fix(ci): resolve all zizmor findings and add zizmor pre-commit checks by gforsyth · Pull Request #106 · rapidsai/nvforest

gforsyth · 2026-05-04T15:21:17Z

Similar to upstream changes in shared-workflows, this PR cleans up and annotates all of the workflows and adds the zizmor linter to make sure changes are checked.

Part of rapidsai/build-planning#275

coderabbitai · 2026-05-04T15:26:47Z

📝 Walkthrough

Summary by CodeRabbit

Chores
- Enforced least-privilege permissions across CI workflows by adding explicit job-level permission scopes.
- Pinned actions to specific commit SHAs for stronger supply-chain reproducibility.
- Added repository policy to enforce action/workflow pinning.
- Switched some jobs to pass required tokens via explicit secrets mappings (reduced reliance on inherited secrets).
- Added a pre-commit hook for security scanning.

Walkthrough

Adds workflow-level permissions: {} defaults, scopes explicit job-level least-privilege permissions, pins selected actions to commit SHAs, replaces some secrets: inherit with explicit secrets: mappings, adds a Zizmor pinning ruleset, and registers a Zizmor pre-commit hook.

Changes

GitHub Actions security & pinning

Layer / File(s)	Summary
Pinning rules & hooks `.github/zizmor.yml`, `.pre-commit-config.yaml`	Add Zizmor ruleset to require SHA pinning by default and allow exceptions for `rapidsai/shared-*`; add `zizmorcore/zizmor-pre-commit` hook pinned to `v1.24.1`.
Workflow-level defaults `.github/workflows/*.yaml`	Add top-level `permissions: {}` to `build.yaml`, `labeler.yml`, `pr.yaml`, and `test.yaml`.
Job permissions (least-privilege) `.github/workflows/build.yaml`, `.github/workflows/pr.yaml`, `.github/workflows/test.yaml`, `.github/workflows/labeler.yml`	Introduce explicit job-level `permissions` blocks across many jobs (scoped reads for `contents/actions/packages/pull-requests` and write for `id-token` where required; `triage` job uses narrower scope).
Secrets wiring `.github/workflows/build.yaml`, `.github/workflows/pr.yaml`	Replace some `secrets: inherit` uses with explicit `secrets:` mappings for conda/wheel upload and publish jobs; retain `secrets: inherit` in other jobs with `zizmor: ignore` annotations.
Action pinning `.github/workflows/labeler.yml`, `.github/workflows/pr.yaml`	Pin `actions/labeler` and `nv-gha-runners/get-pr-info` to specific commit SHAs (replace floating refs).
Trigger annotations `.github/workflows/labeler.yml`	Annotate `pull_request_target` trigger with a `zizmor` ignore comment for "dangerous triggers."

Estimated Code Review Effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested Reviewers

jameslamb

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main changes: resolving zizmor findings and adding zizmor pre-commit checks, which directly aligns with the primary objective of the PR.
Description check	✅ Passed	The description clearly relates to the changeset by explaining alignment with upstream changes, workflow cleanup, and zizmor linter addition, which matches the file-level modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/zizmor.yml:
- Around line 5-9: The policy currently exempts the rapidsai namespaces via the
entries "rapidsai/shared-workflows/*": any and "rapidsai/shared-actions/*": any
which defeats SHA-pinning; remove those two wildcard allowlist entries or
replace them with explicit immutable ref pins (e.g., specific SHA or explicit
immutable tags) so they no longer use the mutable "any" policy, and ensure the
default "*" remains "hash-pin" to enforce SHA-pinning for all remaining
actions/workflows.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b5241dd2-654e-48fd-b63b-61a397c079e4

📥 Commits

Reviewing files that changed from the base of the PR and between 2e39962 and 82eb2d9.

📒 Files selected for processing (6)

.github/workflows/build.yaml
.github/workflows/labeler.yml
.github/workflows/pr.yaml
.github/workflows/test.yaml
.github/zizmor.yml
.pre-commit-config.yaml

coderabbitai · 2026-05-04T15:26:50Z

+        # We require SHA-pinning for all workflows and actions _except_ for those from
+        # rapidsai/shared-workflows and rapidsai/shared-actions
+        "rapidsai/shared-workflows/*": any
+        "rapidsai/shared-actions/*": any
+        "*": hash-pin


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "Shared workflow/action refs that still float on mutable branches:" rg -n --glob '.github/workflows/*' \ 'uses:\s*rapidsai/(shared-workflows|shared-actions)/[^@]+@(main|release/[^[:space:]]+)' \ .github/workflows

Repository: rapidsai/nvforest

Length of output: 3330

🏁 Script executed:

cat -n .github/zizmor.yml

Repository: rapidsai/nvforest

Length of output: 433

Remove mutable branch exemptions for shared workflows and actions.

The any policies for rapidsai/shared-workflows/* and rapidsai/shared-actions/* suppress hash-pin enforcement for refs that are still deployed with mutable branches (@main, @release/26.04). This exemption defeats the security control this PR introduces—allowing unreviewed workflow code changes from upstream repos without a PR here. Verify that pinning these shared refs is not feasible; if unfeasible, at least constrain the allowlist to specific immutable refs you intentionally trust rather than exempting entire namespaces.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In @.github/zizmor.yml around lines 5 - 9, The policy currently exempts the rapidsai namespaces via the entries "rapidsai/shared-workflows/*": any and "rapidsai/shared-actions/*": any which defeats SHA-pinning; remove those two wildcard allowlist entries or replace them with explicit immutable ref pins (e.g., specific SHA or explicit immutable tags) so they no longer use the mutable "any" policy, and ensure the default "*" remains "hash-pin" to enforce SHA-pinning for all remaining actions/workflows.

It doesn't defeat the security controls, it's a well-considered trade-off, and we control the upstream repositories.

@gforsyth, understood — thank you for the context. Since rapidsai controls both shared-workflows and shared-actions, granting any pinning policy for those namespaces is a reasonable and deliberate trust boundary rather than a gap. I'll note this for future reviews.

✏️ Learnings added

Learnt from: gforsyth Repo: rapidsai/nvforest PR: 106 File: .github/zizmor.yml:5-9 Timestamp: 2026-05-04T16:49:24.324Z Learning: In the rapidsai/nvforest repository, the `.github/zizmor.yml` exempts `rapidsai/shared-workflows/*` and `rapidsai/shared-actions/*` from SHA-pinning (policy: `any`) intentionally. This is a deliberate security trade-off because rapidsai controls those upstream repositories. Do not flag these exemptions as security issues in future reviews.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

coderabbitai

🧹 Nitpick comments (1)

.github/workflows/pr.yaml (1)
58-60: Action pinned to commit SHA—good security practice. Consider adding a comment above the action with the corresponding tag/version (in this case, likely referencing "main" or v8) for maintainability and future reference.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr.yaml around lines 58 - 60, Add a brief inline comment
above the nv-gha-runners/get-pr-info@090577647b8ddc4e06e809e264f7881650ecdccf
action (the step with id "get-pr-info") indicating the corresponding readable
tag or branch it pins to (e.g., "main" or "v8") and any rationale/version date;
this preserves the security benefit of pinning to a commit SHA while making it
easier for maintainers to know the intended version.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/pr.yaml:
- Around line 58-60: Add a brief inline comment above the
nv-gha-runners/get-pr-info@090577647b8ddc4e06e809e264f7881650ecdccf action (the
step with id "get-pr-info") indicating the corresponding readable tag or branch
it pins to (e.g., "main" or "v8") and any rationale/version date; this preserves
the security benefit of pinning to a commit SHA while making it easier for
maintainers to know the intended version.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8bc9c322-d858-4409-85a9-1b7b66143c07

📥 Commits

Reviewing files that changed from the base of the PR and between 82eb2d9 and 064e067.

📒 Files selected for processing (3)

.github/workflows/build.yaml
.github/workflows/pr.yaml
.github/workflows/test.yaml

gforsyth · 2026-05-06T19:33:38Z

/merge

fix(ci): add zizmor and resolve all findings

82eb2d9

gforsyth added improvement Improves an existing functionality non-breaking Introduces a non-breaking change labels May 4, 2026

gforsyth requested review from a team as code owners May 4, 2026 15:21

gforsyth requested a review from KyleFromNVIDIA May 4, 2026 15:21

gforsyth mentioned this pull request May 4, 2026

Add zizmor to all RAPIDS projects and address all warnings rapidsai/build-planning#275

Open

57 tasks

coderabbitai Bot reviewed May 4, 2026

View reviewed changes

chyunsu3 approved these changes May 4, 2026

View reviewed changes

refactor(ci): use explicit secrets where possible, pare back permissions

064e067

coderabbitai Bot reviewed May 5, 2026

View reviewed changes

jameslamb approved these changes May 6, 2026

View reviewed changes

jameslamb removed the request for review from KyleFromNVIDIA May 6, 2026 19:30

rapids-bot Bot merged commit 62a6975 into rapidsai:main May 6, 2026
109 of 114 checks passed

Navigation Menu

Uh oh!

fix(ci): resolve all zizmor findings and add zizmor pre-commit checks - #106

fix(ci): resolve all zizmor findings and add zizmor pre-commit checks#106
rapids-bot[bot] merged 2 commits into
rapidsai:mainfrom
gforsyth:securitize

gforsyth commented May 4, 2026

Uh oh!

coderabbitai Bot commented May 4, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Estimated Code Review Effort

Suggested Reviewers

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot May 4, 2026 •

edited

Loading

Uh oh!

gforsyth May 4, 2026

Uh oh!

coderabbitai Bot May 4, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

gforsyth commented May 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

gforsyth commented May 4, 2026

Uh oh!

coderabbitai Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated Code Review Effort

Suggested Reviewers

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gforsyth May 4, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

gforsyth commented May 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderabbitai Bot commented May 4, 2026 •

edited

Loading

coderabbitai Bot May 4, 2026 •

edited

Loading