| 1 | # Zizmor Baseline |
| 2 | |
| 3 | > Issue: jmservera/SquadScope#542 (Phase A) · jmservera/SquadScope#543 (Phase B fixes) |
| 4 | > Epic: jmservera/SquadScope-Coordinator#33 |
| 5 | > Status: **Phase B complete** for High-severity — 0 high/medium findings; CI |
| 6 | > (default persona) is clean. Remaining pedantic info/low items are documented below. |
| 7 | |
| 8 | [zizmor](https://github.com/zizmorcore/zizmor) audits GitHub Actions workflows |
| 9 | for supply-chain risks (template injection, dangerous triggers, unpinned actions, |
| 10 | excessive permissions). It **already exists** in |
| 11 | `.github/workflows/security-scanning.yml` (`zizmorcore/zizmor-action`). This task |
| 12 | normalizes it to the Phase-A contract — it does **not** recreate the job. |
| 13 | |
| 14 | ## CI wiring (confirmed) |
| 15 | |
| 16 | - **Job:** `zizmor-scan` in `.github/workflows/security-scanning.yml`. |
| 17 | - **Triggers:** push + pull_request to `main`/`dev` — so it runs on any change to |
| 18 | `.github/workflows/`. |
| 19 | - **Non-blocking:** `continue-on-error: true` (Phase A warning-only). |
| 20 | - **SARIF / annotations:** `advanced-security: true` uploads SARIF to GitHub Code |
| 21 | Scanning automatically. |
| 22 | - **Scope:** all repository-owned workflows, excluding generated `squad-*` and |
| 23 | `sync-squad-labels` files. |
| 24 | |
| 25 | ## Baseline snapshot |
| 26 | |
| 27 | - **Tool:** zizmor 1.25.2 |
| 28 | - **Date:** 2026-06-26 |
| 29 | - **Scope:** repo-owned workflows (Squad-generated files excluded) |
| 30 | |
| 31 | ### Default (`regular`) persona — what CI surfaces today |
| 32 | |
| 33 | **0 actionable findings** (7 ignored, 42 suppressed). The Phase-A gate is green |
| 34 | on the default persona; the action focuses on P0 findings (template-injection, |
| 35 | dangerous-triggers), of which there are none. |
| 36 | |
| 37 | ### Deep (`pedantic`) persona — Phase B progress |
| 38 | |
| 39 | | Rule | Severity | Phase A | Now | Phase B resolution | |
| 40 | |------|----------|--------:|----:|--------------------| |
| 41 | | excessive-permissions | High | 4 | **0** | Moved workflow-level write `permissions:` to job level (`copilot-pricing-review`, `restore-publish-backup`, `sync-publish-to-main`) | |
| 42 | | concurrency-limits | Low | 3 | **0** | Added workflow `concurrency:` groups (`copilot-pricing-review`, `podcaster-handoff-smoke`, `trigger-podcast`) | |
| 43 | | undocumented-permissions | Low | 14 | 12 | Documented the scoped write perms that were fixed; remainder are explanatory-comment nits in `crawl-and-publish.yml`, `deploy-site.yml`, `security-scanning.yml`, `checkov.yml` | |
| 44 | | anonymous-definition | Informational | 15 | 15 | Deferred — naming jobs in large generated/complex workflows; no security impact | |
| 45 | |
| 46 | All **High** findings are resolved. The default (`regular`) persona that CI |
| 47 | enforces reports **no findings**, so the Phase-C blocking flip is safe. |
| 48 | |
| 49 | ### Deferred (pedantic info/low, no CI impact) |
| 50 | |
| 51 | - `undocumented-permissions` (Low ×12) — add explanatory comments next to |
| 52 | remaining `permissions:` blocks. |
| 53 | - `anonymous-definition` (Informational ×15) — add `name:` to jobs in |
| 54 | `crawl-and-publish.yml` and peers. |
| 55 | |
| 56 | These are documentation/hardening nits surfaced only by `--persona pedantic`; |
| 57 | they do not affect the default-persona CI gate. |
| 58 | |
| 59 | ## Running locally |
| 60 | |
| 61 | ```bash |
| 62 | # Install (matches the action's toolchain family) |
| 63 | pipx install zizmor # or: pip install zizmor |
| 64 | |
| 65 | # Default persona (what CI reports) |
| 66 | zizmor .github/workflows/ |
| 67 | |
| 68 | # Deeper audit used to build the Phase-B backlog |
| 69 | zizmor --persona pedantic .github/workflows/ |
| 70 | |
| 71 | # Mirror the CI input set (exclude generated Squad workflows) |
| 72 | zizmor $(find .github/workflows -maxdepth 1 -type f \ |
| 73 | \( -name "*.yml" -o -name "*.yaml" \) \ |
| 74 | ! -name "squad-*.yml" ! -name "sync-squad-labels.yml" | sort) |
| 75 | ``` |
| 76 | |
| 77 | ## Phase plan |
| 78 | |
| 79 | - **Phase A:** confirm non-blocking + SARIF wiring; record baseline. ✅ |
| 80 | - **Phase B:** fix High-severity excessive-permissions + concurrency-limits. ✅ (info/low nits deferred above) |
| 81 | - **Phase C:** blocking enforcement (#545). ✅ Dropped `continue-on-error` on the |
| 82 | `zizmor-scan` job; default-persona findings now fail the build. Mark it required. |