new audit: encourage use of shell: bash

[lishaduck]

Pre-submission checks

• I am not reporting a bug (crash, false positive/negative, etc). These must be filed via the bug report template.
• I have looked through the open issues for a duplicate request.

What's the problem this feature will solve?

When shell: bash isn't set, pipefail and friends aren't enabled. This makes it easy for failing ci to go undetected. Not a security issue per se, but it could be probably be exploited.

Describe the solution you'd like

Warn when there's a runs: clause without an explicit shell argument (ideally suggest using defaults.run.shell, which is much less verbose and leads people into the pit of sucess).

Additional context

I discovered zizmor yesterday, and it's great! It automates a lot of the audits I do and pointed out a lot of others I hadn't considered.

[woodruffw]

Thanks for the request @lishaduck!

This is an interesting one: I agree that this isn't a security issue per se, but is potentially worth flagging at the "auditor" level (since that level is intended for things that need manual review).

For ongoing reference, here's where the current shell behavior in GHA is documented: https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#custom-shell -- set -e is enabled by default, but set -o pipefail is only enabled if shell: bash is explicitly set (TIL, I thought setting bash explicitly was exactly the same behaviorally!).

Curious what other users think about this as an audit, as well 🙂

[dalito]

I also think that it would be a useful addition. See actions/runner-images#6668 for problem of swallowing exit codes in cmd and pwsh shells on Windows runners.

[woodruffw]

Thanks for the additional example. Yeah, I'd be OK with an auditor or pedantic-level audit for this!

[lishaduck]

An even more pedantic suggestion would be to enforce -u as well, so shell: bash -noprofile --norc -euo pipefail {0}.
(-u fails on undefined variables, which is also a potential footgun).

That also pretty verbose, so 🤷‍♂️