From 5f85cf9ec4240ac50fa27116c917e37bd1cbd3ba Mon Sep 17 00:00:00 2001 From: Cezary Stanislawski Date: Wed, 15 Jul 2026 20:17:57 +0200 Subject: [PATCH 1/7] ci: disable checkout credential persistence --- .github/workflows/lint-helm.yml | 2 ++ .github/workflows/lint.yml | 2 ++ .github/workflows/release-helm.yml | 1 + .github/workflows/release.yml | 1 + .github/workflows/test-e2e-helm.yml | 2 ++ .github/workflows/test-e2e.yml | 2 ++ .github/workflows/test-helm-unittest.yml | 2 ++ .github/workflows/test-helm.yml | 2 ++ .github/workflows/test.yml | 2 ++ 9 files changed, 16 insertions(+) diff --git a/.github/workflows/lint-helm.yml b/.github/workflows/lint-helm.yml index 7faae5b..b2d11d3 100644 --- a/.github/workflows/lint-helm.yml +++ b/.github/workflows/lint-helm.yml @@ -20,6 +20,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Read Helm version from .Version id: get-helm-version diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index ba4a85a..749ff54 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -19,6 +19,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: diff --git a/.github/workflows/release-helm.yml b/.github/workflows/release-helm.yml index 18a4a30..3f37d47 100644 --- a/.github/workflows/release-helm.yml +++ b/.github/workflows/release-helm.yml @@ -27,6 +27,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - name: Configure Git run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e7316a5..e4a1056 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,6 +21,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: diff --git a/.github/workflows/test-e2e-helm.yml b/.github/workflows/test-e2e-helm.yml index 15c0ca5..9dee09f 100644 --- a/.github/workflows/test-e2e-helm.yml +++ b/.github/workflows/test-e2e-helm.yml @@ -23,6 +23,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml index 0e5fc56..7eb105b 100644 --- a/.github/workflows/test-e2e.yml +++ b/.github/workflows/test-e2e.yml @@ -26,6 +26,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: diff --git a/.github/workflows/test-helm-unittest.yml b/.github/workflows/test-helm-unittest.yml index 389bda1..995e392 100644 --- a/.github/workflows/test-helm-unittest.yml +++ b/.github/workflows/test-helm-unittest.yml @@ -20,6 +20,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Read Helm version from .Version id: get-helm-version diff --git a/.github/workflows/test-helm.yml b/.github/workflows/test-helm.yml index 39a99b4..a3ce5d8 100644 --- a/.github/workflows/test-helm.yml +++ b/.github/workflows/test-helm.yml @@ -20,6 +20,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Read Helm version from .Version id: get-helm-version diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 69f0ca4..f83044d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,6 +18,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: From 8251f432448f016715b01c409fe0f11f3fddf6e3 Mon Sep 17 00:00:00 2001 From: Cezary Stanislawski Date: Wed, 15 Jul 2026 20:22:15 +0200 Subject: [PATCH 2/7] ci: restrict workflow token permissions --- .github/workflows/lint-helm.yml | 4 ++++ .github/workflows/lint.yml | 4 ++++ .github/workflows/release-helm.yml | 2 ++ .github/workflows/release.yml | 3 ++- .github/workflows/test-e2e-helm.yml | 4 ++++ .github/workflows/test-e2e.yml | 4 ++++ .github/workflows/test-helm-unittest.yml | 4 ++++ .github/workflows/test-helm.yml | 4 ++++ .github/workflows/test.yml | 4 ++++ 9 files changed, 32 insertions(+), 1 deletion(-) diff --git a/.github/workflows/lint-helm.yml b/.github/workflows/lint-helm.yml index b2d11d3..914481b 100644 --- a/.github/workflows/lint-helm.yml +++ b/.github/workflows/lint-helm.yml @@ -11,11 +11,15 @@ on: - 'Makefile' - '.github/workflows/lint-helm.yml' +permissions: {} + env: HELM_CHART_PATH: charts/lifecycle-controller jobs: lint: + permissions: + contents: read name: Helm lint runs-on: ubuntu-latest steps: diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 749ff54..fd3e702 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -13,8 +13,12 @@ on: - '.golangci.yml' - '.github/workflows/lint.yml' +permissions: {} + jobs: lint: + permissions: + contents: read name: Go lint runs-on: ubuntu-latest steps: diff --git a/.github/workflows/release-helm.yml b/.github/workflows/release-helm.yml index 3f37d47..48b8865 100644 --- a/.github/workflows/release-helm.yml +++ b/.github/workflows/release-helm.yml @@ -13,6 +13,8 @@ on: - '.github/workflows/release-helm.yml' workflow_dispatch: +permissions: {} + env: HELM_CHART_PATH: charts/lifecycle-controller diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e4a1056..872caa0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,13 +9,14 @@ on: tags: - 'v[0-9]+.[0-9]+.[0-9]+' +permissions: {} + jobs: goreleaser: runs-on: ubuntu-latest permissions: contents: write packages: write - id-token: write steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 diff --git a/.github/workflows/test-e2e-helm.yml b/.github/workflows/test-e2e-helm.yml index 9dee09f..a6afd1c 100644 --- a/.github/workflows/test-e2e-helm.yml +++ b/.github/workflows/test-e2e-helm.yml @@ -14,11 +14,15 @@ on: - 'go.sum' - '.github/workflows/test-e2e-helm.yml' +permissions: {} + env: HELM_CHART_PATH: charts/lifecycle-controller jobs: test-e2e-helm: + permissions: + contents: read name: Helm E2E tests runs-on: ubuntu-latest steps: diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml index 7eb105b..0e55dab 100644 --- a/.github/workflows/test-e2e.yml +++ b/.github/workflows/test-e2e.yml @@ -20,8 +20,12 @@ on: - 'test/utils/**' - '.github/workflows/test-e2e.yml' +permissions: {} + jobs: test-e2e: + permissions: + contents: read name: E2E tests runs-on: ubuntu-latest steps: diff --git a/.github/workflows/test-helm-unittest.yml b/.github/workflows/test-helm-unittest.yml index 995e392..7e17c57 100644 --- a/.github/workflows/test-helm-unittest.yml +++ b/.github/workflows/test-helm-unittest.yml @@ -11,11 +11,15 @@ on: - 'Makefile' - '.github/workflows/test-helm-unittest.yml' +permissions: {} + env: HELM_CHART_PATH: charts/lifecycle-controller jobs: helm-unittest: + permissions: + contents: read name: Helm unit tests runs-on: ubuntu-latest steps: diff --git a/.github/workflows/test-helm.yml b/.github/workflows/test-helm.yml index a3ce5d8..a64a855 100644 --- a/.github/workflows/test-helm.yml +++ b/.github/workflows/test-helm.yml @@ -11,11 +11,15 @@ on: - 'Makefile' - '.github/workflows/test-helm.yml' +permissions: {} + env: HELM_CHART_PATH: charts/lifecycle-controller jobs: template-test: + permissions: + contents: read name: Helm template runs-on: ubuntu-latest steps: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f83044d..c6f8654 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,8 +12,12 @@ on: - 'go.sum' - '.github/workflows/test.yml' +permissions: {} + jobs: test: + permissions: + contents: read name: Unit tests runs-on: ubuntu-latest steps: From 6fed3012f8cabd77cba832740730bf53c0251dc5 Mon Sep 17 00:00:00 2001 From: Cezary Stanislawski Date: Wed, 15 Jul 2026 20:30:27 +0200 Subject: [PATCH 3/7] ci: disable release dependency caching --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 872caa0..0f0a52e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,6 +26,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: + cache: false go-version-file: go.mod - run: go version From 8d6099939cedf0cab8cb8ad3adf8d487204bae94 Mon Sep 17 00:00:00 2001 From: Cezary Stanislawski Date: Wed, 15 Jul 2026 20:45:29 +0200 Subject: [PATCH 4/7] ci: add zizmor workflow audit --- .github/workflows/zizmor.yml | 41 ++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..4fe70e5 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,41 @@ +name: GitHub Actions Security + +on: + pull_request: + types: + - opened + - synchronize + - reopened + - ready_for_review + paths: + - '.github/workflows/**' + push: + branches: + - main + paths: + - '.github/workflows/**' + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + zizmor: + name: Audit GitHub Actions + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Audit workflows + uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 + with: + advanced-security: false + inputs: .github/workflows + version: v1.27.0 From e93a1ec0b739a45c9460acf3035b396f75d461ee Mon Sep 17 00:00:00 2001 From: Cezary Stanislawski Date: Wed, 15 Jul 2026 20:53:07 +0200 Subject: [PATCH 5/7] ci: verify Docker builder before release --- .github/workflows/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0f0a52e..a959cea 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,6 +35,11 @@ jobs: - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + - name: Verify Docker builder + run: | + docker buildx version + docker buildx inspect --bootstrap + - name: Log in to GitHub Container Registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: From 9e4a7a8087ef44fd66cd872282deb22b20117d29 Mon Sep 17 00:00:00 2001 From: Cezary Stanislawski Date: Wed, 15 Jul 2026 20:56:19 +0200 Subject: [PATCH 6/7] ci: audit all GitHub configuration --- .github/dependabot.yml | 6 ++++++ .github/workflows/zizmor.yml | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index dbea522..0a5cbbe 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,8 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 groups: kubernetes: patterns: @@ -17,6 +19,8 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 groups: actions: patterns: @@ -26,3 +30,5 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 4fe70e5..897c0b8 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -8,12 +8,12 @@ on: - reopened - ready_for_review paths: - - '.github/workflows/**' + - '.github/**' push: branches: - main paths: - - '.github/workflows/**' + - '.github/**' workflow_dispatch: concurrency: @@ -37,5 +37,5 @@ jobs: uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 with: advanced-security: false - inputs: .github/workflows + inputs: .github version: v1.27.0 From de678fa14bd9c2982f64e582eed515418d411a6a Mon Sep 17 00:00:00 2001 From: Cezary Stanislawski Date: Wed, 15 Jul 2026 20:57:20 +0200 Subject: [PATCH 7/7] ci: clarify configuration audit name --- .github/workflows/zizmor.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 897c0b8..ff92a68 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -1,4 +1,4 @@ -name: GitHub Actions Security +name: GitHub Configuration Security on: pull_request: @@ -24,7 +24,7 @@ permissions: {} jobs: zizmor: - name: Audit GitHub Actions + name: Audit GitHub Configuration runs-on: ubuntu-latest permissions: contents: read