From 6abdbfca9da125158180d093657bc07cf9e3241a Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 6 Apr 2025 16:30:38 +0200 Subject: [PATCH 1/3] Track nixpkgs-unstable for more recent package versions --- flake.lock | 17 +++++++++++++++++ flake.nix | 2 ++ 2 files changed, 19 insertions(+) diff --git a/flake.lock b/flake.lock index e6afa8901..f089243d4 100644 --- a/flake.lock +++ b/flake.lock @@ -522,6 +522,22 @@ "type": "indirect" } }, + "nixpkgs-unstable": { + "locked": { + "lastModified": 1743814133, + "narHash": "sha256-drDyYyUmjeYGiHmwB9eOPTQRjmrq3Yz26knwmMPLZFk=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "250b695f41e0e2f5afbf15c6b12480de1fe0001b", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs_2": { "locked": { "lastModified": 1732014248, @@ -621,6 +637,7 @@ "nix-eval-jobs": "nix-eval-jobs", "nixos-channel-scripts": "nixos-channel-scripts", "nixpkgs": "nixpkgs", + "nixpkgs-unstable": "nixpkgs-unstable", "rfc39": "rfc39", "simple-nixos-mailserver": "simple-nixos-mailserver", "sops-nix": "sops-nix", diff --git a/flake.nix b/flake.nix index 0fc9b51c0..d6001db9e 100644 --- a/flake.nix +++ b/flake.nix @@ -26,6 +26,8 @@ nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; + nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; + flake-parts.url = "github:hercules-ci/flake-parts"; flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs"; From 205b1ecd331cf916254b8a0f3017d80f69051329 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 6 Apr 2025 16:14:04 +0200 Subject: [PATCH 2/3] Use zizmor to lint GitHub action workflows --- .github/workflows/zizmor.yml | 43 ++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000..39ab95286 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,43 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: + - main + paths: + - ".github/**" + - flake.lock + pull_request: + paths: + - ".github/**" + - flake.lock + +permissions: {} + +jobs: + zizmor: + name: Run zizmor against GitHub Action workflows + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - name: Clone repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + with: + persist-credentials: false + + - name: Install nix + uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31 + + - name: Run zizmor 🌈 + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + nix run --inputs-from . nixpkgs-unstable#zizmor -- \ + --format sarif --pedantic . > results.sarif + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3 + with: + sarif_file: results.sarif + category: zizmor From d53d8f2434a11fe8f094a08148545a772639e77c Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 6 Apr 2025 16:36:07 +0200 Subject: [PATCH 3/3] Don't persist checkout action credentials in later steps https://github.com/actions/checkout/issues/485 --- .github/workflows/ci.yml | 8 ++++++++ .github/workflows/dns-apply.yml | 2 ++ .github/workflows/dns-preview.yml | 2 ++ 3 files changed, 12 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 03d30d732..ce862fac3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,6 +24,8 @@ jobs: - macos-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + with: + persist-credentials: false - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31 - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16 with: @@ -45,6 +47,8 @@ jobs: - mimas steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + with: + persist-credentials: false - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31 - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16 with: @@ -61,6 +65,8 @@ jobs: - goofy-hopcroft steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + with: + persist-credentials: false - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31 - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16 with: @@ -77,6 +83,8 @@ jobs: - m2-large steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + with: + persist-credentials: false - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31 - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16 with: diff --git a/.github/workflows/dns-apply.yml b/.github/workflows/dns-apply.yml index b9f19758c..9c6d492cb 100644 --- a/.github/workflows/dns-apply.yml +++ b/.github/workflows/dns-apply.yml @@ -18,6 +18,8 @@ jobs: fail-fast: true steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31 - name: dnscontrol push env: diff --git a/.github/workflows/dns-preview.yml b/.github/workflows/dns-preview.yml index 288c50212..1cf0a22bd 100644 --- a/.github/workflows/dns-preview.yml +++ b/.github/workflows/dns-preview.yml @@ -15,6 +15,8 @@ jobs: fail-fast: false steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31 - name: dnscontrol preview if: github.repository == 'nixos/infra'