llvm.org/llvm.sh
@@ -361,6 +373,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get update
@@ -392,6 +405,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
brew update
.github/workflows/codeql.yml
+1
View File
@@ -62,6 +62,7 @@ jobs:
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev
.github/workflows/docker.yml
+7 -2
View File
@@ -68,6 +68,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Prepare
run: |
@@ -104,9 +105,11 @@ jobs:
- name: Export digest
if: success() && github.repository == 'openthread/openthread' && github.event_name != 'pull_request'
env:
DIGEST: ${{ steps.build.outputs.digest }}
run: |
mkdir -p ${{ runner.temp }}/digests
digest="${{ steps.build.outputs.digest }}"
digest="${DIGEST}"
touch "${{ runner.temp }}/digests/${digest#sha256:}"
- name: Upload digest
@@ -163,4 +166,6 @@ jobs:
- name: Inspect image
run: |
docker buildx imagetools inspect ${{ env.DOCKERHUB_REPO }}:${{ steps.meta.outputs.version }}
docker buildx imagetools inspect ${{ env.DOCKERHUB_REPO }}:${STEPS_META_OUTPUTS_VERSION}
env:
STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }}
.github/workflows/fuzz.yml
+2 -2
View File
@@ -59,14 +59,14 @@ jobs:
- name: Build Fuzzers (${{ matrix.sanitizer }})
id: build
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@200c1902b1a3ce0d461b79aebd7b0d4c5b860601 # master
with:
oss-fuzz-project-name: 'openthread'
language: 'c++'
sanitizer: ${{ matrix.sanitizer }}
- name: Run Fuzzers (${{ matrix.sanitizer }})
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@200c1902b1a3ce0d461b79aebd7b0d4c5b860601 # master
with:
oss-fuzz-project-name: 'openthread'
language: 'c++'
.github/workflows/makefile-check.yml
+3
View File
@@ -55,6 +55,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Check
run: |
script/check-core-makefiles
@@ -68,6 +69,8 @@ jobs:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- name: Check
run: |
script/check-header-guards
.github/workflows/monthly-release.yml
+1 -1
View File
@@ -84,6 +84,6 @@ jobs:
# Uses the built-in GitHub CLI to create the tag and release simultaneously
run: |
gh release create "$TAG_NAME" \
--target "${{ github.ref_name }}" \
--target "${GITHUB_REF_NAME}" \
--title "OpenThread $TAG_NAME" \
--generate-notes
.github/workflows/nexus.yml
+11 -6
View File
@@ -55,11 +55,12 @@ jobs:
egress-policy: audit
- name: Free Disk Space (Ubuntu)
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
@@ -87,11 +88,12 @@ jobs:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- name: Free Disk Space (Ubuntu)
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
env:
@@ -123,11 +125,12 @@ jobs:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- name: Free Disk Space (Ubuntu)
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
env:
@@ -155,11 +158,12 @@ jobs:
egress-policy: audit
- name: Free Disk Space (Ubuntu)
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
@@ -185,11 +189,12 @@ jobs:
egress-policy: audit
- name: Free Disk Space (Ubuntu)
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
@@ -197,7 +202,7 @@ jobs:
sudo apt-get --no-install-recommends install -y ninja-build
- name: Set up Emscripten
uses: mymindstorm/setup-emsdk@v14
uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
- name: Build Nexus WASM
run: |
.github/workflows/otbr-posix-dind.yml
+1
View File
@@ -62,6 +62,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Clone ot-br-posix and replace openthread submodule
run: |
.github/workflows/otbr.yml
+2
View File
@@ -89,6 +89,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Set firewall environment variables
if: ${{ matrix.use_core_firewall }}
run: |
@@ -148,6 +149,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
.github/workflows/otci.yml
+1
View File
@@ -65,6 +65,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
.github/workflows/otns.yml
+4
View File
@@ -65,6 +65,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: "1.23"
@@ -107,6 +108,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: "1.23"
@@ -171,6 +173,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: "1.23"
@@ -221,6 +224,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
.github/workflows/posix.yml
+6
View File
@@ -59,6 +59,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
@@ -157,6 +158,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get update
@@ -204,6 +206,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get update
@@ -235,6 +238,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
rm -f /usr/local/bin/2to3
@@ -268,6 +272,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
env:
PR_BODY: "${{ github.event.pull_request.body }}"
@@ -304,6 +309,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
.github/workflows/simulation.yml
+5
View File
@@ -56,6 +56,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
@@ -110,6 +111,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y expect ninja-build lcov
@@ -143,6 +145,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
@@ -187,6 +190,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
@@ -238,6 +242,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
.github/workflows/size-check.yml
+2
View File
@@ -54,6 +54,8 @@ jobs:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- name: Run
env:
PR_BODY: "${{ github.event.pull_request.body }}"
.github/workflows/size-report.yml
+1
View File
@@ -29,6 +29,7 @@
name: Size Report
on:
# zizmor: ignore[dangerous-triggers] - {workflow_run is required to comment on PRs from forks and does not execute untrusted code}
workflow_run:
workflows: ["Size Check"]
types:
.github/workflows/toranj.yml
+5
View File
@@ -66,6 +66,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
@@ -101,6 +102,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
@@ -138,6 +140,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.12'
@@ -196,6 +199,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
env:
PR_BODY: "${{ github.event.pull_request.body }}"
@@ -219,6 +223,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
.github/workflows/unit.yml
+3
View File
@@ -56,6 +56,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Build
run: make -C third_party/tcplp/lib/test/
- name: Run
@@ -74,6 +75,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get update
@@ -116,6 +118,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y lcov
.github/workflows/version.yml
+1
View File
@@ -52,6 +52,7 @@ jobs:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
submodules: recursive
persist-credentials: false
- name: Check
run: |
script/check-api-version