From 678c8f34353679d9a07eb7d75624e07840f03e3a Mon Sep 17 00:00:00 2001 From: Scott Arciszewski <147527775+tob-scott-a@users.noreply.github.com> Date: Sun, 8 Mar 2026 20:18:04 +0800 Subject: [PATCH] ci: use zizmor to prevent supply chain attacks via GHA (#1518) --- .github/workflows/autocloser.yml | 6 +- .github/workflows/ci.yml | 53 ++++++++---- .github/workflows/cifuzz.yml | 9 ++- .github/workflows/codeql-analysis.yml | 10 ++- .github/workflows/dotnet-core.yml | 112 ++++++++++++++------------ .github/workflows/zizmor.yml | 30 +++++++ 6 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/autocloser.yml b/.github/workflows/autocloser.yml index 6fdb0300..e2dcd1f3 100644 --- a/.github/workflows/autocloser.yml +++ b/.github/workflows/autocloser.yml @@ -1,11 +1,15 @@ name: Autocloser on: [issues] + +permissions: + issues: write + jobs: autoclose: runs-on: ubuntu-latest steps: - name: Autoclose issues that did not follow issue template - uses: roots/issue-closer@v1.2 + uses: roots/issue-closer@fec85f2a845cd6cf33eda6e6a4c93026e71f86d1 # v1.2 with: repo-token: ${{ secrets.GITHUB_TOKEN }} issue-close-message: "This issue was automatically closed because it did not follow the issue template. We use the issue tracker exclusively for bug reports and feature additions that have been previously discussed. However, this issue appears to be a support request. Please use the discussion forums for support requests." diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0da24fe8..e3f81eb6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,11 +8,16 @@ on: workflow_dispatch: +permissions: + contents: read + jobs: tcc: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update @@ -35,13 +40,15 @@ jobs: zig: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update - name: Install Zig - uses: mlugg/setup-zig@v2 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 with: version: master @@ -67,7 +74,9 @@ jobs: regular: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update @@ -96,7 +105,9 @@ jobs: check-globals: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update @@ -114,7 +125,9 @@ jobs: other-comp: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update @@ -140,7 +153,9 @@ jobs: other-arch: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update @@ -160,15 +175,17 @@ jobs: wasi: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Install Zig - uses: mlugg/setup-zig@v2 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 with: version: master - name: Install Wasmer - uses: wasmerio/setup-wasmer@v3.1 + uses: wasmerio/setup-wasmer@24b15c95293d23f89c68bd40dac76338f773e924 # v3.1 - name: Build for wasi-core run: zig build -Dtarget=wasm32-wasi -Doptimize=ReleaseSafe @@ -190,7 +207,9 @@ jobs: aarch64-gcc: runs-on: ubuntu-24.04-arm steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update @@ -211,7 +230,9 @@ jobs: aarch64-gcc-crypto: runs-on: ubuntu-24.04-arm steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update @@ -232,7 +253,9 @@ jobs: aarch64-gcc-sha3: runs-on: ubuntu-24.04-arm steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update @@ -253,7 +276,9 @@ jobs: android: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Update packages list run: sudo apt-get update diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index b2911dd7..4a9eea64 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -6,26 +6,29 @@ on: pull_request: branches: [stable, next] +permissions: + contents: read + jobs: Fuzzing: runs-on: ubuntu-latest steps: - name: Build Fuzzers id: build - uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@2dc71767a7483e3035f57c9fc3a0f21ad3b28599 # master 2026-03-06 with: oss-fuzz-project-name: "libsodium" dry-run: false language: c++ - name: Run Fuzzers - uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@2dc71767a7483e3035f57c9fc3a0f21ad3b28599 # master 2026-03-06 with: oss-fuzz-project-name: "libsodium" fuzz-seconds: 300 dry-run: false language: c++ - name: Upload Crash - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 if: failure() && steps.build.outcome == 'success' with: name: artifacts diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 0046e135..b765152c 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -9,6 +9,9 @@ on: schedule: - cron: '0 17 * * 2' +permissions: + contents: read + jobs: analyze: name: Analyze @@ -26,13 +29,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: fetch-depth: 2 + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4 with: languages: ${{ matrix.language }} @@ -43,6 +47,6 @@ jobs: make -j $(nproc) check - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dotnet-core.yml b/.github/workflows/dotnet-core.yml index 24a012c2..7186151d 100644 --- a/.github/workflows/dotnet-core.yml +++ b/.github/workflows/dotnet-core.yml @@ -7,28 +7,28 @@ on: - next permissions: - id-token: write - attestations: write contents: read jobs: build-windows-msvc: runs-on: windows-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: buildbase.bat run: buildbase.bat ..\vs2022\libsodium.sln 17 working-directory: builds/msvc/build/ shell: cmd - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-win-x64 path: bin/x64/Release/v143/dynamic/libsodium.dll - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-win-x86 path: bin/Win32/Release/v143/dynamic/libsodium.dll - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-win-arm64 path: bin/ARM64/Release/v143/dynamic/libsodium.dll @@ -37,10 +37,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Install Zig - uses: mlugg/setup-zig@v2 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 with: version: master - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Build Android AAR run: sh ./dist-build/android-aar.sh @@ -51,25 +53,25 @@ jobs: unzip libsodium-*.aar -d extracted-aar - name: Upload Android arm64 - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-android-arm64 path: extracted-aar/prefab/modules/sodium/libs/android.arm64-v8a/libsodium.so - name: Upload Android arm - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-android-arm path: extracted-aar/prefab/modules/sodium/libs/android.armeabi-v7a/libsodium.so - name: Upload Android x64 - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-android-x64 path: extracted-aar/prefab/modules/sodium/libs/android.x86_64/libsodium.so - name: Upload Android x86 - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-android-x86 path: extracted-aar/prefab/modules/sodium/libs/android.x86/libsodium.so @@ -79,7 +81,7 @@ jobs: rm -fr zig-out .zig-cache; zig build -Doptimize=ReleaseFast -Dtarget=x86_64-linux-gnu.2.17 - name: tests run: cd zig-out/bin && ./run.sh - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-linux-x64 path: zig-out/lib/libsodium.so @@ -104,7 +106,7 @@ jobs: - name: tests run: | cd zig-out/bin && env LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib ./run.sh - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-linux-arm path: zig-out/lib/libsodium.so @@ -115,7 +117,7 @@ jobs: - name: tests run: | cd zig-out/bin && env LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib ./run.sh - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-linux-arm64 path: zig-out/lib/libsodium.so @@ -123,7 +125,7 @@ jobs: - name: build-linux-musl-x64 run: | rm -fr zig-out .zig-cache; zig build -Doptimize=ReleaseFast -Dtarget=x86_64-linux-musl - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-linux-musl-x64 path: zig-out/lib/libsodium.so @@ -131,7 +133,7 @@ jobs: - name: build-linux-musl-arm run: | rm -fr zig-out .zig-cache; zig build -Doptimize=ReleaseFast -Dtarget=arm-linux-musleabihf - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-linux-musl-arm path: zig-out/lib/libsodium.so @@ -139,7 +141,7 @@ jobs: - name: build-linux-musl-arm64 run: | rm -fr zig-out .zig-cache; zig build -Doptimize=ReleaseFast -Dtarget=aarch64-linux-musl - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-linux-musl-arm64 path: zig-out/lib/libsodium.so @@ -147,29 +149,35 @@ jobs: build-apple: runs-on: macos-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: configure run: ./configure - name: build-xcframework run: env LIBSODIUM_FULL_BUILD=1 LIBSODIUM_SKIP_SIMULATORS=1 dist-build/apple-xcframework.sh - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-macos path: libsodium-apple/macos/lib/libsodium.dylib - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-ios path: libsodium-apple/ios/lib/libsodium.a - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-tvos path: libsodium-apple/tvos/lib/libsodium.a - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-maccatalyst path: libsodium-apple/catalyst/lib/libsodium.a pack: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + attestations: write needs: - build-windows-msvc - build-apple @@ -181,82 +189,84 @@ jobs: DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1 DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1 steps: - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-win-x64 path: .libsodium-pack/runtimes/win-x64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-win-x86 path: .libsodium-pack/runtimes/win-x86/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-win-arm64 path: .libsodium-pack/runtimes/win-arm64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-linux-x64 path: .libsodium-pack/runtimes/linux-x64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-linux-arm64 path: .libsodium-pack/runtimes/linux-arm64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-linux-arm path: .libsodium-pack/runtimes/linux-arm/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-linux-musl-x64 path: .libsodium-pack/runtimes/linux-musl-x64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-linux-musl-arm path: .libsodium-pack/runtimes/linux-musl-arm/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-linux-musl-arm64 path: .libsodium-pack/runtimes/linux-musl-arm64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-macos path: .libsodium-pack/runtimes/osx-x64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-macos path: .libsodium-pack/runtimes/osx-arm64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-ios path: .libsodium-pack/runtimes/ios-arm64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-tvos path: .libsodium-pack/runtimes/tvos-arm64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-maccatalyst path: .libsodium-pack/runtimes/maccatalyst-x64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-maccatalyst path: .libsodium-pack/runtimes/maccatalyst-arm64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-android-arm64 path: .libsodium-pack/runtimes/android-arm64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-android-arm path: .libsodium-pack/runtimes/android-arm/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-android-x64 path: .libsodium-pack/runtimes/android-x64/native/ - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-android-x86 path: .libsodium-pack/runtimes/android-x86/native/ @@ -266,13 +276,13 @@ jobs: - name: Create NuGet package run: dotnet pack -c Release .libsodium-pack/libsodium.pkgproj - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: nuget-package path: .libsodium-pack/bin/Release/*.nupkg - name: Attest Build Provenance - uses: actions/attest-build-provenance@v3 + uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 # v3 with: subject-path: .libsodium-pack/bin/Release/*.nupkg @@ -287,8 +297,10 @@ jobs: DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1 DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1 steps: - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: nuget-package path: .libsodium-pack/ @@ -314,7 +326,7 @@ jobs: mv .libsodium-test/bin/Release/net8.0/linux-arm/publish .libsodium-builds/linux-arm mv .libsodium-test/bin/Release/net8.0/linux-arm64/publish .libsodium-builds/linux-arm64 mv .libsodium-test/bin/Release/net8.0/linux-x64/publish .libsodium-builds/linux-x64 - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: test-builds path: .libsodium-builds/* @@ -332,7 +344,7 @@ jobs: env: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1 steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: test-builds path: .libsodium-builds/ @@ -377,7 +389,7 @@ jobs: sudo ln -s /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.* /lib sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.* /lib - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: test-builds path: .libsodium-builds/ diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..9df384d7 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,30 @@ +name: Zizmor + +on: + push: + branches: [master, stable, next] + paths: + - '.github/workflows/**' + pull_request: + branches: [master, stable, next] + paths: + - '.github/workflows/**' + + workflow_dispatch: + +permissions: + contents: read + +jobs: + zizmor: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + + - name: Install zizmor + run: pipx install zizmor + + - name: Run zizmor + run: zizmor --min-severity medium .github/workflows/