Issue #771: Add static analysis with zizmor.

[elvism-lullabot]

See #771

[deviantintegral]

Pin the ubuntu version, so 26 doesn't break things later?

Suggested change

	runs-on: ubuntu-latest
	runs-on: ubuntu-24.04

[mrdavidburns]

Note from today's sync.

Let's add this workflow directly to this Drainpipe project as a way to test it out. Then we can decide if this is something we want to include with Drainpipe.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[elvism-lullabot]

I added the testZizmor.yml to the GitHub workflows, and it ran successfully. However, github-advanced-security encountered an error here. Could you please review the error? The usage follows the instructions from the README in fabasoad/setup-zizmor-action.

[elvism-lullabot]

I’ve resolved several Zizmor issues. You can see that the Zizmor alerts have been closed here

[mrdavidburns]

@elvism-lullabot Let's update this pull request so that it only scaffolds this file when Drainpipe is configured to run security checks.

see: https://github.com/Lullabot/drainpipe?tab=readme-ov-file#security

Also, we need to make sure all checks are passing before this can be merged.

[elvism-lullabot]

@mrdavidburns Do we need to move the Zizmor check into the scaffold folder and remove it from the GitHub workflows, or should we keep it there for this project?

[mrdavidburns]

I'm still not 100% this should be shipped w/ Drainpipe. If we do it would need to be configurable and something we can turn on with configuration. cc @deviantintegral

[elvism-lullabot]

For the Zizmor configuration rules, we can use a zizmor.yml file to add or ignore specific rules (see: https://docs.zizmor.sh/configuration/).

I also added a rule with a path under the ignore section:

ignore:
  - ./scaffold/github/actions/common/set-env/action.yml

However, it seems this only works when using the file name (e.g., TestFunctional.yml ). In that case, the errors related to the rule in that file was marked as fixed after adding it to the ignore list.

For enabling the configuration, we could consider using Security:Zizmor, which copies the configuration files from both security and zizmor, while keeping the Security configuration unchanged.

cc @mrdavidburns

[deviantintegral]

Let's talk about this on the call tomorrow.

[deviantintegral]

@elvism-lullabot can you file a separate PR just to do the bit around pinning remote workflows? Like these lines:

webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd #v0.9.1