Skip to content

Mint read-only App token for zizmor audit #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Wenxin Jiang (Wenxin-Jiang) wants to merge 2 commits into from
Closed

Mint read-only App token for zizmor audit #29

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fc0289a
Mint read-only App token for zizmor audit
Wenxin-Jiang Sep 14, 2026
66ff66d
Scope audit token to a dedicated read-only App
Wenxin-Jiang Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion .github/workflows/audit-gha-workflows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,32 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Create read-only audit token
id: audit-token
if: >-
${{ vars.ZIZMOR_AUDIT_APP_CLIENT_ID != ''
&& vars.ZIZMOR_AUDIT_REPOSITORIES != ''
&& github.actor != 'dependabot[bot]'
&& (github.event_name != 'pull_request'
|| github.event.pull_request.head.repo.full_name == github.repository) }}
continue-on-error: true
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
client-id: ${{ vars.ZIZMOR_AUDIT_APP_CLIENT_ID }}
private-key: ${{ secrets.ZIZMOR_AUDIT_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env]
owner: ${{ github.repository_owner }}
repositories: ${{ vars.ZIZMOR_AUDIT_REPOSITORIES }}
permission-contents: read
- name: Report token source
env:
MINTED: ${{ steps.audit-token.outcome == 'success' && steps.audit-token.outputs.token != '' }}
run: |
if [ "$MINTED" = "true" ]; then echo "audit token: minted"; else echo "audit token: fallback GITHUB_TOKEN"; fi
- name: Install zizmor
run: pip install zizmor==1.23.1
- name: Run zizmor
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ steps.audit-token.outputs.token || secrets.GITHUB_TOKEN }}
run: |
if [ -d .github ]; then
zizmor .github --gh-token "${GITHUB_TOKEN}" --min-severity medium
Expand Down