ci: Resolve most `zizmor` findings as of `zizmor@1.31.1` by hashcatHitman · Pull Request #3045 · rust-lang/rustc-dev-guide

hashcatHitman · 2026-10-07T18:32:10Z

In pursuit of getting more zizmor lints enforced across rust-lang repos through crabwatch, this PR fixes most zizmor findings as of zizmor@1.31.1, using the auditor persona. The lints that actually fired per-persona level are:

regular persona findings:

Fixed in this PR:
Not fixed in this PR:
- None

pedantic persona findings:

Everything from regular
Fixed in this PR:
- 2 additional instances of excessive-permissions (See also: Solve the excessive-permissions lint crabwatch#97)
- template-injection
- undocumented-permissions
Not fixed in this PR:
- anonymous-definition (Because coming up with names is hard and there is minimal benefit to this)
- concurrency-limits (Due to concerns about special cases. See also: Determine special cases for concurrency-limits crabwatch#107)

auditor persona findings:

Everything from pedantic
Not fixed in this PR:
- None

The hash pin format is supported by tools like Dependabot and Renovate, which can update the pinned hashes and their associated comments. If you'd like help setting either of those up, let me know which you prefer, and if you'd like it in this PR or a new one. By default, I would assume to set them up to only update GitHub Actions.

rustbot · 2026-10-07T18:32:14Z

Thanks for the PR. If you have write access, feel free to merge this PR if it does not need reviews. You can request a review using r? rustc-dev-guide or r? <username>.

See: https://rust-lang.zulipchat.com/#narrow/channel/242791-t-infra/topic/josh-sync.20pull.20workflow.20version.20pinning/near/629742031 Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

See: https://github.com/actions/cache/releases/tag/v4.3.0 This is the same version we were already using at the time of writing. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

See: https://github.com/actions/checkout/releases/tag/v7.0.1 This is the same version we were already using at the time of writing. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

See: https://github.com/actions/github-script/releases/tag/v7.1.0 This is the same version we were already using at the time of writing. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

hashcatHitman · 2026-10-22T17:37:31Z

Oops. Guess I can't rename branches when I have a PR open. Noted. Pretend I renamed the branch for this PR to zizmor.

rustbot · 2026-10-22T17:46:39Z

Thanks for the PR. If you have write access, feel free to merge this PR if it does not need reviews. You can request a review using r? rustc-dev-guide or r? <username>.

hashcatHitman · 2026-10-22T17:47:03Z

r? rustc-dev-guide

Kobzol

Thanks! Left two comments.

View changes since this review

Kobzol · 2026-10-26T08:29:04Z

          git config user.email ""
          git add .
          git commit -m "Deploy ${GITHUB_SHA} to gh-pages"
-          git push --quiet -f "https://x-token:${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}" HEAD:gh-pages


Why this change? Is GITHUB_TOKEN even passed as an environment variable by default?

Why this change?

template-injection lint. Even when not necessarily dangerous, zizmor considers template expansions a code smell.

Is GITHUB_TOKEN even passed as an environment variable by default?

I don't think so, but in this case, it was already explicitly put into the environment:

rustc-dev-guide/.github/workflows/ci.yml

Lines 12 to 23 in 6986caf

jobs:

ci:

if: github.repository == 'rust-lang/rustc-dev-guide'

runs-on: ubuntu-latest

env:

MDBOOK_VERSION: 0.5.2

MDBOOK_LINKCHECK2_VERSION: 0.13.0

MDBOOK_MERMAID_VERSION: 0.17.0

MDBOOK_OUTPUT__LINKCHECK__FOLLOW_WEB_LINKS: ${{ github.event_name != 'pull_request' }}

DEPLOY_DIR: book/html

BASE_SHA: ${{ github.event.pull_request.base.sha }}

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

I see. It seems safer to not put it into the environment and only access it through secrets, but I don't know if there is anything else here that might be reading it.

FWIW, I don't like this lint being applied to things that are clearly safe from expansion attacks, such as secrets.GITHUB_TOKEN.

I don't know if there is anything else here that might be reading it.

Yeah, that's the tricky part. There's only so much I can do to test these things on my own (I already accidentally used up all my free minutes for this month doing so, it seems... oops!), so I have to try to err on the side of "not breaking infrastructure".

It seems safer to not put it into the environment and only access it through secrets

I think it isn't really meaningfully safer, though I would definitely prefer the scope be reduced (env for a specific step, rather than the entire job). That suffers the same "I don't know what might be using this already" problem, though.

Ideally, the token only grants read permissions/none at all and is not really a concern regardless for public repos. Which I think is the relationship permissions: {} creates? It's a little unclear how that works.

Kobzol

Thanks!

View changes since this review

rustbot added the S-waiting-on-review Status: this PR is waiting for a reviewer to verify its content label Oct 7, 2026

hashcatHitman added 7 commits October 22, 2026 15:00

ci: Ignore unpinned-uses for josh-sync/rustc-pull

08409d1

See: https://rust-lang.zulipchat.com/#narrow/channel/242791-t-infra/topic/josh-sync.20pull.20workflow.20version.20pinning/near/629742031 Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

ci: Pin actions/cache to 4.3.0 hash

4ff64e4

See: https://github.com/actions/cache/releases/tag/v4.3.0 This is the same version we were already using at the time of writing. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

ci: Pin actions/checkout to 7.0.1 hash

27f1588

See: https://github.com/actions/checkout/releases/tag/v7.0.1 This is the same version we were already using at the time of writing. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

ci: Pin actions/github-script to 7.1.0 hash

59b517f

See: https://github.com/actions/github-script/releases/tag/v7.1.0 This is the same version we were already using at the time of writing. Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

ci: Disable credential persistence

c026b14

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

ci: Prefer shell expansion over template expansion

f8c74dd

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

ci: Disable all permissions by default

9bc273a

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

hashcatHitman marked this pull request as draft October 22, 2026 15:17

rustbot removed the S-waiting-on-review Status: this PR is waiting for a reviewer to verify its content label Oct 22, 2026

hashcatHitman force-pushed the ref-version-mismatch_and_stale-action-refs_and_unpinned-uses branch from 621e147 to f42d3ed Compare October 22, 2026 15:22

ci: Grant minimum required permissions

a688144

Signed-off-by: hashcatHitman <155700084+hashcatHitman@users.noreply.github.com>

hashcatHitman force-pushed the ref-version-mismatch_and_stale-action-refs_and_unpinned-uses branch from f42d3ed to a688144 Compare October 22, 2026 17:34

hashcatHitman closed this Oct 22, 2026

hashcatHitman deleted the ref-version-mismatch_and_stale-action-refs_and_unpinned-uses branch October 22, 2026 17:36

hashcatHitman reopened this Oct 22, 2026

hashcatHitman changed the title ~~ci: Resolve ref-version-mismatch, stale-action-refs, and unpinned-uses~~ ci: Resolve most zizmor findings as of zizmor@1.31.1 Oct 22, 2026

hashcatHitman restored the ref-version-mismatch_and_stale-action-refs_and_unpinned-uses branch October 22, 2026 17:38

hashcatHitman marked this pull request as ready for review October 22, 2026 17:46

rustbot added the S-waiting-on-review Status: this PR is waiting for a reviewer to verify its content label Oct 22, 2026

rustbot assigned BoxyUwU Oct 22, 2026

Kobzol reviewed Oct 26, 2026

View reviewed changes

Kobzol approved these changes Oct 26, 2026

View reviewed changes

Kobzol merged commit 69e3b70 into rust-lang:main Oct 26, 2026
8 checks passed

rustbot removed the S-waiting-on-review Status: this PR is waiting for a reviewer to verify its content label Oct 26, 2026

hashcatHitman mentioned this pull request Oct 26, 2026

ops(rustc-dev-guide): Opt in to 10 new lints rust-lang/crabwatch#115

Merged

hashcatHitman deleted the ref-version-mismatch_and_stale-action-refs_and_unpinned-uses branch October 26, 2026 17:39

hashcatHitman added this to t-crabwatch policy expansion Oct 28, 2026

hashcatHitman moved this to Policy Adjusted in t-crabwatch policy expansion Oct 28, 2026

Navigation Menu

Repository navigation

ci: Resolve most `zizmor` findings as of `zizmor@1.31.1` - #3045

ci: Resolve most `zizmor` findings as of `zizmor@1.31.1`#3045
Kobzol merged 8 commits into
rust-lang:mainfrom
hashcatHitman:ref-version-mismatch_and_stale-action-refs_and_unpinned-uses

hashcatHitman commented Oct 7, 2026 •

edited

Loading

Uh oh!

rustbot commented Oct 7, 2026

Uh oh!

hashcatHitman commented Oct 22, 2026

Uh oh!

rustbot commented Oct 22, 2026

Uh oh!

hashcatHitman commented Oct 22, 2026

Uh oh!

Kobzol left a comment •

edited by rustbot

Loading

Uh oh!

Kobzol Oct 26, 2026

Uh oh!

hashcatHitman Oct 26, 2026

Uh oh!

Kobzol Oct 26, 2026

Uh oh!

hashcatHitman Oct 26, 2026

Uh oh!

Uh oh!

Kobzol left a comment •

edited by rustbot

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	jobs:
	ci:
	if: github.repository == 'rust-lang/rustc-dev-guide'
	runs-on: ubuntu-latest
	env:
	MDBOOK_VERSION: 0.5.2
	MDBOOK_LINKCHECK2_VERSION: 0.13.0
	MDBOOK_MERMAID_VERSION: 0.17.0
	MDBOOK_OUTPUT__LINKCHECK__FOLLOW_WEB_LINKS: ${{ github.event_name != 'pull_request' }}
	DEPLOY_DIR: book/html
	BASE_SHA: ${{ github.event.pull_request.base.sha }}
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Conversation

hashcatHitman commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rustbot commented Oct 7, 2026

Uh oh!

hashcatHitman commented Oct 22, 2026

Uh oh!

rustbot commented Oct 22, 2026

Uh oh!

hashcatHitman commented Oct 22, 2026

Uh oh!

Kobzol left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Kobzol Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

hashcatHitman Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

Kobzol Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

hashcatHitman Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Kobzol left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hashcatHitman commented Oct 7, 2026 •

edited

Loading

Kobzol left a comment •

edited by rustbot

Loading

Kobzol left a comment •

edited by rustbot

Loading