Lint our GitHub Actions workflows with zizmor

[legoktm]

Status

Ready for review

Description

We just need to set persist-credentials: false in all of our workflows.

Introduce the standard make lint target that runs all of our linters.

Refs <freedomofpress/securedrop-tooling#18>.

[cfm]

Thanks, @legoktm. This follows the precedent established in other pull requests towards freedomofpress/securedrop-tooling#18 and runs as expected.

Do you think any of these checks, currently disabled in our environment, are worth enabling in follow-up work?

2025-01-03T18:04:43.735635Z  WARN zizmor: skipping impostor-commit: can't run without a GitHub API token
2025-01-03T18:04:43.735660Z  WARN zizmor: skipping ref-confusion: can't run without a GitHub API token
2025-01-03T18:04:43.735666Z  WARN zizmor: skipping known-vulnerable-actions: can't run without a GitHub API token

[legoktm]

Do you think any of these checks, currently disabled in our environment, are worth enabling in follow-up work?

I would like to enable them, but since they need a GitHub API token, then we're adding a new secret to CI, which means we've expanded our CI attack surface :/

I'm kind of hoping that woodruffw/zizmor#278 will address some of the things that currently need the GH API.

[cfm]

Yep, that's what I was wondering about! Thanks for the pointer.

[woodruffw]

Hi! I saw this backlinked from woodruffw/zizmor#278; thanks for trying out zizmor!

FWIW, you don't need to configure a new secret in CI to use zizmor's online features: you can use the default secrets.GITHUB_TOKEN, which you can even scope down to permissions: {} (i.e. no permissions needed at all). The main reason zizmor needs a token is to avoid getting throttled with rate limits, not because it needs any special access to anything 🙂

(Long term the plan is to move to the static API however, so this will certainly become less relevant!)