romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-06-05 20:44:14 +03:00
Code Issues Projects Releases Packages Wiki Activity

GHA/checksrc: check GHA rules with zizmor

Browse source 
The pedantic level is experimental. If it causes issues, we may just
disable it alongside the ignore comments.

Also:
- silence error:
  ```
   INFO audit: zizmor: completed label.yml
  error[dangerous-triggers]: use of fundamentally insecure workflow trigger
    --> label.yml:13:1
     |
  13 | 'on': [pull_request_target]
     | ^^^^^^^^^^^^^^^^^^^^^^^^^^^ pull_request_target is almost always used insecurely
     |
     = note: audit confidence -> Medium
  ```
- fix pedantic warning:
  ```
   INFO audit: zizmor: completed label.yml
  warning[excessive-permissions]: overly broad permissions
    --> label.yml:1:1
  ...  |
  24 | |         with:
  25 | |           repo-token: '${{ secrets.GITHUB_TOKEN }}'
     | |____________________________________________________- default permissions used due to no permissions: block
     |
     = note: audit confidence -> Medium
  ```
- silence `template-injection` false positives like:
  ```
  - note: ${{ matrix.build.torture && 'test-torture' || 'test-ci' }} may expand into attacker-controllable code
  - note: ${{ contains(matrix.build.install_steps, 'pytest') && 'caddy httpd vsftpd' || '' }} may expand into attacker-controllable code
  ```
  It doesn't seem like these could be controlled by an attacker.
  Let me know if I'm missing something.

Closes #17278
This commit is contained in:
Viktor Szakats 2025-05-07 18:56:27 +02:00
parent 283ad5c432
commit e522f47986
No known key found for this signature in database
GPG key ID: B5ABD165E2AEF201
5 changed files with 23 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.github/workflows/macos.yml vendored
View file

@ -183,6 +183,7 @@ jobs:
# Run this command with retries because of spurious failures seen
# while running the tests, for example
# https://github.com/curl/curl/runs/4095721123?check_suite_focus=true
# zizmor: ignore[template-injection]
run: |
echo ${{ matrix.build.generate && 'ninja' || 'automake libtool' }} \
pkgconf libpsl libssh2 \
@ -311,6 +312,7 @@ jobs:
- name: 'run tests'
if: ${{ !matrix.build.clang-tidy }}
timeout-minutes: ${{ matrix.build.torture && 20 || 10 }}
# zizmor: ignore[template-injection]
run: |
export TFLAGS='-j20 ${{ matrix.build.tflags }}'
if [ -z '${{ matrix.build.torture }}' ]; then