René's URL Explorer Experiment

Title: chore: Harden workflows: least-privilege permissions + zizmor integration by brunoborges · Pull Request #1039 · actions/setup-java · GitHub

Open Graph Title: chore: Harden workflows: least-privilege permissions + zizmor integration by brunoborges · Pull Request #1039 · actions/setup-java

X Title: chore: Harden workflows: least-privilege permissions + zizmor integration by brunoborges · Pull Request #1039 · actions/setup-java

Description: Summary Hardens the action's own CI/CD workflows by applying GitHub Actions security best practices and integrates zizmor so regressions are caught automatically going forward. Motivation: after the recent supply-chain compromises in the Actions ecosystem, consumers increasingly expect the actions they depend on to follow least-privilege and hardening practices. These changes are config-only — no action source (src//dist/) is touched, so runtime behavior of setup-java is unchanged. What changed 1. Least-privilege permissions: on every workflow Previously most workflows had no permissions: block and therefore inherited the repository/organization default token scopes. Now each workflow declares exactly what it needs: Workflow Permissions basic-validation, check-dist, licensed, all e2e-* contents: read codeql-analysis top-level {}, job keeps actions: read / contents: read / security-events: write publish-immutable-actions top-level {}, job keeps contents: read / id-token: write / packages: write update-config-files top-level {}, job gets contents: write + pull-requests: write (needed to push the branch and open the PR) release-new-action-version already scoped to contents: write (unchanged) 2. Drop credential persistence Added persist-credentials: false to all actions/checkout steps that don't subsequently use the GITHUB_TOKEN (every e2e/validation checkout plus the immutable-publish checkout). This prevents the token from lingering in the local git config. 3. Avoid template injection in run: blocks Moved ${{ matrix.version }} and ${{ steps.setup-java.outputs.path }} expansions out of inline run: scripts into env: variables referenced as "$VAR", the pattern recommended to avoid shell injection via expression interpolation. 4. Pin the container image alpine:latest → alpine:3.21 in e2e-versions.yml (mutable latest tag → fixed version). 5. Integrate zizmor .github/workflows/zizmor.yml — runs on push/PR, fails the build on any finding (regression gate), and uploads SARIF to the Code scanning tab. .github/zizmor.yml — pinning policy aligned with this repo's conventions: first-party actions/* and github/* may use version tags (ref-pin), while any third-party action must be pinned to a full commit SHA (hash-pin). Validation zizmor goes from 39 high + 39 medium + 31 low/info findings to 0, both offline and online: $ zizmor .github/workflows/ No findings to report. Good job! All workflow YAML was validated for syntax. Related Addresses the hardening/security-posture aspect mentioned alongside #1023 (immutable releases). The publish-immutable-actions.yml workflow that satisfies #1023 is also hardened here (persist-credentials: false, explicit top-level {}).

Open Graph Description: Summary Hardens the action's own CI/CD workflows by applying GitHub Actions security best practices and integrates zizmor so regressions are caught automatically going forward. Motivation: afte...

X Description: Summary Hardens the action's own CI/CD workflows by applying GitHub Actions security best practices and integrates zizmor so regressions are caught automatically going forward. Motivation: ...

Opengraph URL: https://github.com/actions/setup-java/pull/1039

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width