Skip to content

[CI] Add zizmor workflow #20437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Oct 28, 2025
Merged

[CI] Add zizmor workflow #20437

Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8f9f433
[CI] Add zizmor workflow
KornevNikita Oct 21, 2025
5025fd9
Merge remote-tracking branch 'origin/sycl' into zizmor
KornevNikita Oct 27, 2025
1847201
make list less strict
KornevNikita Oct 27, 2025
d2a38ba
upd paths
KornevNikita Oct 27, 2025
f9a437b
add a comment and upd paths
KornevNikita Oct 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .github/workflows/sycl-zizmor.yml
View file
Open in desktop
Copy link
Contributor

@offsake offsake Oct 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is my understanding correct that this change detects and scans yaml files assuming some folder structure of .github / devops folders?

If such, are the hardcoded paths something intentional and you want to keep track of the target folders structure changes in the future OR it is an initial temporal solution and eventually you want something more flexible?

Thanks,
-S

Copy link
Contributor Author

@KornevNikita KornevNikita Oct 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, not sure what you mean by "some folder structure". Workflow files are always stored in the .github/workflows/ directory, and our composite actions are stored in devops/actions. I don't think this will ever change.

Also, this workflow downloads and scans only .github/workflows/sycl-* & .github/workflows/ur-* ymls and all ymls in the devops/actions directory, as I believe it's the only workflows we launch here in intel/llvm (@intel/dpcpp-devops-reviewers right?). It's intended to avoid alerts in workflows we don't even run.

Does this answer your question? If not, could you please clarify what you mean.

Copy link
Contributor

@offsake offsake Oct 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Workflow files are always stored in the .github/workflows/ directory

How reliable this statement is? Should it be possible to commit and run a workflow file from a different folder?

Also, this workflow downloads and scans only .github/workflows/sycl-* & .github/workflows/ur-* ymls and all ymls in the devops/actions directory, as I believe it's the only workflows we launch here in intel/llvm (@intel/dpcpp-devops-reviewers right?). It's intended to avoid alerts in workflows we don't even run.

From security point of view having a list of explicitly disabled for scanning items is preferred vs. the list of 'enabled' items, so when unclassified item is added it goes through the scanning by default until it is disabled explicitly.

Copy link
Contributor Author

@KornevNikita KornevNikita Oct 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How reliable this statement is? Should it be possible to commit and run a workflow file from a different folder?

It's just how GitHub works - all workflows should be placed in the .github/workflows directory to be launched, so it's not possible to run a workflow file from a different folder.

From security point of view having a list of explicitly disabled for scanning items is preferred vs. the list of 'enabled' items, so when unclassified item is added it goes through the scanning by default until it is disabled explicitly.

Nevertheless, composite actions may be placed anywhere. But I believe here in intel/llvm the devops team won't allow a developer to place a composite action anywhere but the devops/actions directory. And as I see in llvm/llvm-project composite actions are always stored right in the .github/workflows dir, although I didn't find any strict policy about this.

Anyways, I've updated the patch to not only scan sycl-* and ur-* workflow files in .github/workflows, but the whole directory. If this is still not good enough, we can switch to scanning the whole repo.

Copy link
Contributor

@offsake offsake Oct 27, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for following up on that.

Anyways, I've updated the patch to not only scan sycl-* and ur-* workflow files in .github/workflows, but the whole directory.

Might be good enough given your explanations wrt github limitations.

Although, shouldn't we drop sycl-* and ur-* masks in "on:" section either?

If this is still not good enough, we can switch to scanning the whole repo.

I'd recommend adding comments from your paragraph about devops/actions directory somewhere in this file. Something along the lines that we may consider scanning whole repo rather than devops/actions only if we want to harden security...

Copy link
Contributor Author

@KornevNikita KornevNikita Oct 27, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although, shouldn't we drop sycl-* and ur-* masks in "on:" section either?

Oops, right, updated.

I'd recommend adding comments from your paragraph about devops/actions directory somewhere in this file. Something along the lines that we may consider scanning whole repo rather than devops/actions only if we want to harden security...

Added a comment.

Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
name: Zizmor

on:
workflow_dispatch:
push:
paths:
- '.github/workflows/**
- 'devops/actions/**'

permissions: {}

jobs:
zizmor:
name: Run zizmor
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- name: Checkout repository
uses: actions/checkout@v5
with:
sparse-checkout-cone-mode: false
sparse-checkout: |
.github/workflows/
devops/actions/

- name: Run zizmor
uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0
Loading