Skip to content

ci: Resolve most zizmor findings as of zizmor@1.31.1 #7212

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ytmimi merged 17 commits into from
Oct 30, 2026
Merged

ci: Resolve most zizmor findings as of zizmor@1.31.1 #7212

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
71e643a
ci: Disable credential persistence
hashcatHitman Oct 23, 2026
e1ab351
ci: Expand `github.event.inputs.commit_hash` in `env`
hashcatHitman Oct 23, 2026
eed5eec
ci: Expand `github.event.inputs.rustfmt_configs` in `env`
hashcatHitman Oct 23, 2026
a149e10
ci: Expand `github.event.inputs.clone_url` in `env`
hashcatHitman Oct 23, 2026
66bf953
ci: Expand `github.event.inputs.branch_name` in `env`
hashcatHitman Oct 23, 2026
6251ca8
ci: Expand `github.event.inputs.language_edition` in `env`
hashcatHitman Oct 23, 2026
f6fc894
ci: Expand `github.event.inputs.style_edition` in `env`
hashcatHitman Oct 23, 2026
a2d4800
ci: Expand `github.event.release.tag_name` in `env`
hashcatHitman Oct 23, 2026
ef138d3
ci: Prefer shell expansion over template expansion
hashcatHitman Oct 23, 2026
bce8aa0
ci: Expand `matrix.target` in `env`
hashcatHitman Oct 23, 2026
add9f81
ci: Expand `matrix.os` in `env`
hashcatHitman Oct 23, 2026
0f85075
ci: Expand `matrix.build` in `env`
hashcatHitman Oct 23, 2026
da2aab9
ci: Expand `matrix.integration` in `env`
hashcatHitman Oct 23, 2026
144bbf6
ci: Expand `matrix.package` in `env`
hashcatHitman Oct 23, 2026
43dc4a9
ci: Expand `toJson(needs)` in `env`
hashcatHitman Oct 23, 2026
7d06a5c
ci: Disable all permissions by default
hashcatHitman Oct 24, 2026
f87c96e
ci: Grant minimum required permissions
hashcatHitman Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 15 additions & 7 deletions .github/workflows/check_diff.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,8 @@ jobs:
steps:
- name: checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Build check_diff binary
working-directory: ./check_diff
Expand All @@ -60,19 +62,25 @@ jobs:
working-directory: ./check_diff
env:
CHECK_DIFF_LOG: info
GITHUB_EVENT_INPUTS_COMMIT_HASH: ${{ github.event.inputs.commit_hash }}
GITHUB_EVENT_INPUTS_RUSTFMT_CONFIGS: ${{ github.event.inputs.rustfmt_configs }}
GITHUB_EVENT_INPUTS_CLONE_URL: ${{ github.event.inputs.clone_url }}
GITHUB_EVENT_INPUTS_BRANCH_NAME: ${{ github.event.inputs.branch_name }}
GITHUB_EVENT_INPUTS_LANGUAGE_EDITION: ${{ github.event.inputs.language_edition }}
GITHUB_EVENT_INPUTS_STYLE_EDITION: ${{ github.event.inputs.style_edition }}
shell: bash
run: |
OPTIONS=""
if [[ -n "${{ github.event.inputs.commit_hash }}" ]]; then
OPTIONS+="--commit-hash ${{ github.event.inputs.commit_hash }} "
if [[ -n "${GITHUB_EVENT_INPUTS_COMMIT_HASH}" ]]; then
OPTIONS+="--commit-hash ${GITHUB_EVENT_INPUTS_COMMIT_HASH} "
fi
if [[ -n "${{ github.event.inputs.rustfmt_configs }}" ]]; then
OPTIONS+="--rustfmt-config ${{ github.event.inputs.rustfmt_configs }} "
if [[ -n "${GITHUB_EVENT_INPUTS_RUSTFMT_CONFIGS}" ]]; then
OPTIONS+="--rustfmt-config ${GITHUB_EVENT_INPUTS_RUSTFMT_CONFIGS} "
fi
target/release/check_diff ${{ github.event.inputs.clone_url }} ${{ github.event.inputs.branch_name }} \
--edition ${{ github.event.inputs.language_edition }} \
--style-edition ${{ github.event.inputs.style_edition }} \
target/release/check_diff ${GITHUB_EVENT_INPUTS_CLONE_URL} ${GITHUB_EVENT_INPUTS_BRANCH_NAME} \
--edition ${GITHUB_EVENT_INPUTS_LANGUAGE_EDITION} \
--style-edition ${GITHUB_EVENT_INPUTS_STYLE_EDITION} \
$OPTIONS
8 changes: 7 additions & 1 deletion .github/workflows/clippy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ jobs:
steps:
- name: checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: install rustup
run: |
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > rustup-init.sh
Expand All @@ -35,10 +37,14 @@ jobs:
steps:
- name: checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: install rustup
run: |
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > rustup-init.sh
sh rustup-init.sh -y --default-toolchain none
- name: clippy
run: cargo clippy --locked --manifest-path ${{ matrix.package }}/Cargo.toml
run: cargo clippy --locked --manifest-path "${MATRIX_PACKAGE}/Cargo.toml"
env:
MATRIX_PACKAGE: ${{ matrix.package }}

5 changes: 4 additions & 1 deletion .github/workflows/integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,8 @@ jobs:
steps:
- name: checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

# Run build
- name: install rustup
Expand All @@ -70,5 +72,6 @@ jobs:
- name: run integration tests
env:
TARGET: x86_64-unknown-linux-gnu
run: cargo run --locked --manifest-path ci/Cargo.toml integration ${{ matrix.integration }}
MATRIX_INTEGRATION: ${{ matrix.integration }}
run: cargo run --locked --manifest-path ci/Cargo.toml integration ${MATRIX_INTEGRATION}
continue-on-error: ${{ matrix.allow-failure == true }}
2 changes: 2 additions & 0 deletions .github/workflows/rustdoc_check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ jobs:
steps:
- name: checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: install rustup
run: |
Expand Down
16 changes: 12 additions & 4 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,8 @@ jobs:
run: git config --global core.autocrlf false
- name: checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Install Rustup using win.rustup.rs
if: ${{ matrix.os == 'windows-latest' }}
Expand All @@ -52,7 +54,9 @@ jobs:
Invoke-WebRequest https://win.rustup.rs/ -OutFile rustup-init.exe
.\rustup-init.exe -y --default-host=x86_64-pc-windows-msvc --default-toolchain=none
del rustup-init.exe
rustup target add ${{ matrix.target }}
rustup target add ${env:MATRIX_TARGET}
env:
MATRIX_TARGET: ${{ matrix.target }}
shell: powershell

- name: Add mingw32 to path for i686-gnu
Expand All @@ -71,7 +75,9 @@ jobs:
run: |
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > rustup-init.sh
sh rustup-init.sh -y --default-toolchain none
rustup target add ${{ matrix.target }}
rustup target add ${MATRIX_TARGET}
env:
MATRIX_TARGET: ${{ matrix.target }}

# Run build
- name: Build and Test
Expand All @@ -97,6 +103,8 @@ jobs:
- name: Conclusion
run: |
# Print the dependent jobs to see them in the CI log
jq -C <<< '${{ toJson(needs) }}'
jq -C <<< "${JSON_NEEDS}"
# Check if all jobs that we depend on (in the needs array) were successful (or have been skipped).
jq --exit-status 'all(.result == "success" or .result == "skipped")' <<< '${{ toJson(needs) }}'
jq --exit-status 'all(.result == "success" or .result == "skipped")' <<< "${JSON_NEEDS}"
env:
JSON_NEEDS: ${{ toJson(needs) }}
23 changes: 19 additions & 4 deletions .github/workflows/upload-assets.yml
View file
Open in desktop

@jieyouxu jieyouxu Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a way we can require zizmor checks to pass as opposed to monitor for now? I know we're still in the gradually-cover-all-the-repo phase.

(Or wait, is it just some rules are not enforced org-wide yet?)

@hashcatHitman hashcatHitman Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a way we can require zizmor checks to pass as opposed to monitor for now?

I'm not sure, I've never dealt with a workflow that mysteriously imposes itself from another repo like this before. If you have access to branch rulesets, my best guess would be to add a ruleset that requires status checks to pass, but I'm not sure if Crabwatch will actually show up in that list. (I don't have such access over surveys, which would have been my place to check, so I'm guessing you probably don't have such access?)

Alternatively, you could just re-run zizmor yourself in this repository and require it the same way you would any other workflow. It'd be a bit redundant, but it is an option.

I know we're still in the gradually-cover-all-the-repo phase.

This seems to imply that you think once we get out of that phase we're going to start requiring crabwatch to pass. While that was the original plan, I believe we've decided against doing that for the foreseeable future due to several lints being capable of failing due to factors outside of our control (originally, this referred to archived-uses, but I believe I made a more complete list in this issue: rust-lang/crabwatch#92). This change of plans was announced here: #t-infra/announcements > GitHub Actions linter @ 💬.

(Or wait, is it just some rules are not enforced org-wide yet?)

We maintain a policy here: https://github.com/rust-lang/crabwatch/blob/main/zizmor-policy.yml

Not all rules are enabled by default. We're enabling more rules over time, but before we do that, we have to fix them so that they pass. The policy allows defining overrides for individual repos, so the workflow looks like one of two things, generally:

  • A:
      1. Pick a lint that is not yet enabled
      1. Pick ${repo} from the repos that lint fires for
      1. Fix that lint in repository rust-lang/${repo}
      1. Enable that lint just for rust-lang/${repo}
      1. Repeat 2-4 until all repos have the lint solved
      1. Enable the lint by default and remove the overrides
  • B:
      1. Pick ${repo} from the repos that any lint fires for
      1. Fix as many of the lints in repository rust-lang/${repo} as possible
      1. Enable all of the lints that are fixed just for rust-lang/${repo}
      1. Repeat 1-3 until all repos have some large set of lints solved
      1. Enable all those lints by default and remove the overrides

I started by doing something like the first approach, where I'd specifically target ~3 lints at a time, but I've found it isn't much more work to just tackle almost all of them at once. Fewer PRs to bother each repository with, and saying "I'm here to fix all/almost all of the lints" makes it less surprising for me to enable lints that were already solved for a given repository.

I've been using the script found here: https://github.com/hashcatHitman/.zizmor_meta/blob/514f583f97e1fda98861582cfdd4bebfe7f639f8/zizmor_blast.bash

To do bulk scans which I manually cache to pick through later. I'm not sure if we actually use crabwatch on any repos that are archived, not public, or forks, but I've started by prioritizing the public, non-archived, non-forks. In general, the crabwatch custom property is what decides if we run crabwatch on a repo. You'd probably get more accurate results by running the actual crabwatch wrapper, but I'm stubborn and don't feel like downloading yq just for this, yet.

@jieyouxu jieyouxu Oct 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah okay, thanks for the context.

@jieyouxu jieyouxu Oct 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm yeah alright, I didn't consider the external factor possibility (i.e. an action can get archived and now if you hard-require zizmor nothing can be merged). That makes sense 👍

Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,13 @@ on:
types: [created]
workflow_dispatch:

permissions: {}

jobs:
build-release:
name: build-release
permissions:
contents: write # Required by `gh release upload`
strategy:
matrix:
build: [linux-x86_64, macos-x86_64, windows-x86_64-gnu, windows-x86_64-msvc]
Expand All @@ -32,13 +36,18 @@ jobs:
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

# Run build
- name: install rustup
shell: bash
run: |
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > rustup-init.sh
sh rustup-init.sh -y --default-toolchain none
rustup target add ${{ matrix.target }}
rustup target add ${MATRIX_TARGET}
env:
MATRIX_TARGET: ${{ matrix.target }}

- name: Add mingw64 to path for x86_64-gnu
run: echo "C:\msys64\mingw64\bin" >> $GITHUB_PATH
Expand All @@ -51,12 +60,12 @@ jobs:
- name: Build archive
shell: bash
run: |
staging="rustfmt_${{ matrix.build }}_${{ github.event.release.tag_name }}"
staging="rustfmt_${MATRIX_BUILD}_${GITHUB_EVENT_RELEASE_TAG_NAME}"
mkdir -p "$staging"
cp {README.md,Configurations.md,CHANGELOG.md,LICENSE-MIT,LICENSE-APACHE} "$staging/"
if [ "${{ matrix.os }}" = "windows-latest" ]; then
if [ "${MATRIX_OS}" = "windows-latest" ]; then
cp target/release/{rustfmt.exe,cargo-fmt.exe,rustfmt-format-diff.exe,git-rustfmt.exe} "$staging/"
7z a "$staging.zip" "$staging"
echo "ASSET=$staging.zip" >> $GITHUB_ENV
Expand All @@ -65,9 +74,15 @@ jobs:
tar czf "$staging.tar.gz" "$staging"
echo "ASSET=$staging.tar.gz" >> $GITHUB_ENV
fi
env:
MATRIX_OS: ${{ matrix.os }}
MATRIX_BUILD: ${{ matrix.build }}
GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}

- name: Upload Release Asset
shell: bash
if: github.event_name == 'release'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh release upload "${{ github.event.release.tag_name }}" "${{ env.ASSET }}"
GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
run: gh release upload "${GITHUB_EVENT_RELEASE_TAG_NAME}" "${ASSET}"
Comment thread
jieyouxu marked this conversation as resolved.
Resolved
Loading