From 803266d2f2ef3336ba09c5e81eac7d7a62ece540 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Mon, 27 Jul 2026 18:55:55 -0700 Subject: [PATCH] [github-actions] resolve zizmor security findings across workflows (#13438) This commit resolves Zizmor static analysis security findings across all workflow files in `.github/workflows/` to ensure the Zizmor action scanning check passes cleanly without warnings or errors. Specifically, this commit addresses the following rules: - artipacked: Set `persist-credentials: false` on `actions/checkout` steps across 15 workflow files where credentials are not required after checkout, preventing potential credential exposure in logs and build artifacts. - unpinned-uses: Pinned third-party GitHub actions in `fuzz.yml` and `nexus.yml` (`cifuzz`, `free-disk-space`, and `setup-emsdk`) from mutable branch or tag references to immutable commit SHAs. - template-injection: Extracted inline expression interpolations from `run:` script blocks into intermediate `env:` variables in `monthly-release.yml` and `docker.yml`, eliminating script injection risks. - dangerous-triggers: Added an inline suppression comment and justification for the `workflow_run` trigger in `size-report.yml`, which only downloads artifact reports to comment on pull requests from forks without checking out or executing untrusted code. --- .github/workflows/build.yml | 14 ++++++++++++++ .github/workflows/codeql.yml | 1 + .github/workflows/docker.yml | 9 +++++++-- .github/workflows/fuzz.yml | 4 ++-- .github/workflows/makefile-check.yml | 3 +++ .github/workflows/monthly-release.yml | 2 +- .github/workflows/nexus.yml | 17 +++++++++++------ .github/workflows/otbr-posix-dind.yml | 1 + .github/workflows/otbr.yml | 2 ++ .github/workflows/otci.yml | 1 + .github/workflows/otns.yml | 4 ++++ .github/workflows/posix.yml | 6 ++++++ .github/workflows/simulation.yml | 5 +++++ .github/workflows/size-check.yml | 2 ++ .github/workflows/size-report.yml | 1 + .github/workflows/toranj.yml | 5 +++++ .github/workflows/unit.yml | 3 +++ .github/workflows/version.yml | 1 + 18 files changed, 70 insertions(+), 11 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f45313856..9144ac24c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -56,6 +56,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get update @@ -78,6 +79,8 @@ jobs: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false - name: Run linkspector uses: umbrelladocs/action-linkspector@6c637d70424624231467a4ca918be54fa3b792d0 # v1.5.4 @@ -98,6 +101,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y build-essential ninja-build libreadline-dev libncurses-dev @@ -117,6 +121,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y build-essential ninja-build libreadline-dev libncurses-dev @@ -137,6 +142,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y build-essential ninja-build libreadline-dev libncurses-dev @@ -177,6 +183,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get update @@ -196,6 +203,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get update @@ -215,6 +223,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev @@ -272,6 +281,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | cd /tmp @@ -305,6 +315,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get update @@ -338,6 +349,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | wget https://apt.llvm.org/llvm.sh @@ -361,6 +373,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get update @@ -392,6 +405,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | brew update diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 43934cb09..ffbadafb5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -62,6 +62,7 @@ jobs: uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 6081fb021..0fb54c073 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -68,6 +68,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Prepare run: | @@ -104,9 +105,11 @@ jobs: - name: Export digest if: success() && github.repository == 'openthread/openthread' && github.event_name != 'pull_request' + env: + DIGEST: ${{ steps.build.outputs.digest }} run: | mkdir -p ${{ runner.temp }}/digests - digest="${{ steps.build.outputs.digest }}" + digest="${DIGEST}" touch "${{ runner.temp }}/digests/${digest#sha256:}" - name: Upload digest @@ -163,4 +166,6 @@ jobs: - name: Inspect image run: | - docker buildx imagetools inspect ${{ env.DOCKERHUB_REPO }}:${{ steps.meta.outputs.version }} + docker buildx imagetools inspect ${{ env.DOCKERHUB_REPO }}:${STEPS_META_OUTPUTS_VERSION} + env: + STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }} diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 0cb35e703..cf8c044d4 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -59,14 +59,14 @@ jobs: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@200c1902b1a3ce0d461b79aebd7b0d4c5b860601 # master with: oss-fuzz-project-name: 'openthread' language: 'c++' sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) - uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@200c1902b1a3ce0d461b79aebd7b0d4c5b860601 # master with: oss-fuzz-project-name: 'openthread' language: 'c++' diff --git a/.github/workflows/makefile-check.yml b/.github/workflows/makefile-check.yml index fc7539f1b..180e36825 100644 --- a/.github/workflows/makefile-check.yml +++ b/.github/workflows/makefile-check.yml @@ -55,6 +55,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Check run: | script/check-core-makefiles @@ -68,6 +69,8 @@ jobs: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false - name: Check run: | script/check-header-guards diff --git a/.github/workflows/monthly-release.yml b/.github/workflows/monthly-release.yml index faf402fa0..315f01846 100644 --- a/.github/workflows/monthly-release.yml +++ b/.github/workflows/monthly-release.yml @@ -84,6 +84,6 @@ jobs: # Uses the built-in GitHub CLI to create the tag and release simultaneously run: | gh release create "$TAG_NAME" \ - --target "${{ github.ref_name }}" \ + --target "${GITHUB_REF_NAME}" \ --title "OpenThread $TAG_NAME" \ --generate-notes diff --git a/.github/workflows/nexus.yml b/.github/workflows/nexus.yml index ffbe95319..0afb8e1d1 100644 --- a/.github/workflows/nexus.yml +++ b/.github/workflows/nexus.yml @@ -55,11 +55,12 @@ jobs: egress-policy: audit - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@main + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | @@ -87,11 +88,12 @@ jobs: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@main + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap env: @@ -123,11 +125,12 @@ jobs: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@main + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap env: @@ -155,11 +158,12 @@ jobs: egress-policy: audit - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@main + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | @@ -185,11 +189,12 @@ jobs: egress-policy: audit - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@main + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | @@ -197,7 +202,7 @@ jobs: sudo apt-get --no-install-recommends install -y ninja-build - name: Set up Emscripten - uses: mymindstorm/setup-emsdk@v14 + uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14 - name: Build Nexus WASM run: | diff --git a/.github/workflows/otbr-posix-dind.yml b/.github/workflows/otbr-posix-dind.yml index e464f8d5e..2c45618df 100644 --- a/.github/workflows/otbr-posix-dind.yml +++ b/.github/workflows/otbr-posix-dind.yml @@ -62,6 +62,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Clone ot-br-posix and replace openthread submodule run: | diff --git a/.github/workflows/otbr.yml b/.github/workflows/otbr.yml index a397dd0b7..d852933a5 100644 --- a/.github/workflows/otbr.yml +++ b/.github/workflows/otbr.yml @@ -89,6 +89,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Set firewall environment variables if: ${{ matrix.use_core_firewall }} run: | @@ -148,6 +149,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov diff --git a/.github/workflows/otci.yml b/.github/workflows/otci.yml index f16dcc652..6fa85e863 100644 --- a/.github/workflows/otci.yml +++ b/.github/workflows/otci.yml @@ -65,6 +65,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' diff --git a/.github/workflows/otns.yml b/.github/workflows/otns.yml index bb3aac231..1f32a341f 100644 --- a/.github/workflows/otns.yml +++ b/.github/workflows/otns.yml @@ -65,6 +65,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "1.23" @@ -107,6 +108,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "1.23" @@ -171,6 +173,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "1.23" @@ -221,6 +224,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov diff --git a/.github/workflows/posix.yml b/.github/workflows/posix.yml index b9feb92d2..b7cb44006 100644 --- a/.github/workflows/posix.yml +++ b/.github/workflows/posix.yml @@ -59,6 +59,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -157,6 +158,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get update @@ -204,6 +206,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get update @@ -235,6 +238,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | rm -f /usr/local/bin/2to3 @@ -268,6 +272,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap env: PR_BODY: "${{ github.event.pull_request.body }}" @@ -304,6 +309,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov diff --git a/.github/workflows/simulation.yml b/.github/workflows/simulation.yml index 47d4e584e..0e869313f 100644 --- a/.github/workflows/simulation.yml +++ b/.github/workflows/simulation.yml @@ -56,6 +56,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -110,6 +111,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y expect ninja-build lcov @@ -143,6 +145,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -187,6 +190,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -238,6 +242,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov diff --git a/.github/workflows/size-check.yml b/.github/workflows/size-check.yml index a3127700d..a4443efd7 100644 --- a/.github/workflows/size-check.yml +++ b/.github/workflows/size-check.yml @@ -54,6 +54,8 @@ jobs: egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false - name: Run env: PR_BODY: "${{ github.event.pull_request.body }}" diff --git a/.github/workflows/size-report.yml b/.github/workflows/size-report.yml index 7e625c85a..7f40ec872 100644 --- a/.github/workflows/size-report.yml +++ b/.github/workflows/size-report.yml @@ -29,6 +29,7 @@ name: Size Report on: + # zizmor: ignore[dangerous-triggers] - {workflow_run is required to comment on PRs from forks and does not execute untrusted code} workflow_run: workflows: ["Size Check"] types: diff --git a/.github/workflows/toranj.yml b/.github/workflows/toranj.yml index 0899635c2..da7187113 100644 --- a/.github/workflows/toranj.yml +++ b/.github/workflows/toranj.yml @@ -66,6 +66,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -101,6 +102,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -138,6 +140,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' @@ -196,6 +199,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap env: PR_BODY: "${{ github.event.pull_request.body }}" @@ -219,6 +223,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml index f8b88b2db..ddbd3ef30 100644 --- a/.github/workflows/unit.yml +++ b/.github/workflows/unit.yml @@ -56,6 +56,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Build run: make -C third_party/tcplp/lib/test/ - name: Run @@ -74,6 +75,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get update @@ -116,6 +118,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Bootstrap run: | sudo apt-get --no-install-recommends install -y lcov diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml index 1c58f6ff0..9578b6017 100644 --- a/.github/workflows/version.yml +++ b/.github/workflows/version.yml @@ -52,6 +52,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: submodules: recursive + persist-credentials: false - name: Check run: | script/check-api-version