Incorporate zizmor GitHub Actions security auditing (#69)

.github/workflows/ci.yml

@@ -6,11 +6,17 @@ on:
   pull_request:
     branches: [ main ]
 
+# Least privilege: CI only needs to read the repository.
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v5
       with:
         python-version: '3.12'
@@ -29,6 +35,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Install uv
       uses: astral-sh/setup-uv@v5
@@ -53,6 +61,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Install uv
       uses: astral-sh/setup-uv@v5
@@ -97,6 +107,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Install uv
       uses: astral-sh/setup-uv@v5
@@ -125,6 +137,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Install uv
       uses: astral-sh/setup-uv@v5
@@ -147,6 +161,8 @@ jobs:
     needs: [pre-commit, test-core]
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Install uv
       uses: astral-sh/setup-uv@v5

.github/workflows/monthly-release.yml

@@ -28,6 +28,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: true
 
       - name: Set up Git identity
         run: |
@@ -36,12 +37,15 @@ jobs:
 
       - name: Prepare version
         id: prep
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          INPUT_FORCE: ${{ inputs.force }}
         run: |
           args=()
-          if [ -n "${{ inputs.version }}" ]; then
-            args+=(--version "${{ inputs.version }}")
+          if [ -n "$INPUT_VERSION" ]; then
+            args+=(--version "$INPUT_VERSION")
           fi
-          if [ "${{ inputs.force }}" = "true" ]; then
+          if [ "$INPUT_FORCE" = "true" ]; then
             args+=(--force)
           fi
           python scripts/prepare_release.py "${args[@]}"
@@ -80,63 +84,73 @@ jobs:
 
       - name: Update conda recipe source hash
         if: steps.prep.outputs.release_needed == 'true'
+        env:
+          RELEASE_VERSION: ${{ steps.prep.outputs.version }}
         run: |
           python scripts/update_conda_recipe.py \
-            --version "${{ steps.prep.outputs.version }}" \
+            --version "$RELEASE_VERSION" \
             --sdist dist/uxarray_mcp-*.tar.gz
 
       - name: Commit version bump
         if: steps.prep.outputs.release_needed == 'true'
+        env:
+          RELEASE_VERSION: ${{ steps.prep.outputs.version }}
         run: |
           git add pyproject.toml src/uxarray_mcp/__init__.py conda/recipe/meta.yaml
           if git diff --cached --quiet; then
-            echo "Version files already match ${{ steps.prep.outputs.version }}; no release commit needed."
+            echo "Version files already match ${RELEASE_VERSION}; no release commit needed."
           else
-            git commit -m "Release ${{ steps.prep.outputs.version }}"
+            git commit -m "Release ${RELEASE_VERSION}"
           fi
 
       - name: Tag release
         if: steps.prep.outputs.release_needed == 'true'
+        env:
+          RELEASE_VERSION: ${{ steps.prep.outputs.version }}
+          RELEASE_TAG: ${{ steps.prep.outputs.tag }}
         run: |
-          git tag -a "${{ steps.prep.outputs.tag }}" -m "Release ${{ steps.prep.outputs.version }}"
+          git tag -a "$RELEASE_TAG" -m "Release ${RELEASE_VERSION}"
 
       - name: Push release commit and tag
         if: steps.prep.outputs.release_needed == 'true'
+        env:
+          RELEASE_TAG: ${{ steps.prep.outputs.tag }}
         run: |
           git push origin HEAD:main
-          git push origin "${{ steps.prep.outputs.tag }}"
+          git push origin "$RELEASE_TAG"
 
       - name: Create GitHub release
         if: steps.prep.outputs.release_needed == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_VERSION: ${{ steps.prep.outputs.version }}
+          RELEASE_TAG: ${{ steps.prep.outputs.tag }}
+          PREVIOUS_TAG: ${{ steps.prep.outputs.previous_tag }}
+          CHANGED_COMMITS: ${{ steps.prep.outputs.changed_commits }}
         run: |
-          cat > release-notes.md <<'EOF'
-          Automated release ${{ steps.prep.outputs.version }}.
-          EOF
-          if [ -n "${{ steps.prep.outputs.previous_tag }}" ]; then
-            cat >> release-notes.md <<'EOF'
-
-          Changes since ${{ steps.prep.outputs.previous_tag }}: ${{ steps.prep.outputs.changed_commits }} commit(s).
-          EOF
-          else
-            cat >> release-notes.md <<'EOF'
-
-          Initial release.
-          EOF
-          fi
-          gh release create "${{ steps.prep.outputs.tag }}" \
+          {
+            echo "Automated release ${RELEASE_VERSION}."
+            if [ -n "$PREVIOUS_TAG" ]; then
+              echo ""
+              echo "Changes since ${PREVIOUS_TAG}: ${CHANGED_COMMITS} commit(s)."
+            else
+              echo ""
+              echo "Initial release."
+            fi
+          } > release-notes.md
+          gh release create "$RELEASE_TAG" \
             --repo "$GITHUB_REPOSITORY" \
-            --title "${{ steps.prep.outputs.tag }}" \
+            --title "$RELEASE_TAG" \
             --notes-file release-notes.md \
             dist/*
 
       - name: Dispatch PyPI publish workflow
         if: steps.prep.outputs.release_needed == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.prep.outputs.tag }}
         run: |
           gh workflow run release.yml \
             --repo "$GITHUB_REPOSITORY" \
-            --ref "${{ steps.prep.outputs.tag }}" \
-            -f tag="${{ steps.prep.outputs.tag }}"
+            --ref "$RELEASE_TAG" \
+            -f tag="$RELEASE_TAG"

.github/workflows/release.yml

@@ -21,9 +21,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.tag || github.ref }}
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: false
 
       - name: Set up Python 3.12
         uses: actions/setup-python@v5
@@ -74,6 +77,8 @@ jobs:
     steps:
       - name: Install uv
         uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: false
 
       - name: Set up Python 3.12
         uses: actions/setup-python@v5
@@ -120,10 +125,14 @@ jobs:
       - name: Check out source repository
         if: env.CONDA_FEEDSTOCK_REPOSITORY != '' && env.CONDA_FEEDSTOCK_TOKEN != ''
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install uv
         if: env.CONDA_FEEDSTOCK_REPOSITORY != '' && env.CONDA_FEEDSTOCK_TOKEN != ''
         uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: false
 
       - name: Set up Python 3.12
         if: env.CONDA_FEEDSTOCK_REPOSITORY != '' && env.CONDA_FEEDSTOCK_TOKEN != ''
@@ -142,12 +151,16 @@ jobs:
           repository: ${{ env.CONDA_FEEDSTOCK_REPOSITORY }}
           token: ${{ env.CONDA_FEEDSTOCK_TOKEN }}
           path: feedstock
+          # Credentials are intentionally persisted: this job pushes a branch
+          # and opens a PR against the conda-forge feedstock.
+          persist-credentials: true
 
       - name: Update feedstock recipe
         if: env.CONDA_FEEDSTOCK_REPOSITORY != '' && env.CONDA_FEEDSTOCK_TOKEN != ''
+        env:
+          REF_NAME: ${{ inputs.tag || github.ref_name }}
         run: |
-          ref_name="${{ inputs.tag || github.ref_name }}"
-          version="${ref_name#v}"
+          version="${REF_NAME#v}"
           python scripts/update_conda_recipe.py \
             --recipe feedstock/recipe/meta.yaml \
             --version "$version" \
@@ -157,9 +170,9 @@ jobs:
         if: env.CONDA_FEEDSTOCK_REPOSITORY != '' && env.CONDA_FEEDSTOCK_TOKEN != ''
         env:
           GH_TOKEN: ${{ env.CONDA_FEEDSTOCK_TOKEN }}
+          REF_NAME: ${{ inputs.tag || github.ref_name }}
         run: |
-          ref_name="${{ inputs.tag || github.ref_name }}"
-          version="${ref_name#v}"
+          version="${REF_NAME#v}"
           cd feedstock
           branch="uxarray-mcp-${version}"
           git config user.name "Rajeev Jain"

.github/workflows/zizmor.yml

@@ -0,0 +1,34 @@
+name: zizmor GitHub Actions audit
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - ".github/workflows/**"
+      - ".github/zizmor.yml"
+  pull_request:
+    branches: [ main ]
+    paths:
+      - ".github/workflows/**"
+      - ".github/zizmor.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Audit workflows with zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: false
+
+      - name: Run zizmor
+        run: uvx zizmor .github/workflows/

.github/zizmor.yml

@@ -0,0 +1,14 @@
+# zizmor configuration — GitHub Actions security auditing.
+# https://docs.zizmor.sh/configuration/
+#
+# We fix the high-signal findings (excessive-permissions, artipacked,
+# template-injection, cache-poisoning) directly in the workflows. Pinning every
+# third-party action to a full commit SHA (`unpinned-uses`) is tracked as a
+# separate follow-up so this initial adoption stays focused and reviewable.
+rules:
+  unpinned-uses:
+    ignore:
+      - ci.yml
+      - monthly-release.yml
+      - release.yml
+      - zizmor.yml

.pre-commit-config.yaml

@@ -35,3 +35,9 @@ repos:
           - "types-PyYAML"
         # Only check source, not tests or docs
         files: ^src/
+
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.5.2
+    hooks:
+      - id: zizmor
+        name: audit GitHub Actions with zizmor