Scan GitHub Actions workflows with zizmor

.github/dependabot.yml

@@ -12,10 +12,14 @@ updates:
       day: "monday"
     labels:
       - "dependencies"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "monday"
     labels:
       - "dependencies"
+    cooldown:
+      default-days: 7

.github/workflows/build.yml

@@ -13,17 +13,21 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
     strategy:
       matrix:
         java: [ '17', '21', '25' ]
     steps:
       - name: Checkout project
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'
@@ -35,14 +39,14 @@ jobs:
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: Cache SonarQube packages
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
 
       - name: Cache Maven packages
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -56,7 +60,7 @@ jobs:
 
       - name: Publish test report
         if: always()
-        uses: mikepenz/action-junit-report@v6
+        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6
         with:
           report_paths: '**/target/surefire-reports/TEST-*.xml'
 

.github/workflows/hotfix.yml

@@ -12,16 +12,21 @@ jobs:
     name: Create Branch
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
     steps:
       - name: Checkout project
-        uses: actions/checkout@v7
+        # zizmor: ignore[artipacked] persisted credentials are required to push the hotfix branch below
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
           token: ${{ secrets.CI_CD_TOKEN }}
 
       - name: Create branch
+        env:
+          TAG_VERSION: ${{ github.event.inputs.tag_version }}
         run: |
-          START_TAG=v${{ github.event.inputs.tag_version }}
+          START_TAG=v$TAG_VERSION
           echo "Start from tag $START_TAG"
           MAJOR_MINOR_DIGIT=$(echo "$START_TAG" | cut -d '.' -f 1-2)
           PATCH_DIGIT=$(echo "$START_TAG" | cut -d '.' -f 3)

.github/workflows/release.yml

@@ -9,29 +9,26 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read
     steps:
       - name: Checkout project
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           java-version: '17'
           distribution: 'temurin'
-          cache: maven
           server-id: central
           server-username: SONATYPE_USERNAME
           server-password: SONATYPE_TOKEN
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
-      - name: Cache Maven packages
-        uses: actions/cache@v6
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2
-
       - name: Deploy
         run: mvn -B clean deploy -DskipTests -Psign
         env:
@@ -40,15 +37,17 @@ jobs:
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Generate release changelog
-        uses: mikepenz/release-changelog-builder-action@v6
+        uses: mikepenz/release-changelog-builder-action@c9bcd8238b6f41e05561348339429d360b1c0247 # v6
         id: build_changelog
         with:
           configuration: 'changelog-builder.json'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create release
-        uses: ncipollo/release-action@v1.21.0
+        # ncipollo/release-action v1.21.0 (pinned by SHA). Kept over `gh release` for its
+        # allowUpdates support, which has no single-command equivalent.
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # zizmor: ignore[superfluous-actions]
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           body: ${{ steps.build_changelog.outputs.changelog }}

.github/workflows/security.yml

@@ -9,14 +9,18 @@ jobs:
   scan-code:
     name: Scan code
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout project
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Trivy source code
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .
@@ -29,7 +33,7 @@ jobs:
 
       - name: Upload Trivy source code report
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           sarif_file: trivy-results.sarif
           category: source-code

.github/workflows/tag.yml

@@ -12,46 +12,53 @@ jobs:
     name: Tag
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/hotfix/v')
+    permissions:
+      contents: read
     steps:
       - name: Checkout project
-        uses: actions/checkout@v7
+        # zizmor: ignore[artipacked] persisted credentials are required to push the release commit and tag below
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           token: ${{ secrets.CI_CD_TOKEN }}
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           java-version: '17'
           distribution: 'temurin'
           cache: maven
 
       - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.GPG_PASSPHRASE }}
           git_user_signingkey: true
           git_commit_gpgsign: true
 
       - name: Validate release version format
+        env:
+          RELEASE_VERSION: ${{ github.event.inputs.release_version }}
         run: |
-          if [[ ! "${{ github.event.inputs.release_version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if [[ ! "$RELEASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "Release version must follow SemVer format (X.Y.Z) and start with a digit"
-            echo "Current value: ${{ github.event.inputs.release_version }}"
+            echo "Current value: $RELEASE_VERSION"
             echo "Expected format: 1.2.3, 2.0.0, etc."
             echo "Note: The 'v' prefix will be added automatically to the tag. Do not include it manually"
             exit 1
           fi
 
       - name: Create tag
+        env:
+          RELEASE_VERSION: ${{ github.event.inputs.release_version }}
         run: |
-          mvn versions:set -DnewVersion=${{ github.event.inputs.release_version }}
+          mvn versions:set -DnewVersion="$RELEASE_VERSION"
           git add pom.xml
           git add **/pom.xml
-          git commit -s -m "Prepare release v${{ github.event.inputs.release_version }}"
+          git commit -s -m "Prepare release v$RELEASE_VERSION"
           git push
-          git tag v${{ github.event.inputs.release_version }} -s -m "Create tag v${{ github.event.inputs.release_version }}"
-          git push origin v${{ github.event.inputs.release_version }}
+          git tag "v$RELEASE_VERSION" -s -m "Create tag v$RELEASE_VERSION"
+          git push origin "v$RELEASE_VERSION"
 
       - name: Update next version
         run: |

.github/workflows/zizmor.yml

@@ -0,0 +1,28 @@
+name: zizmor
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+  schedule:
+    - cron: '0 5 * * 1'
+  workflow_dispatch:
+
+jobs:
+  scan-actions:
+    name: Scan GitHub Actions
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout project
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7