From 2b76c68f81ef641224a0d14d035fd5171280c195 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Fri, 4 Sep 2026 16:18:01 +0200 Subject: [PATCH 1/7] fix: add permissions and pin yamllint in peribolos-validate workflow Add a top-level 'permissions: contents: read' block to restrict the default GITHUB_TOKEN scope and pin yamllint to v1.38.0 to satisfy the Pinned-Dependencies check. Resolves code scanning alerts: #35, #36, #51 Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/workflows/peribolos-validate.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/peribolos-validate.yml b/.github/workflows/peribolos-validate.yml index 6ba35fe..02e0d8f 100644 --- a/.github/workflows/peribolos-validate.yml +++ b/.github/workflows/peribolos-validate.yml @@ -6,6 +6,9 @@ on: - main pull_request: +permissions: + contents: read + jobs: project: name: Verify peribolos @@ -27,4 +30,4 @@ jobs: go test ./... - name: Install yamllint and check peribolos.yaml - run: pip install yamllint && yamllint peribolos.yaml + run: pip install yamllint==1.38.0 && yamllint peribolos.yaml From df09552c05fc1ac31dac9054a6676a7333a074c4 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Fri, 4 Sep 2026 16:26:28 +0200 Subject: [PATCH 2/7] fix: add top-level permissions to peribolos-apply workflow Add a restrictive top-level 'permissions: contents: read' block to ensure the default GITHUB_TOKEN scope is minimal. The existing job-level permissions block is preserved as an explicit override. Resolves code scanning alert: #33 Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/workflows/peribolos-apply.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/peribolos-apply.yml b/.github/workflows/peribolos-apply.yml index 0240de8..fe5d67a 100644 --- a/.github/workflows/peribolos-apply.yml +++ b/.github/workflows/peribolos-apply.yml @@ -19,6 +19,9 @@ on: type: boolean default: false +permissions: + contents: read + concurrency: group: peribolos-apply cancel-in-progress: false From 91505558ccc5d5ed440e933f787d940d9ae359ed Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Fri, 4 Sep 2026 16:32:43 +0200 Subject: [PATCH 3/7] fix: add top-level permissions to peribolos-drift workflow Add a restrictive top-level 'permissions: contents: read' block to ensure the default GITHUB_TOKEN scope is minimal. The existing job-level permissions block (contents: read, issues: write) is preserved as an explicit override for the drift detection job. Resolves code scanning alert: #34 Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/workflows/peribolos-drift.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/peribolos-drift.yml b/.github/workflows/peribolos-drift.yml index d2413a5..838ce63 100644 --- a/.github/workflows/peribolos-drift.yml +++ b/.github/workflows/peribolos-drift.yml @@ -14,6 +14,9 @@ on: - cron: '30 4 * * 1' workflow_dispatch: +permissions: + contents: read + jobs: detect-drift: if: github.repository_owner == 'complytime' From 38a32e3c9cb29558687b40534426537cf75f4fe6 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Fri, 4 Sep 2026 16:59:24 +0200 Subject: [PATCH 4/7] fix: disable credential persistence in peribolos-validate checkout Add persist-credentials: false to the actions/checkout step to prevent unnecessary git credential storage on disk. Resolves zizmor artipacked finding. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/workflows/peribolos-validate.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/peribolos-validate.yml b/.github/workflows/peribolos-validate.yml index 02e0d8f..893f490 100644 --- a/.github/workflows/peribolos-validate.yml +++ b/.github/workflows/peribolos-validate.yml @@ -16,6 +16,8 @@ jobs: timeout-minutes: 20 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: './go.mod' From 6e692a8629d41fe7d1074ac7bcc3de99716aed72 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Fri, 4 Sep 2026 16:59:32 +0200 Subject: [PATCH 5/7] fix: disable credential persistence in peribolos-apply checkouts Add persist-credentials: false to both actions/checkout steps to prevent unnecessary git credential storage on disk. Resolves zizmor artipacked findings. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/workflows/peribolos-apply.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/peribolos-apply.yml b/.github/workflows/peribolos-apply.yml index fe5d67a..20b1488 100644 --- a/.github/workflows/peribolos-apply.yml +++ b/.github/workflows/peribolos-apply.yml @@ -35,6 +35,8 @@ jobs: steps: - name: Checkout complytime/.github repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 @@ -51,6 +53,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: kubernetes-sigs/prow + persist-credentials: false - name: Build peribolos if: >- From f84887e648c9c8dbeeb9ff25631a3a8a716f1b75 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Fri, 4 Sep 2026 16:59:47 +0200 Subject: [PATCH 6/7] fix: disable credential persistence in peribolos-drift checkouts Add persist-credentials: false to both actions/checkout steps to prevent unnecessary git credential storage on disk. Resolves zizmor artipacked findings. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/workflows/peribolos-drift.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/peribolos-drift.yml b/.github/workflows/peribolos-drift.yml index 838ce63..a642097 100644 --- a/.github/workflows/peribolos-drift.yml +++ b/.github/workflows/peribolos-drift.yml @@ -28,6 +28,8 @@ jobs: steps: - name: Checkout complytime/.github repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 @@ -41,6 +43,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: kubernetes-sigs/prow + persist-credentials: false - name: Build peribolos run: | From 4ca295917070e7734fc13f9087a44ff57ef84372 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Fri, 4 Sep 2026 16:59:58 +0200 Subject: [PATCH 7/7] fix: add zizmor config to ignore github-app for peribolos workflows Peribolos manages the entire complytime GitHub org (membership, teams, repos), so its GitHub App token intentionally requires org-wide scope. The zizmor github-app audit flags this as dangerous, but scoping the token to individual repositories would break peribolos functionality. Resolves zizmor github-app findings. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/zizmor.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..f8d75dd --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,11 @@ +# zizmor configuration — https://docs.zizmor.sh/configuration/ +# +# Peribolos manages the entire complytime GitHub org (membership, teams, +# repos), so its GitHub App token intentionally has org-wide scope. +# The github-app audit flags this as dangerous, but scoping the token +# to individual repositories would break peribolos' core functionality. +rules: + github-app: + ignore: + - peribolos-apply.yml + - peribolos-drift.yml