Improve security of GitHub Actions workflows

caxu-rh · caxu-rh · commit 0735e2b401e2 · 2025-08-01T11:50:40.000-04:00
Signed-off-by: Caleb Xu &lt;caxu@redhat.com&gt;
diff --git a/.github/workflows/add-release-info-to-pyxis.yml b/.github/workflows/add-release-info-to-pyxis.yml
@@ -41,9 +41,12 @@ jobs:
           --key '${{ env.KEY_FILE_LOCATION }}' \
           --pass '${{ secrets.certificatePassword }}' \
           -H 'Content-Type: application/json' \
-          -d '{"commit":"${{ inputs.commit }}","enabled_for_testing":true,"name":"github.com/redhat-openshift-ecosystem/openshift-preflight","version":"${{ inputs.tag }}"}' \
+          -d ${DATA_PAYLOAD} \
           -X POST \
-          'https://${{ inputs.host }}/v1/tools' | jq
+          ${PYXIS_ENDPOINT} | jq
+        env:
+          DATA_PAYLOAD: '{"commit":"${{ inputs.commit }}","enabled_for_testing":true,"name":"github.com/redhat-openshift-ecosystem/openshift-preflight","version":"${{ inputs.tag }}"}'
+          PYXIS_ENDPOINT: 'https://${{ inputs.host }}/v1/tools'
 
       - name: Cleanup
         if: always()
diff --git a/.github/workflows/build-main.yml b/.github/workflows/build-main.yml
@@ -6,7 +6,10 @@ on:
 
 env:
   IMAGE_NAME: preflight
-  
+
+permissions:
+  contents: read
+
 jobs:
   build-main:
     name: Build and push main snapshot images
@@ -16,21 +19,27 @@ jobs:
         platform: [linux]
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
+
     - name: Fetch latest release version
-      uses: reloc8/action-latest-release-version@1.0.0
+      uses: reloc8/action-latest-release-version@b8d6337f30390558e7874a044d6a3c1314314bab # 1.0.0
       id: fetch-latest-release
-    - name: Set Env Tags
-      run: echo RELEASE_TAG=${{ steps.fetch-latest-release.outputs.latest-release }} >> $GITHUB_ENV
-    - name: set short sha
-      run: echo SHA_SHORT=$(git rev-parse --short HEAD) >> $GITHUB_ENV
+
+    - name: Set release tag and short SHA
+      run: |
+        echo RELEASE_TAG=${RELEASE_TAG} >> $GITHUB_ENV
+        echo SHA_SHORT=$(git rev-parse --short HEAD) >> $GITHUB_ENV
+      env:
+        RELEASE_TAG: ${{ steps.fetch-latest-release.outputs.latest-release }}
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
         
     - name: Build Image
       id: build-image
-      uses: redhat-actions/buildah-build@v2
+      uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
       with:
         image: ${{ secrets.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
         tags: ${{ env.SHA_SHORT }}-${{ matrix.platform }}-${{ matrix.architecture }}
@@ -44,7 +53,7 @@ jobs:
 
     - name: Push Image
       id: push-image
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2.8
       with:
         image: ${{ env.IMAGE_NAME }}
         tags: ${{ env.SHA_SHORT }}-${{ matrix.platform }}-${{ matrix.architecture }}
@@ -53,7 +62,9 @@ jobs:
         password: ${{ secrets.REGISTRY_PASSWORD }}
 
     - name: Print image url
-      run: echo "Image pushed to ${{ steps.push-image.outputs.registry-paths }}"
+      run: echo "Image pushed to ${REGISTRY_PATHS}"
+      env:
+        REGISTRY_PATHS: ${{ steps.push-image.outputs.registry-paths }}
     
     outputs:
       imageName: ${{ env.IMAGE_NAME }}
@@ -62,13 +73,15 @@ jobs:
   build-coverage:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Install system deps
       run: 'sudo apt update && sudo apt install -y libgpgme-dev libbtrfs-dev libdevmapper-dev'
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version-file: go.mod
 
@@ -85,7 +98,7 @@ jobs:
       run: make cover
      
     - name: Coveralls
-      uses: coverallsapp/github-action@v2
+      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         file: coverage.out
diff --git a/.github/workflows/build-multiarch.yml b/.github/workflows/build-multiarch.yml
@@ -55,37 +55,49 @@ jobs:
 
       # Authenticate to container image registry to push the image
       - name: Podman Login
-        uses: redhat-actions/podman-login@v1
+        uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7
         with:
           registry: ${{ secrets.registry }}
           username: ${{ secrets.user }}
           password: ${{ secrets.password }}
 
       - name: Create and add to manifest
         run: |
-          buildah manifest create ${{ inputs.name }}
-          buildah manifest add ${{ inputs.name }} ${{ secrets.registry }}/${{ inputs.name }}:${{ inputs.tag }}-linux-amd64
-          buildah manifest add ${{ inputs.name }} ${{ secrets.registry }}/${{ inputs.name }}:${{ inputs.tag }}-linux-ppc64le
-          buildah manifest add ${{ inputs.name }} ${{ secrets.registry }}/${{ inputs.name }}:${{ inputs.tag }}-linux-arm64
-          buildah manifest add ${{ inputs.name }} ${{ secrets.registry }}/${{ inputs.name }}:${{ inputs.tag }}-linux-s390x
+          buildah manifest create ${INPUT_NAME}
+          buildah manifest add ${INPUT_NAME} ${{ secrets.registry }}/${INPUT_NAME}:${INPUT_TAG}-linux-amd64
+          buildah manifest add ${INPUT_NAME} ${{ secrets.registry }}/${INPUT_NAME}:${INPUT_TAG}-linux-ppc64le
+          buildah manifest add ${INPUT_NAME} ${{ secrets.registry }}/${INPUT_NAME}:${INPUT_TAG}-linux-arm64
+          buildah manifest add ${INPUT_NAME} ${{ secrets.registry }}/${INPUT_NAME}:${INPUT_TAG}-linux-s390x
+        env:
+          INPUT_NAME: ${{ inputs.name }}
+          INPUT_TAG: ${{ inputs.tag }}
 
       - name: Push manifest
         id: push-manifest
         run: |
-            podman manifest push --digestfile imagedigest ${{ inputs.name }} ${{ secrets.registry }}/${{ inputs.name }}:${{ inputs.tag }}  --all
+            podman manifest push --digestfile imagedigest ${INPUT_NAME} ${{ secrets.registry }}/${INPUT_NAME}:${INPUT_TAG}  --all
             echo "digest=$(cat imagedigest)" | tee -a $GITHUB_OUTPUT
+        env:
+          INPUT_NAME: ${{ inputs.name }}
+          INPUT_TAG: ${{ inputs.tag }}
 
       - name: Sign the published manifest
         # only sign if release is published, not for ghactions branch push
         # which is used for testing and development.
         if: ${{ inputs.sign == true && github.event.release && github.event.action == 'published' }}
         run: |
-          cosign sign --yes --recursive ${{ secrets.registry }}/${{ inputs.name }}@${{ steps.push-manifest.outputs.digest }}
+          cosign sign --yes --recursive ${{ secrets.registry }}/${INPUT_NAME}@${DIGEST}
+        env:
+          DIGEST: ${{ steps.push-manifest.outputs.digest }}
+          INPUT_NAME: ${{ inputs.name }}
 
       - name: Verify the image signature
         if: ${{ inputs.sign == true && github.event.release && github.event.action == 'published' }}
         run: |
           cosign verify \
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/build-multiarch.yml@refs/tags/${{ inputs.tag }} \
+            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/build-multiarch.yml@refs/tags/${INPUT_TAG} \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            ${{ secrets.registry }}/${{ inputs.name }}:${{ inputs.tag }}
+            ${{ secrets.registry }}/${INPUT_NAME}:${INPUT_TAG}
+        env:
+          INPUT_NAME: ${{ inputs.name }}
+          INPUT_TAG: ${{ inputs.tag }}
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
@@ -17,18 +17,23 @@ jobs:
       matrix:
         architecture: [amd64,ppc64le,arm64,s390x]
         platform: [linux]
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
+
     - name: Set Env Tags
       run: echo RELEASE_TAG=$(echo $GITHUB_REF | cut -d '/' -f 3) >> $GITHUB_ENV
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
     - name: Build Image
       id: build-image
-      uses: redhat-actions/buildah-build@v2
+      uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
       with:
         image: ${{ secrets.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
         tags: ${{ env.RELEASE_TAG }}-${{ matrix.platform }}-${{ matrix.architecture }}
@@ -41,7 +46,7 @@ jobs:
 
     - name: Push Image
       id: push-image
-      uses: redhat-actions/push-to-registry@v2
+      uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2.8
       with:
         image: ${{ env.IMAGE_NAME }}
         tags: ${{ env.RELEASE_TAG }}-${{ matrix.platform }}-${{ matrix.architecture }}
@@ -50,7 +55,9 @@ jobs:
         password: ${{ secrets.REGISTRY_PASSWORD }}
 
     - name: Print image url
-      run: echo "Image pushed to ${{ steps.push-image.outputs.registry-paths }}"
+      run: echo "Image pushed to ${REGISTRY_PATHS}"
+      env:
+        REGISTRY_PATHS: ${{ steps.push-image.outputs.registry-paths }}
 
     outputs:
       imageName: ${{ env.IMAGE_NAME }}
@@ -78,6 +85,10 @@ jobs:
       token: ${{ secrets.GITHUB_TOKEN }}
 
   extract-assets:
+    permissions:
+      # Write access to contents is needed in order to upload
+      # files to releases.
+      contents: write
     needs: build-release
     uses: ./.github/workflows/release-artifacts.yml
     with:
@@ -90,6 +101,7 @@ jobs:
       token: ${{ secrets.GITHUB_TOKEN }}
 
   add-release-info-to-pyxis:
+    permissions: {}
     needs: [build-release, extract-assets]
     uses: ./.github/workflows/add-release-info-to-pyxis.yml
     if: "!github.event.release.prerelease"
@@ -103,6 +115,7 @@ jobs:
       certificatePassword: ${{ secrets.PREFLIGHT_RELEASE_PASSWORD }}
 
   copy-to-rhisv:
+    permissions: {}
     needs: [build-release, build-multiarch]
     uses: ./.github/workflows/copy-to-rhisv.yml
     with:
diff --git a/.github/workflows/check-actions.yml b/.github/workflows/check-actions.yml
@@ -0,0 +1,23 @@
+name: Analyze GitHub Actions security
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1
+        with:
+          advanced-security: false
diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml
@@ -1,13 +1,11 @@
 name: Gemini AI Code Review
 
-on:
+# pull_request_target is needed to access the Gemini key and modify (set/remove labels, comment on)
+# the pull request.
+on: # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [opened, synchronize, reopened, labeled]
 
-permissions:
-  contents: read
-  pull-requests: write
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
@@ -18,18 +16,23 @@ jobs:
     outputs:
       should_run_review: ${{ steps.prep.outputs.should_run_review }}
     permissions:
+      contents: read
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Handle review label
         id: prep
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
+          LABEL_JSON: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+          EVENT_ACTION: ${{ github.event.action }}
         run: |
-          HAS_LABEL=$(echo '${{ toJSON(github.event.pull_request.labels.*.name) }}' | jq 'any(. == "gemini-review")')
-          EVENT_ACTION="${{ github.event.action }}"
+          HAS_LABEL=$(jq -n 'env.LABEL_JSON | fromjson | any(. == "gemini-review")')
 
           if [[ "$HAS_LABEL" == "true" && "$EVENT_ACTION" != "labeled" ]]; then
             echo "gemini-review label found on a '${EVENT_ACTION}' event. Removing label and skipping review."
@@ -47,15 +50,19 @@ jobs:
     runs-on: ubuntu-latest
     needs: [handle-label]
     if: needs.handle-label.outputs.should_run_review == 'true'
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Gemini AI Code Review
-        uses: sshnaidm/gemini-code-review-action@d4ccdaf0e2cad5cb79f80f6db07857c0e7fff28f
+        uses: sshnaidm/gemini-code-review-action@d4ccdaf0e2cad5cb79f80f6db07857c0e7fff28f # v1
         with:
           gemini-key: ${{ secrets.GEMINI_API_KEY }}
           model: 'gemini-2.5-flash'
diff --git a/.github/workflows/copy-to-rhisv.yml b/.github/workflows/copy-to-rhisv.yml
@@ -28,18 +28,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Podman Login
-      uses: redhat-actions/podman-login@v1
+      uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7
       with:
-        registry: ${{ secrets.destImageRegistry }}
+        registry: ${DEST_IMAGE_REGISTRY}
         username: ${{ secrets.destRegistryUser }}
         password: ${{ secrets.destRegistryPassword }}
 
     - name: Copy Images from Source to Dest
       id: skopeo-copy-image
       run: |
         skopeo -v
-        skopeo copy --all --preserve-digests docker://${{ secrets.sourceImageRegistry }}/${{ inputs.sourceImageName }}:${{ inputs.sourceImageTag }}-linux-amd64 docker://${{ secrets.destImageRegistry }}/${{ inputs.destImageName }}:${{ inputs.sourceImageTag }}-linux-amd64
-        skopeo copy --all --preserve-digests docker://${{ secrets.sourceImageRegistry }}/${{ inputs.sourceImageName }}:${{ inputs.sourceImageTag }}-linux-ppc64le docker://${{ secrets.destImageRegistry }}/${{ inputs.destImageName }}:${{ inputs.sourceImageTag }}-linux-ppc64le
-        skopeo copy --all --preserve-digests docker://${{ secrets.sourceImageRegistry }}/${{ inputs.sourceImageName }}:${{ inputs.sourceImageTag }}-linux-arm64 docker://${{ secrets.destImageRegistry }}/${{ inputs.destImageName }}:${{ inputs.sourceImageTag }}-linux-arm64
-        skopeo copy --all --preserve-digests docker://${{ secrets.sourceImageRegistry }}/${{ inputs.sourceImageName }}:${{ inputs.sourceImageTag }}-linux-s390x docker://${{ secrets.destImageRegistry }}/${{ inputs.destImageName }}:${{ inputs.sourceImageTag }}-linux-s390x
-        skopeo copy --all --preserve-digests docker://${{ secrets.sourceImageRegistry }}/${{ inputs.sourceImageName }}:${{ inputs.sourceImageTag }} docker://${{ secrets.destImageRegistry }}/${{ inputs.destImageName }}:${{ inputs.sourceImageTag }}
+        skopeo copy --all --preserve-digests docker://${SOURCE_IMAGE_REGISTRY}/${SOURCE_IMAGE_NAME}:${SOURCE_IMAGE_TAG}-linux-amd64 docker://${DEST_IMAGE_REGISTRY}/${DEST_IMAGE_NAME}:${SOURCE_IMAGE_TAG}-linux-amd64
+        skopeo copy --all --preserve-digests docker://${SOURCE_IMAGE_REGISTRY}/${SOURCE_IMAGE_NAME}:${SOURCE_IMAGE_TAG}-linux-ppc64le docker://${DEST_IMAGE_REGISTRY}/${DEST_IMAGE_NAME}:${SOURCE_IMAGE_TAG}-linux-ppc64le
+        skopeo copy --all --preserve-digests docker://${SOURCE_IMAGE_REGISTRY}/${SOURCE_IMAGE_NAME}:${SOURCE_IMAGE_TAG}-linux-arm64 docker://${DEST_IMAGE_REGISTRY}/${DEST_IMAGE_NAME}:${SOURCE_IMAGE_TAG}-linux-arm64
+        skopeo copy --all --preserve-digests docker://${SOURCE_IMAGE_REGISTRY}/${SOURCE_IMAGE_NAME}:${SOURCE_IMAGE_TAG}-linux-s390x docker://${DEST_IMAGE_REGISTRY}/${DEST_IMAGE_NAME}:${SOURCE_IMAGE_TAG}-linux-s390x
+        skopeo copy --all --preserve-digests docker://${SOURCE_IMAGE_REGISTRY}/${SOURCE_IMAGE_NAME}:${SOURCE_IMAGE_TAG} docker://${DEST_IMAGE_REGISTRY}/${DEST_IMAGE_NAME}:${SOURCE_IMAGE_TAG}
+      env:
+        SOURCE_IMAGE_REGISTRY: ${{ secrets.sourceImageRegistry }}
+        SOURCE_IMAGE_NAME: ${{ inputs.sourceImageName }}
+        SOURCE_IMAGE_TAG: ${{ inputs.sourceImageTag }}
+        DEST_IMAGE_REGISTRY: ${{ secrets.destImageRegistry }}
+        DEST_IMAGE_NAME: ${{ inputs.destImageName }}
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -6,11 +6,16 @@ on:
     - main
     - release-*
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Install system deps
       run: 'sudo apt update && sudo apt install -y libgpgme-dev libbtrfs-dev libdevmapper-dev'
@@ -36,7 +41,7 @@ jobs:
       run: make cover
 
     - name: Coveralls
-      uses: coverallsapp/github-action@v2
+      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         file: coverage.out
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
