Add zizmor CI & make it happy (#32717)

* Add zizmor CI & make it happy

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

* Fix zizmor job

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

---------

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

.github/workflows/backport.yml

@@ -1,6 +1,8 @@
 name: Backport
 on:
-    pull_request_target:
+    # Privilege escalation necessary to enable backporting PRs from forks
+    # 🚨 We must not execute any checked out code here.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
         types:
             - closed
             - labeled

.github/workflows/build.yml

@@ -44,6 +44,8 @@ jobs:
                 shell: bash
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6

.github/workflows/build_debian.yaml

@@ -15,6 +15,8 @@ jobs:
             VERSION: ${{ github.ref_name }}
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Download package
               working-directory: apps/web
@@ -75,7 +77,7 @@ jobs:
 
             - name: Publish to packages.element.io
               if: github.event.release.prerelease == false
-              uses: element-hq/packages.element.io@master
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
               with:
                   file: apps/web/element-web.deb
                   github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/build_develop.yml

@@ -29,6 +29,8 @@ jobs:
             R2_PUBLIC_URL: "https://element-web-develop.element.io"
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -134,4 +136,6 @@ jobs:
                   gitHubToken: ${{ secrets.GITHUB_TOKEN }}
 
             - run: |
-                  echo "Deployed to ${{ steps.cfp.outputs.url }}" >> $GITHUB_STEP_SUMMARY
+                  echo "Deployed to ${STEPS_CFP_OUTPUTS_URL}" >> $GITHUB_STEP_SUMMARY
+              env:
+                  STEPS_CFP_OUTPUTS_URL: ${{ steps.cfp.outputs.url }}

.github/workflows/cd.yaml

@@ -26,6 +26,7 @@ jobs:
                   # reduce the size of the checkout with tree filtering,
                   # see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
                   filter: tree:0
+                  persist-credentials: false
 
             - name: Prepare nx
               uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4

.github/workflows/deploy.yml

@@ -35,6 +35,8 @@ jobs:
             SITE: ${{ inputs.site || 'staging.element.io' }}
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Load GPG key
               run: |

.github/workflows/docker.yaml

@@ -23,6 +23,7 @@ jobs:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   fetch-depth: 0 # needed for docker-package to be able to calculate the version
+                  persist-credentials: false
 
             - name: Install Cosign
               uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3

.github/workflows/docs.yml

@@ -21,17 +21,20 @@ jobs:
               with:
                   repository: element-hq/element-desktop
                   path: element-desktop
+                  persist-credentials: false
 
             - name: Fetch element-web
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   path: element-web
+                  persist-credentials: false
 
             - name: Fetch matrix-js-sdk
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   repository: matrix-org/matrix-js-sdk
                   path: matrix-js-sdk
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
               with:

.github/workflows/end-to-end-tests-netlify.yaml

@@ -2,7 +2,9 @@
 # taking the artifact and uploading it to Netlify for easier viewing
 name: Upload End to End Test report to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
         workflows: ["End to End Tests"]
         types:
             - completed

.github/workflows/end-to-end-tests.yaml

@@ -54,6 +54,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   repository: element-hq/element-web
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -174,9 +175,11 @@ jobs:
               working-directory: apps/web
               run: |
                   pnpm playwright test \
-                      --shard "${{ matrix.runner }}/${{ needs.build.outputs.num-runners }}" \
+                      --shard "$SHARD" \
                       --project="${{ matrix.project }}" \
                       ${{ (github.event_name == 'pull_request' && matrix.runAllTests == false ) && '--grep-invert @mergequeue' || '' }}
+              env:
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, needs.build.outputs.num-runners) }}
 
             - name: Upload blob report to GitHub Actions Artifacts
               if: always()
@@ -190,7 +193,7 @@ jobs:
         name: Downstream Playwright tests [element-modules]
         needs: build
         if: inputs.skip != true && github.event_name == 'merge_group'
-        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main
+        uses: element-hq/element-modules/.github/workflows/reusable-playwright-tests.yml@main # zizmor: ignore[unpinned-uses]
         with:
             webapp-artifact: webapp
 

.github/workflows/localazy_download.yaml

@@ -7,7 +7,7 @@ permissions:
     pull-requests: write # needed to auto-approve PRs
 jobs:
     download:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
         with:
             packageManager: pnpm
         secrets:

.github/workflows/localazy_upload.yaml

@@ -9,6 +9,6 @@ on:
 permissions: {} # No permissions needed
 jobs:
     upload:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
         secrets:
             LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}

.github/workflows/netlify.yaml

@@ -2,7 +2,9 @@
 # and uploading it to netlify
 name: Upload Preview Build to Netlify
 on:
-    workflow_run:
+    # Privilege escalation necessary to publish to Netlify
+    # 🚨 We must not execute any checked out code here.
+    workflow_run: # zizmor: ignore[dangerous-triggers]
         workflows: ["Build"]
         types:
             - completed

.github/workflows/pull_request.yaml

@@ -1,13 +1,15 @@
 name: Pull Request
 on:
-    pull_request_target:
+    # Privilege escalation necessary access members of the review teams
+    # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
         types: [opened, edited, labeled, unlabeled, synchronize]
     merge_group:
         types: [checks_requested]
 permissions: {}
 jobs:
     action:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
         permissions:
             pull-requests: write
         secrets:

.github/workflows/release-drafter.yml

@@ -9,4 +9,4 @@ jobs:
     draft:
         permissions:
             contents: write
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]

.github/workflows/release-gitflow.yml

@@ -7,7 +7,7 @@ concurrency: ${{ github.repository }}-${{ github.workflow }}
 permissions: {} # We use ELEMENT_BOT_TOKEN instead
 jobs:
     merge:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
         secrets:
             ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
         with:

.github/workflows/release.yml

@@ -14,7 +14,7 @@ concurrency: ${{ github.workflow }}
 permissions: {}
 jobs:
     release:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
         permissions:
             contents: write
             issues: write

.github/workflows/release_prepare.yml

@@ -27,7 +27,7 @@ jobs:
                     - matrix-org/matrix-js-sdk
                     - element-hq/element-web
                     - element-hq/element-desktop
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-checks.yml@develop # zizmor: ignore[unpinned-uses]
         secrets:
             ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
         with:
@@ -50,6 +50,7 @@ jobs:
                   fetch-depth: 0
                   fetch-tags: true
                   token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
             - name: Checkout Element Web
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               if: inputs.element-web
@@ -60,6 +61,7 @@ jobs:
                   fetch-depth: 0
                   fetch-tags: true
                   token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
             - name: Checkout Matrix JS SDK
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               if: inputs.matrix-js-sdk
@@ -70,6 +72,7 @@ jobs:
                   fetch-depth: 0
                   fetch-tags: true
                   token: ${{ secrets.ELEMENT_BOT_TOKEN }}
+                  persist-credentials: true
 
             - name: Prepare Git
               run: |

.github/workflows/shared-component-publish.yaml

@@ -14,6 +14,8 @@ jobs:
         steps:
             - name: 🧮 Checkout code
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - name: 🔧 Set up node environment

.github/workflows/shared-component-storybook-build.yml

@@ -13,6 +13,8 @@ jobs:
         steps:
             - name: 🧮 Checkout code
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - name: 🔧 Pnpm cache

.github/workflows/sonarqube.yml

@@ -12,7 +12,7 @@ jobs:
     sonarqube:
         name: 🩻 SonarQube
         if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
-        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop # zizmor: ignore[unpinned-uses]
         permissions:
             actions: read
             statuses: write

.github/workflows/static_analysis.yaml

@@ -49,6 +49,8 @@ jobs:
         runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -73,6 +75,19 @@ jobs:
               run: git diff --exit-code
               if: matrix.assert-diff
 
+    zizmor:
+        name: Zizmor Github Actions lint
+        runs-on: ubuntu-24.04
+        permissions:
+            security-events: write
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+
     i18n:
         strategy:
             fail-fast: false
@@ -95,7 +110,7 @@ jobs:
                     - name: Shared Components
                       path: "packages/shared-components"
         name: "i18n Check (${{ matrix.name }})"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@abf186831e2acb3e98fca13a0711a3fa1364d2b1
         permissions:
             pull-requests: read
         with:

.github/workflows/sync-labels.yml

@@ -13,7 +13,7 @@ permissions: {} # We use ELEMENT_BOT_TOKEN instead
 
 jobs:
     sync-labels:
-        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@dac99c67f08f8f2a079e885ffb682a2f39cd3960
         with:
             LABELS: |
                 element-hq/element-meta

.github/workflows/tests.yml

@@ -43,6 +43,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - name: pnpm cache
@@ -70,21 +71,25 @@ jobs:
               working-directory: apps/web
               run: |
                   pnpm test \
-                      --coverage=${{ env.ENABLE_COVERAGE }} \
+                      --coverage=$ENABLE_COVERAGE \
                       --ci \
-                      --max-workers ${{ steps.cpu-cores.outputs.count }} \
+                      --max-workers $MAX_WORKERS \
-                      --shard ${{ matrix.runner }}/${{ strategy.job-total }} \
+                      --shard "$SHARD" \
                       --cacheDirectory /tmp/jest_cache
               env:
                   JEST_SONAR_UNIQUE_OUTPUT_NAME: true
 
                   # tell jest to use coloured output
                   FORCE_COLOR: true
+                  MAX_WORKERS: ${{ steps.cpu-cores.outputs.count }}
+                  SHARD: ${{ format('{0}/{1}', matrix.runner, strategy.job-total) }}
 
             - name: Move coverage files into place
               if: env.ENABLE_COVERAGE == 'true'
               working-directory: apps/web
-              run: mv coverage/lcov.info coverage/${{ steps.setupNode.outputs.node-version }}-${{ matrix.runner }}.lcov.info
+              run: mv coverage/lcov.info coverage/$NODE_VERSION-${{ matrix.runner }}.lcov.info
+              env:
+                  NODE_VERSION: ${{ steps.setupNode.outputs.node-version }}
 
             - name: Upload Artifact
               if: env.ENABLE_COVERAGE == 'true'
@@ -125,6 +130,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   repository: ${{ inputs.matrix-js-sdk-sha && 'element-hq/element-web' || github.repository }}
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - name: pnpm cache
@@ -164,7 +170,7 @@ jobs:
 
             - name: Run tests
               working-directory: "packages/shared-components"
-              run: pnpm test:unit --coverage=${{ env.ENABLE_COVERAGE }}
+              run: pnpm test:unit --coverage=$ENABLE_COVERAGE
 
             - name: Upload Artifact
               if: env.ENABLE_COVERAGE == 'true'

.github/workflows/update-jitsi.yml

@@ -10,6 +10,8 @@ jobs:
         runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6