zizmorでGitHub Actionsを静的解析し、公開ワークフローのサプライチェーンリスクを低減する

$ zizmor --persona auditor .github/workflows/ci.yaml
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows/ci.yaml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/ci.yaml:13:9
   |
13 |         - name: Checkout
   |  _________^
14 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
   | |________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[anonymous-definition]: workflow or action definition without a name
 --> .github/workflows/ci.yaml:9:3
  |
9 |   ci:
  |   ^^ this job
  |
  = note: audit confidence → High
  = tip: use 'name: ...' to give this job a name
  = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[concurrency-limits]: insufficient job-level concurrency limits
 --> .github/workflows/ci.yaml:3:1
  |
3 | on: [push]
  | ^^^^^^^^^^ workflow is missing concurrency setting
...
9 |   ci:
  |   -- job affected by missing workflow concurrency
  |
  = note: audit confidence → High
  = help: audit documentation → https://docs.zizmor.sh/audits/#concurrency-limits

3 findings (1 fixable): 1 informational, 1 low, 1 medium, 0 high

$ zizmor --persona auditor .github/workflows/deploy.yaml
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows/deploy.yaml
error[excessive-permissions]: overly broad permissions
  --> .github/workflows/deploy.yaml:20:3
   |
20 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

help[undocumented-permissions]: permissions without explanatory comments
  --> .github/workflows/deploy.yaml:20:3
   |
20 |   id-token: write
   |   ^^^^^^^^^^^^^^^ needs an explanatory comment
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

2 findings: 0 informational, 1 low, 0 medium, 1 high

$ zizmor --persona auditor .github/workflows/deploy.yaml
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows/deploy.yaml
warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/deploy.yaml:1:1
   |
 1 | / name: Deploy
 2 | |
 3 | | on:
 4 | |   push:
...  |
36 | |       CLOUDINARY_CLOUD_NAME: ${{ secrets.CLOUDINARY_CLOUD_NAME }}
37 | |       CLOUDINARY_API_KEY: ${{ secrets.CLOUDINARY_API_KEY }}
   | |____________________________________________________________^ default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

1 finding: 0 informational, 0 low, 1 medium, 0 high

$ zizmor --persona auditor .github/workflows/reusable-deploy.yaml
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows/reusable-deploy.yaml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/reusable-deploy.yaml:28:9
   |
28 |       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/reusable-deploy.yaml:1:1
   |
 1 | / name: Deploy (Reusable)
 2 | |
 3 | | on:
 4 | |   workflow_call:
...  |
49 | |           CLOUDINARY_API_KEY: ${{ secrets.CLOUDINARY_API_KEY }}
50 | |           CLOUDINARY_API_SECRET_KEY_NAME: ${{ vars.CLOUDINARY_API_SECRET_KEY_NAME }}
   | |_____________________________________________________________________________________^ default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

help[template-injection]: code injection via template expansion
  --> .github/workflows/reusable-deploy.yaml:43:35
   |
43 | ...   run: bunx cdk deploy "${{ inputs.stageName == 'prd' && 'p' || 'd' }}-st-main" -c stageName=${{ inputs.stageName }} --require-a...
   |       --- this run block        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> .github/workflows/reusable-deploy.yaml:43:104
   |
43 |         run: bunx cdk deploy "${{ inputs.stageName == 'prd' && 'p' || 'd' }}-st-main" -c stageName=${{ inputs.stageName }} --require...
   |         --- this run block                                                                             ^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

warning[self-hosted-runner]: runs on a self-hosted runner
  --> .github/workflows/reusable-deploy.yaml:21:5
   |
21 |     runs-on: [self-hosted, macOS, ARM64]
   |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ self-hosted runner used here
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#self-hosted-runner

help[undocumented-permissions]: permissions without explanatory comments
  --> .github/workflows/reusable-deploy.yaml:25:7
   |
25 |       id-token: write
   |       ^^^^^^^^^^^^^^^ needs an explanatory comment
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/reusable-deploy.yaml:20:3
   |
20 |   deploy:
   |   ^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

7 findings (2 fixable): 1 informational, 2 low, 3 medium, 1 high

$ zizmor --persona auditor .github/workflows/docs.yaml
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows/docs.yaml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/docs.yaml:29:9
   |
29 |         - name: Checkout
   |  _________^
30 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31 | |         with:
32 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[excessive-permissions]: overly broad permissions
  --> .github/workflows/docs.yaml:17:3
   |
17 |   pages: write
   |   ^^^^^^^^^^^^ pages: write is overly broad at the workflow level
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

error[excessive-permissions]: overly broad permissions
  --> .github/workflows/docs.yaml:18:3
   |
18 |   id-token: write
   |   ^^^^^^^^^^^^^^^ id-token: write is overly broad at the workflow level
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

help[undocumented-permissions]: permissions without explanatory comments
  --> .github/workflows/docs.yaml:17:3
   |
17 |   pages: write
   |   ^^^^^^^^^^^^ needs an explanatory comment
18 |   id-token: write
   |   ^^^^^^^^^^^^^^^ needs an explanatory comment
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/docs.yaml:25:3
   |
25 |   build:
   |   ^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/docs.yaml:68:3
   |
68 |   deploy:
   |   ^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

6 findings (1 fixable): 2 informational, 1 low, 1 medium, 2 high

$ zizmor --persona auditor .github/workflows/renovate-cargo-update.yaml
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows/renovate-cargo-update.yaml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/renovate-cargo-update.yaml:18:9
   |
18 |         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
   |  _________^
19 | |         with:
20 | |           ref: ${{ github.head_ref }}
   | |_____________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[excessive-permissions]: overly broad permissions
  --> .github/workflows/renovate-cargo-update.yaml:10:3
   |
10 |   contents: write
   |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

help[undocumented-permissions]: permissions without explanatory comments
  --> .github/workflows/renovate-cargo-update.yaml:10:3
   |
10 |   contents: write
   |   ^^^^^^^^^^^^^^^ needs an explanatory comment
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

error[bot-conditions]: spoofable bot actor check
  --> .github/workflows/renovate-cargo-update.yaml:14:9
   |
13 |   update-and-ci:
   |   ------------- this job
14 |     if: github.actor == 'renovate[bot]'
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ actor context may be spoofable
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#bot-conditions

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/renovate-cargo-update.yaml:13:3
   |
13 |   update-and-ci:
   |   ^^^^^^^^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[concurrency-limits]: insufficient job-level concurrency limits
  --> .github/workflows/renovate-cargo-update.yaml:3:1
   |
 3 | / on:
 4 | |   pull_request:
 5 | |     paths:
 6 | |       - 'Cargo.toml'
 7 | |       - 'apps/blog-api/**/Cargo.toml'
   | |_____________________________________^ workflow is missing concurrency setting
...
13 |     update-and-ci:
   |     ------------- job affected by missing workflow concurrency
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#concurrency-limits

6 findings (2 fixable): 1 informational, 2 low, 1 medium, 2 high

$ zizmor --persona auditor .github/workflows/renovate-apm-update.yaml
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows/renovate-apm-update.yaml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/renovate-apm-update.yaml:20:9
   |
20 |         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
   |  _________^
21 | |         with:
22 | |           ref: ${{ github.head_ref }}
   | |_____________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[excessive-permissions]: overly broad permissions
 --> .github/workflows/renovate-apm-update.yaml:9:3
  |
9 |   contents: write
  |   ^^^^^^^^^^^^^^^ contents: write is overly broad at the workflow level
  |
  = note: audit confidence → High
  = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

help[undocumented-permissions]: permissions without explanatory comments
 --> .github/workflows/renovate-apm-update.yaml:9:3
  |
9 |   contents: write
  |   ^^^^^^^^^^^^^^^ needs an explanatory comment
  |
  = note: audit confidence → High
  = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

error[bot-conditions]: spoofable bot actor check
  --> .github/workflows/renovate-apm-update.yaml:13:9
   |
12 |   update-and-audit:
   |   ---------------- this job
13 |     if: github.actor == 'renovate[bot]'
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ actor context may be spoofable
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#bot-conditions

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/renovate-apm-update.yaml:12:3
   |
12 |   update-and-audit:
   |   ^^^^^^^^^^^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[concurrency-limits]: insufficient job-level concurrency limits
  --> .github/workflows/renovate-apm-update.yaml:3:1
   |
 3 | / on:
 4 | |   pull_request:
 5 | |     paths:
 6 | |       - 'apm.yml'
   | |_________________^ workflow is missing concurrency setting
...
12 |     update-and-audit:
   |     ---------------- job affected by missing workflow concurrency
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#concurrency-limits

6 findings (2 fixable): 1 informational, 2 low, 1 medium, 2 high