From 3131956eb01499bf62b3b54ff7640dfab9ed2000 Mon Sep 17 00:00:00 2001 From: Mark Kittisopikul Date: Tue, 4 Aug 2026 16:41:53 -0400 Subject: [PATCH] Harden workflow checkout credential hygiene + permissions (#6545) * Harden workflow checkout credential hygiene + permissions Address zizmor static-analysis findings: - artipacked: add `persist-credentials: false` to actions/checkout steps in codeql.yml (2), test-binary-installation.yml (2), clang-format-check.yml, freebsd.yml, h5py.yml, openbsd.yml, signed-plugins.yml, and update-progress.yml. None of these jobs push to git, so dropping the persisted checkout credential is safe. - excessive-permissions: restrict call-workflows.yml top-level permissions to `contents: read`, and grant `packages: write` / `pull-requests: write` only on the two jobs that call the maven-staging reusable workflow (which declares those needs). No behavioral change. Co-Authored-By: Claude Opus 4.8 * Removed extra blank lines. --------- Co-authored-by: Claude Opus 4.8 Co-authored-by: Larry Knox --- .github/workflows/call-workflows.yml | 10 ++++++++-- .github/workflows/clang-format-check.yml | 2 ++ .github/workflows/codeql.yml | 5 +++++ .github/workflows/freebsd.yml | 2 ++ .github/workflows/h5py.yml | 1 + .github/workflows/openbsd.yml | 2 ++ .github/workflows/signed-plugins.yml | 2 ++ .github/workflows/test-binary-installation.yml | 2 ++ .github/workflows/update-progress.yml | 4 +++- 9 files changed, 27 insertions(+), 3 deletions(-) diff --git a/.github/workflows/call-workflows.yml b/.github/workflows/call-workflows.yml index 9e8c891957d..db49c47aef5 100644 --- a/.github/workflows/call-workflows.yml +++ b/.github/workflows/call-workflows.yml @@ -30,8 +30,6 @@ concurrency: permissions: contents: read - packages: write - pull-requests: write jobs: call-workflow-special-cmake: @@ -222,6 +220,10 @@ jobs: call-maven-staging: name: "Maven Staging Tests" needs: call-release-cmake + permissions: + contents: read + packages: write + pull-requests: write uses: ./.github/workflows/maven-staging.yml with: test_maven_deployment: true @@ -232,6 +234,10 @@ jobs: call-maven-ffm-staging: name: "Maven Staging Tests" needs: call-ffm-latest-java + permissions: + contents: read + packages: write + pull-requests: write uses: ./.github/workflows/maven-staging.yml with: test_maven_deployment: true diff --git a/.github/workflows/clang-format-check.yml b/.github/workflows/clang-format-check.yml index ea22c0a0a9e..2af754f221d 100644 --- a/.github/workflows/clang-format-check.yml +++ b/.github/workflows/clang-format-check.yml @@ -12,6 +12,8 @@ jobs: if: "!contains(github.event.head_commit.message, 'skip-ci')" steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Run clang-format style check for C and Java code uses: DoozyX/clang-format-lint-action@bcb4eb2cb0d707ee4f3e5cc3b456eb075f12cf73 # v0.20 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c70f22b83ba..be910c7ebd8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -21,6 +21,9 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Check for code changes uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 id: filter @@ -65,6 +68,8 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Configure HDF5 run: | diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index 10969a0c247..62e35767601 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -50,6 +50,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Build and test on FreeBSD uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1 diff --git a/.github/workflows/h5py.yml b/.github/workflows/h5py.yml index 6c7372eaab8..c45961c665e 100644 --- a/.github/workflows/h5py.yml +++ b/.github/workflows/h5py.yml @@ -16,6 +16,7 @@ jobs: - name: Checkout Spack uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: spack/spack path: ./spack diff --git a/.github/workflows/openbsd.yml b/.github/workflows/openbsd.yml index f2418eff574..56deef15f7c 100644 --- a/.github/workflows/openbsd.yml +++ b/.github/workflows/openbsd.yml @@ -50,6 +50,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Build and test on OpenBSD uses: vmactions/openbsd-vm@c941015845c0f0c429676840963dc63b226d4f69 diff --git a/.github/workflows/signed-plugins.yml b/.github/workflows/signed-plugins.yml index 93cb971266d..608d15f9a75 100644 --- a/.github/workflows/signed-plugins.yml +++ b/.github/workflows/signed-plugins.yml @@ -77,6 +77,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install dependencies (Linux) if: runner.os == 'Linux' diff --git a/.github/workflows/test-binary-installation.yml b/.github/workflows/test-binary-installation.yml index 139dd27a92c..fdfe56199f4 100644 --- a/.github/workflows/test-binary-installation.yml +++ b/.github/workflows/test-binary-installation.yml @@ -73,6 +73,7 @@ jobs: - name: Checkout HDF5Examples uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: HDFGroup/HDF5Examples path: HDF5Examples @@ -277,6 +278,7 @@ jobs: - name: Checkout HDF5Examples uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: HDFGroup/HDF5Examples path: HDF5Examples diff --git a/.github/workflows/update-progress.yml b/.github/workflows/update-progress.yml index 9404cc2cc31..31cd4ec0f8f 100644 --- a/.github/workflows/update-progress.yml +++ b/.github/workflows/update-progress.yml @@ -14,7 +14,9 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - + with: + persist-credentials: false + - name: Set up Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: