From f775884d63ecf857f8feea8dd2864466979a3258 Mon Sep 17 00:00:00 2001 From: Doug Latornell Date: Fri, 11 Sep 2026 17:14:49 -0700 Subject: [PATCH 1/4] Add empty `permissions` blocks to all GHA workflows Added empty `permissions: {}` blocks to all workflows to prevent unintended/unexpected default permissions from leaking in. This was a recommendation from the zizmor auditor persona. This change aligns the workflows with the latest recommendations for fine-grained permissions configuration. --- .github/workflows/assign-issue-pr.yaml | 3 +++ .github/workflows/sphinx-linkcheck.yaml | 2 ++ 2 files changed, 5 insertions(+) diff --git a/.github/workflows/assign-issue-pr.yaml b/.github/workflows/assign-issue-pr.yaml index 6ffec5c..9b0b5da 100644 --- a/.github/workflows/assign-issue-pr.yaml +++ b/.github/workflows/assign-issue-pr.yaml @@ -1,4 +1,7 @@ name: Assign Issue/PR + +permissions: {} + on: issues: types: diff --git a/.github/workflows/sphinx-linkcheck.yaml b/.github/workflows/sphinx-linkcheck.yaml index db710b3..f54ee45 100644 --- a/.github/workflows/sphinx-linkcheck.yaml +++ b/.github/workflows/sphinx-linkcheck.yaml @@ -1,5 +1,7 @@ name: sphinx-linkcheck +permissions: {} + on: push: branches: ['*'] From 2743f0955d1e93844eeef10fffe2c3724cab9627 Mon Sep 17 00:00:00 2001 From: Doug Latornell Date: Fri, 11 Sep 2026 17:16:08 -0700 Subject: [PATCH 2/4] Make zizmor ignore unpinned uses of our own workflows Annotated `uses` steps in all GitHub Actions workflows that call UBC-MOAD reusable workflows with `zizmor: ignore[unpinned-uses]` comments. This suppresses the auditor warning about unpinned actions and aligns with our current workflow configuration practice of trusting our own workflows. --- .github/workflows/assign-issue-pr.yaml | 2 +- .github/workflows/sphinx-linkcheck.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/assign-issue-pr.yaml b/.github/workflows/assign-issue-pr.yaml index 9b0b5da..c41e949 100644 --- a/.github/workflows/assign-issue-pr.yaml +++ b/.github/workflows/assign-issue-pr.yaml @@ -16,4 +16,4 @@ jobs: permissions: issues: write pull-requests: write - uses: UBC-MOAD/gha-workflows/.github/workflows/auto-assign.yaml@main + uses: UBC-MOAD/gha-workflows/.github/workflows/auto-assign.yaml@main # zizmor: ignore[unpinned-uses] diff --git a/.github/workflows/sphinx-linkcheck.yaml b/.github/workflows/sphinx-linkcheck.yaml index f54ee45..9c5a41d 100644 --- a/.github/workflows/sphinx-linkcheck.yaml +++ b/.github/workflows/sphinx-linkcheck.yaml @@ -16,4 +16,4 @@ jobs: permissions: contents: read - uses: UBC-MOAD/gha-workflows/.github/workflows/pixi-sphinx-linkcheck.yaml@main + uses: UBC-MOAD/gha-workflows/.github/workflows/pixi-sphinx-linkcheck.yaml@main # zizmor: ignore[unpinned-uses] From c6c5aef11e9af4aec71c426cb1feffb404e8e629 Mon Sep 17 00:00:00 2001 From: Doug Latornell Date: Fri, 11 Sep 2026 17:20:07 -0700 Subject: [PATCH 3/4] Annotate GitHub Actions permissions with rationale Added comments explaining the rationale for each `permissions` setting in all GitHub Actions workflows. This improves clarity and aligns with best practices for fine-grained permissions configuration. --- .github/workflows/assign-issue-pr.yaml | 8 ++++++-- .github/workflows/sphinx-linkcheck.yaml | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/assign-issue-pr.yaml b/.github/workflows/assign-issue-pr.yaml index c41e949..989dbb1 100644 --- a/.github/workflows/assign-issue-pr.yaml +++ b/.github/workflows/assign-issue-pr.yaml @@ -1,3 +1,6 @@ +# Automatically assign new or reopened issues and pull requests in this +# repo to Doug + name: Assign Issue/PR permissions: {} @@ -11,9 +14,10 @@ on: types: - reopened - opened + jobs: auto_assign: permissions: - issues: write - pull-requests: write + issues: write # Required to add assignee to issues + pull-requests: write # Required to add assignee to pull requests uses: UBC-MOAD/gha-workflows/.github/workflows/auto-assign.yaml@main # zizmor: ignore[unpinned-uses] diff --git a/.github/workflows/sphinx-linkcheck.yaml b/.github/workflows/sphinx-linkcheck.yaml index 9c5a41d..bb1448b 100644 --- a/.github/workflows/sphinx-linkcheck.yaml +++ b/.github/workflows/sphinx-linkcheck.yaml @@ -14,6 +14,6 @@ on: jobs: sphinx-linkcheck: permissions: - contents: read + contents: read # Required to access the repository contents uses: UBC-MOAD/gha-workflows/.github/workflows/pixi-sphinx-linkcheck.yaml@main # zizmor: ignore[unpinned-uses] From 8580fb2c02038afecef2518d63ae86a0a7aa6da0 Mon Sep 17 00:00:00 2001 From: Doug Latornell Date: Fri, 11 Sep 2026 17:22:02 -0700 Subject: [PATCH 4/4] Add `name` fields to GitHub Actions workflows Updated all workflows to include a meaningful `name` field for each job. This enhances readability and makes the workflow steps easier to understand in the GitHub Actions UI. --- .github/workflows/assign-issue-pr.yaml | 1 + .github/workflows/sphinx-linkcheck.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/assign-issue-pr.yaml b/.github/workflows/assign-issue-pr.yaml index 989dbb1..c10a224 100644 --- a/.github/workflows/assign-issue-pr.yaml +++ b/.github/workflows/assign-issue-pr.yaml @@ -17,6 +17,7 @@ on: jobs: auto_assign: + name: Automatically assign new or reopened issues and pull requests to Doug permissions: issues: write # Required to add assignee to issues pull-requests: write # Required to add assignee to pull requests diff --git a/.github/workflows/sphinx-linkcheck.yaml b/.github/workflows/sphinx-linkcheck.yaml index bb1448b..51ffbba 100644 --- a/.github/workflows/sphinx-linkcheck.yaml +++ b/.github/workflows/sphinx-linkcheck.yaml @@ -13,6 +13,7 @@ on: jobs: sphinx-linkcheck: + name: Sphinx linkcheck permissions: contents: read # Required to access the repository contents