mirror of
https://github.com/prometheus-community/windows_exporter.git
synced 2026-10-25 21:19:03 +01:00
85 lines
3.3 KiB
YAML
85 lines
3.3 KiB
YAML
---
|
|
# This workflow runs zizmor to find security issues in GitHub Actions workflows.
|
|
# It is synchronized from https://github.com/prometheus/prometheus.
|
|
#
|
|
# If the "GitHub Actions Security" check fails:
|
|
#
|
|
# 1. Open the "Run zizmor" step in the failed job. Each finding identifies
|
|
# a rule, the affected file and line, and the reason for the finding.
|
|
# The scan can report existing issues in files your PR did not change.
|
|
#
|
|
# 2. Find guidance for the reported rule at https://docs.zizmor.sh/audits/.
|
|
# Fix the affected workflow and push your changes to rerun the check.
|
|
#
|
|
# 3. To reproduce locally, install the zizmor version specified below using
|
|
# the instructions at https://docs.zizmor.sh/installation/.
|
|
# From the repository root, run `zizmor .`.
|
|
# Some findings can be fixed with `zizmor --fix=safe .`.
|
|
# Review the resulting diff and verify that the workflows still work.
|
|
#
|
|
# If a finding appears incorrect or a fix is unclear, ask the repository
|
|
# maintainers before adding an exception. Document the reason for any exception
|
|
# and keep it scoped to the specific finding. See the configuration reference
|
|
# at https://docs.zizmor.sh/configuration/.
|
|
#
|
|
# Propose changes to this shared workflow in prometheus/prometheus so they
|
|
# can be synchronized across repositories.
|
|
name: GitHub Actions Security
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- main
|
|
- master
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
|
|
jobs:
|
|
zizmor:
|
|
name: Run zizmor
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Run zizmor
|
|
id: zizmor
|
|
uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
|
|
with:
|
|
advanced-security: false
|
|
version: 1.31.1
|
|
|
|
- name: Explain how to resolve findings
|
|
if: failure() && steps.zizmor.outcome == 'failure'
|
|
run: |
|
|
cat >> "$GITHUB_STEP_SUMMARY" <<'EOF'
|
|
### Troubleshooting GitHub Actions Security
|
|
|
|
Open the **Run zizmor** step for the findings or execution error.
|
|
Each finding identifies the affected file, line, and rule.
|
|
The scan can report existing issues in files your PR did not change.
|
|
|
|
1. Follow the [guidance for the reported rule](https://docs.zizmor.sh/audits/).
|
|
2. Fix the affected workflow and push your changes to rerun the check.
|
|
|
|
To reproduce locally, [install zizmor](https://docs.zizmor.sh/installation/)
|
|
using the version specified in this workflow and run `zizmor .` from
|
|
the repository root. Some findings can be fixed with `zizmor --fix=safe .`.
|
|
Review the resulting diff and verify that the workflows still work.
|
|
|
|
If a finding appears incorrect or a fix is unclear, ask the repository
|
|
maintainers before adding an exception. Document the reason and keep
|
|
the exception scoped to the specific finding. See the
|
|
[configuration reference](https://docs.zizmor.sh/configuration/).
|
|
|
|
This workflow is synchronized from [prometheus/prometheus](https://github.com/prometheus/prometheus).
|
|
Propose shared workflow changes there so they can reach all repositories.
|
|
EOF
|