From 498aaa682ccf9214cd05fcbd495a1a01be1d1ee5 Mon Sep 17 00:00:00 2001 From: Christoph Hannebauer Date: Mon, 28 Sep 2026 11:07:30 +0200 Subject: [PATCH 1/4] zizmor: unsafe autofixes --- .github/workflows/analyzeStyle.yml | 13 +++++++++---- .github/workflows/check-arm-template.yml | 2 ++ .github/workflows/generate-arm-template.yml | 4 +++- .github/workflows/prepare-marketplace.yml | 5 +++-- 4 files changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/analyzeStyle.yml b/.github/workflows/analyzeStyle.yml index 903377b..0dfa9e1 100644 --- a/.github/workflows/analyzeStyle.yml +++ b/.github/workflows/analyzeStyle.yml @@ -14,7 +14,8 @@ jobs: steps: - uses: actions/checkout@v7 with: - fetch-depth: 10 + fetch-depth: 10 + persist-credentials: false - name: Check for changed files id: changes run: | @@ -42,7 +43,9 @@ jobs: markdown-link-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: tcort/github-action-markdown-link-check@e047c5b37f24ab722bbef1a27b6fab7f96bc4068 # v1 with: use-quiet-mode: 'yes' @@ -52,11 +55,13 @@ jobs: if: needs.filter.outputs.bicep == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7 + with: + persist-credentials: false - name: Lint Bicep files run: az bicep lint --file azuredeploy.bicep check-arm-templates: needs: filter if: needs.filter.outputs.json == 'true' - uses: ./.github/workflows/check-arm-template.yml \ No newline at end of file + uses: $/.github/workflows/check-arm-template.yml diff --git a/.github/workflows/check-arm-template.yml b/.github/workflows/check-arm-template.yml index 8017555..195ee1f 100644 --- a/.github/workflows/check-arm-template.yml +++ b/.github/workflows/check-arm-template.yml @@ -12,12 +12,14 @@ jobs: with: ref: ${{ github.ref }} path: install + persist-credentials: false - name: Download ARM TTK uses: actions/checkout@v7 with: repository: Azure/arm-ttk path: arm-ttk + persist-credentials: false - name: Test ARM Template shell: pwsh diff --git a/.github/workflows/generate-arm-template.yml b/.github/workflows/generate-arm-template.yml index eb3527f..2f4d6b9 100644 --- a/.github/workflows/generate-arm-template.yml +++ b/.github/workflows/generate-arm-template.yml @@ -16,6 +16,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v7 + with: + persist-credentials: true # we persist credentials, so we can push the generated ARM template - name: Generate ARM template run: az bicep build --file azuredeploy.bicep @@ -30,4 +32,4 @@ jobs: check-arm-template: needs: build-and-push - uses: ./.github/workflows/check-arm-template.yml \ No newline at end of file + uses: $/.github/workflows/check-arm-template.yml diff --git a/.github/workflows/prepare-marketplace.yml b/.github/workflows/prepare-marketplace.yml index f26c314..83883e3 100644 --- a/.github/workflows/prepare-marketplace.yml +++ b/.github/workflows/prepare-marketplace.yml @@ -13,7 +13,8 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: - ref: 'marketplace' + ref: 'marketplace' + persist-credentials: false - name: Download Artifacts from install repository run: | @@ -46,4 +47,4 @@ jobs: with: name: Release path: publish/* - compression-level: 9 \ No newline at end of file + compression-level: 9 From 6382992e7af38ec2accbafb55c89baa060664ae7 Mon Sep 17 00:00:00 2001 From: Christoph Hannebauer Date: Mon, 28 Sep 2026 11:12:34 +0200 Subject: [PATCH 2/4] Zizmor safe autofixes --- .github/workflows/analyzeStyle.yml | 6 +++--- .github/workflows/check-arm-template.yml | 4 ++-- .github/workflows/dependabot-auto-merge-actions.yml | 2 +- .github/workflows/generate-arm-template.yml | 2 +- .github/workflows/prepare-marketplace.yml | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/analyzeStyle.yml b/.github/workflows/analyzeStyle.yml index 0dfa9e1..1bf1050 100644 --- a/.github/workflows/analyzeStyle.yml +++ b/.github/workflows/analyzeStyle.yml @@ -12,7 +12,7 @@ jobs: bicep: ${{ steps.changes.outputs.bicep }} json: ${{ steps.changes.outputs.json }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 10 persist-credentials: false @@ -43,7 +43,7 @@ jobs: markdown-link-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: tcort/github-action-markdown-link-check@e047c5b37f24ab722bbef1a27b6fab7f96bc4068 # v1 @@ -55,7 +55,7 @@ jobs: if: needs.filter.outputs.bicep == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Lint Bicep files diff --git a/.github/workflows/check-arm-template.yml b/.github/workflows/check-arm-template.yml index 195ee1f..e070265 100644 --- a/.github/workflows/check-arm-template.yml +++ b/.github/workflows/check-arm-template.yml @@ -8,14 +8,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout the repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.ref }} path: install persist-credentials: false - name: Download ARM TTK - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Azure/arm-ttk path: arm-ttk diff --git a/.github/workflows/dependabot-auto-merge-actions.yml b/.github/workflows/dependabot-auto-merge-actions.yml index 5191a72..7e8d9ca 100644 --- a/.github/workflows/dependabot-auto-merge-actions.yml +++ b/.github/workflows/dependabot-auto-merge-actions.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/generate-arm-template.yml b/.github/workflows/generate-arm-template.yml index 2f4d6b9..bdd559d 100644 --- a/.github/workflows/generate-arm-template.yml +++ b/.github/workflows/generate-arm-template.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true # we persist credentials, so we can push the generated ARM template diff --git a/.github/workflows/prepare-marketplace.yml b/.github/workflows/prepare-marketplace.yml index 83883e3..2289d51 100644 --- a/.github/workflows/prepare-marketplace.yml +++ b/.github/workflows/prepare-marketplace.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 'marketplace' persist-credentials: false @@ -43,7 +43,7 @@ jobs: cp CertMaster-Artifacts-Linux.zip publish/dist-certmaster/ - name: Upload Artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: Release path: publish/* From bb95c6d1ff7c935841e8f8e84094011ca5c8f5f0 Mon Sep 17 00:00:00 2001 From: Christoph Hannebauer Date: Mon, 28 Sep 2026 11:23:17 +0200 Subject: [PATCH 3/4] zizmor manual fixes --- .github/workflows/check-arm-template.yml | 3 +++ .github/workflows/generate-arm-template.yml | 9 +++++++-- .github/workflows/prepare-marketplace.yml | 7 +++++-- 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/.github/workflows/check-arm-template.yml b/.github/workflows/check-arm-template.yml index e070265..0959dbc 100644 --- a/.github/workflows/check-arm-template.yml +++ b/.github/workflows/check-arm-template.yml @@ -3,6 +3,9 @@ name: Check ARM Template with TTK on: workflow_call: +permissions: + contents: read + jobs: check-arm-templates: runs-on: ubuntu-latest diff --git a/.github/workflows/generate-arm-template.yml b/.github/workflows/generate-arm-template.yml index bdd559d..668298c 100644 --- a/.github/workflows/generate-arm-template.yml +++ b/.github/workflows/generate-arm-template.yml @@ -7,11 +7,14 @@ on: paths: - '**/*.bicep' +permissions: + contents: read + jobs: build-and-push: runs-on: ubuntu-latest - permissions: # Job-level permissions configuration starts here - contents: write # 'write' access to repository contents + permissions: + contents: write # pushes the generated ARM template back to master steps: - name: Checkout repository @@ -32,4 +35,6 @@ jobs: check-arm-template: needs: build-and-push + permissions: + contents: read uses: $/.github/workflows/check-arm-template.yml diff --git a/.github/workflows/prepare-marketplace.yml b/.github/workflows/prepare-marketplace.yml index 2289d51..686c72d 100644 --- a/.github/workflows/prepare-marketplace.yml +++ b/.github/workflows/prepare-marketplace.yml @@ -6,6 +6,9 @@ name: Create Artifacts for Marketplace on: workflow_dispatch: +permissions: + contents: read + jobs: prepare-marketplace: runs-on: ubuntu-latest @@ -13,7 +16,7 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: 'marketplace' + ref: 'marketplace' persist-credentials: false - name: Download Artifacts from install repository @@ -47,4 +50,4 @@ jobs: with: name: Release path: publish/* - compression-level: 9 + compression-level: 9 From db8e99ad10f318c584678a03d1f49c8801d09048 Mon Sep 17 00:00:00 2001 From: Christoph Hannebauer Date: Mon, 28 Sep 2026 11:59:53 +0200 Subject: [PATCH 4/4] safe fix for dependabot.yml --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b39a2ba..eea86ae 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,3 +10,5 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7