Repository navigation
Harden GitHub Actions workflows - #4097
Merged
Merged
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
adutra
force-pushed
the
harden-ci-actions
branch
3 times, most recently
from
March 31, 2026 19:30
2e00fd9 to
b76bb7c
Compare
jbonofre
previously approved these changes
Apr 1, 2026
github-project-automation
Bot
moved this from PRs In Progress
to Ready to merge
in Basic Kanban Board
snazy
reviewed
Apr 1, 2026
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
dimas-b
reviewed
Apr 1, 2026
dimas-b
previously approved these changes
Apr 2, 2026
This PR strengthens our CI jobs:
- Prevent template injection by moving ${{ }} expressions out of run blocks
- Prevent "ArtiPACKED"-like exploits by avoiding persisting credentials
- Fix excessive permissions wherever possible
- Add new job to run Zizmor checks on PRs that modify workflows
Release workflows that push branches/tags (release-1, release-2,
release-4) intentionally retain persisted credentials.
adutra
force-pushed
the
harden-ci-actions
branch
from
April 3, 2026 09:39
e436497 to
cfb5222
Compare
dimas-b
approved these changes
Apr 3, 2026
dimas-b
reviewed
Apr 3, 2026
Comment on lines
+386
to
+387
| AWS_ACCESS_KEY_ID: ${{secrets.AWS_ACCESS_KEY_ID}} # zizmor: ignore[secrets-outside-env] | ||
| AWS_SECRET_ACCESS_KEY: ${{secrets.AWS_SECRET_ACCESS_KEY}} # zizmor: ignore[secrets-outside-env] |
Contributor
There was a problem hiding this comment.
optional: AFAIK, these two secrets are not actually used (and not defined). I suppose we could remove them for the sake of clarity.
Contributor
Author
|
Heads up: I'm going to merge this by today EOD. |
github-project-automation
Bot
moved this from Ready to merge
to Done
in Basic Kanban Board
adutra
added a commit
to adutra/polaris
that referenced
this pull request
Apr 7, 2026
This is a follow-up to apache#4097 that adds two more checks, taking Apache Iceberg CI as an example.
adutra
added a commit
to adutra/polaris
that referenced
this pull request
Apr 7, 2026
This is a follow-up to apache#4097 that adds two more checks, taking Apache Iceberg CI as an example.
6 tasks
adutra
added a commit
that referenced
this pull request
Apr 8, 2026
This is a follow-up to #4097 that adds two more checks, taking Apache Iceberg CI as an example.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR strengthens our CI jobs:
${{ }}expressions out of run blocksRelease workflows that push branches/tags (release-1, release-2, release-4) intentionally retain persisted credentials.
Checklist
CHANGELOG.md(if needed)site/content/in-dev/unreleased(if needed)