ci(zizmor): opt into the severity gate — block high-severity findings - #225
Merged
Conversation
Adopt the new zizmor SARIF-guard gating from ci-workflows (#183). The zizmor lane now runs `--format=sarif` through the in-lane guard and BLOCKS on any high-severity (SARIF error) workflow-security finding — template-injection, dangerous-triggers, unpinned-uses, etc. — while lower severities still only annotate. Gating rides the existing required ci-status lane: no code-scanning, no security-events grant, no org-wide ruleset change. - ci.yml: bump the zizmor.yml pin to 31a5b76 and set `fail-on-severity: high`. - policy.json: register the new runner-input contract for zizmor.yml@31a5b76 with `fail-on-severity` in allowedInputs (runner-policy would otherwise reject the new pin + input). Pre-flight `zizmor --persona=regular` (online) on this repo reports 0 high findings (3 notes: 2 adhoc-packages, 1 use-trusted-publishing), so the gate does not block existing workflows. lint:runner-policy + test:runner-policy pass. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Claude finished @kyle-sexton's task in 1m 7s —— View job PR Review
The changes are minimal and well-scoped. Both files are updated atomically — the new pin is introduced in No critical or important findings. 🟡 Nit — stale policy.json entry for the old pin
The Everything else checks out:
|
kyle-sexton
added a commit
that referenced
this pull request
Jul 21, 2026
Burn down the note-level zizmor findings that were annotating every PR (all below the `fail-on-severity: high` gate added in #225). - `ci.yml:404,589` (`adhoc-packages`): the two exact-pinned `npm install -g` tsc/biome steps install toolchains on PATH so the contract tests can drive the tools directly — deliberate and documented. Add inline `# zizmor: ignore[adhoc-packages] <rationale>`. - `publish-packages.yml:83` (`use-trusted-publishing`): a real security recommendation (drop the long-lived token for OIDC). Left visible and tracked in #226 — the proper fix needs npm-org trusted-publisher config. After this, `zizmor --persona=regular` reports only the single tracked note. ## Related No related issue: annotation-noise burn-down following the gate rollout (#225, ci-workflows#183). Deferred proper fix tracked in #226. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 23, 2026
Merged
kyle-sexton
added a commit
that referenced
this pull request
Jul 23, 2026
…ter v0.8.0 selector (#252) No related issue: enforcer support for merged melodic-software/ci-workflows v0.8.0 (#224, #225); unblocks the caller repin + ancillary-events opt-in in melodic-software/medley. ## Related ci-workflows#224, ci-workflows#225 ## Summary - Adds `optionalBooleanSelectorInputs` to the runner-policy schema and enforcer so boolean selector opt-ins can be governed; the only accepted value is the literal `true` (`booleanTrueMap` uses `const: true`). - Registers `admits-ancillary-events` and the deprecated alias `admits-comment-events`. These let a caller opt its no-checkout `issue_comment` / `pull_request_review` / `pull_request_review_comment` / `issues` jobs into self-hosted fleet routing (ci-workflows #224, #225). - Registers the ci-workflows v0.8.0 `select-runner` revision `e77f0126b474144708719f99795e44d0ffe2541d`, owner-scoped to `melodic-software`, so consumers can repin and activate the opt-in. - The boolean map merges into `exactCanonicalMap`'s optional-input argument, reusing the existing fail-closed exact-match; a load-time duplicate-name guard keeps the optional string and boolean maps disjoint. ## Security posture The enforcer *permits*, but does not *verify*, the caller's no-checkout declaration — that premise is trusted under the same job-step review that backs a local-routing grant. No existing job-level control is relaxed (statically-read-only-or-grant, privileged-hosted, container/service, runner-target all still apply); the opt-in only widens which event types the selector may route self-hosted. Captured as a new THREAT-MODEL threats-table row and residual-risk bullet, and in the component README's selector-input contract. Fleet-admission-logic security review pending per team lead before merge. ## Test plan - [x] `npm run test:runner-policy` — 238/238 pass (10 new cases: accept `true`, accept alias, reject `false`, reject quoted `"true"`, reject unknown input, owner-scoped v0.8.0 accept, unapproved-revision reject, schema reject non-`true`, duplicate optional-string name, duplicate canonical name) - [x] `npm run lint:runner-policy` — Runner policy passed (dogfood with `GITHUB_REPOSITORY` owner evidence) - [x] `npm run lint:md` — 0 errors - [x] `npm run test:packages` — 14/14 pass - [x] `npm run lint:hooks` — All good - [x] `npm run test:lefthook-dotnet` — 12/12 pass - [x] `bash harness/shell/run-tests.sh harness/shell/lib.test.sh` — passed - [x] `npx biome check` on changed JS/JSON — no fixes needed - [x] Independent security review (fresh reviewer, rationale withheld) — correct and fail-closed, no P1–P3 findings; the two P4 coverage gaps it raised (quoted-string value, canonical duplicate-name branch) are addressed here Do NOT merge — held for the fleet-admission security review. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adopt the new zizmor SARIF-guard gating shipped in ci-workflows #183. The zizmor lane now runs
--format=sarifthrough the in-lane guard and blocks on any high-severity (SARIFerror) workflow-security finding — template-injection, dangerous-triggers, unpinned-uses, etc. — while lower severities still only annotate. Gating rides the existing requiredci-statuslane: no code-scanning, nosecurity-eventsgrant, no org-wide ruleset change.Changes
ci.yml: bump thezizmor.ymlpin to31a5b76and setfail-on-severity: high; comment updated.components/runner-policy/policy.json: register the new runner-input contract forzizmor.yml@31a5b76withfail-on-severityinallowedInputs—runner-policywould otherwise reject the new pin + input (its lane is inci-status).Safety
Pre-flight
zizmor --persona=regular(online) on this repo → 0 high findings (3 notes: 2adhoc-packages, 1use-trusted-publishing). Thehighgate does not block existing workflows.lint:runner-policy+test:runner-policy(227/227) pass locally.Related
No related issue: rolls out the consumer-side opt-in for the gating capability added in melodic-software/ci-workflows#183. The 3 remaining note-level findings are a separate follow-up (documented-ignore / OIDC trusted-publishing), below this gate's threshold.