From e70e38ff36c0258098d543f9de6dcef8c69d1cf3 Mon Sep 17 00:00:00 2001
From: wenxin-jiang <wenxin_jiang@outlook.com>
Date: Mon, 14 Sep 2026 11:59:24 -0400
Subject: [PATCH 1/2] Allow audit to read private Patchpedia refs

Use a read-only PR bot token for Patchpedia lookups in depscan.
Keep repository-token authentication for other audit consumers.

Assisted-by: Codex:GPT-6
---
 .github/workflows/audit-gha-workflows.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/audit-gha-workflows.yml b/.github/workflows/audit-gha-workflows.yml
index abd5cf3..1c6df22 100644
--- a/.github/workflows/audit-gha-workflows.yml
+++ b/.github/workflows/audit-gha-workflows.yml
@@ -17,9 +17,22 @@ jobs:
           persist-credentials: false
       - name: Install zizmor
         run: pip install zizmor==1.23.1
+      - name: Create Patchpedia read token
+        if: github.repository == 'SocketDev/depscan'
+        id: patchpedia-token
+        uses: >-
+          actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
+          # The required workflow scans checkout data without executing it.
+          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}  # zizmor: ignore[secrets-outside-env]
+          owner: SocketDev
+          repositories: patchpedia
+          permission-contents: read
       - name: Run zizmor
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: >-
+            ${{ steps.patchpedia-token.outputs.token || secrets.GITHUB_TOKEN }}
         run: |
           if [ -d .github ]; then
             zizmor .github --gh-token "${GITHUB_TOKEN}" --min-severity medium

From c3bedd82a8449f8568575d2e535ec99370d3312b Mon Sep 17 00:00:00 2001
From: wenxin-jiang <wenxin_jiang@outlook.com>
Date: Mon, 14 Sep 2026 12:08:36 -0400
Subject: [PATCH 2/2] Scope patches commit provenance exception

Audit the three depscan patches workflows separately so their
private commit lookup can be omitted without changing other inputs.
Preserve failures from both scans and remove App credentials.

Assisted-by: Codex:GPT-6
---
 .github/workflows/audit-gha-workflows.yml | 48 +++++++++++++++--------
 1 file changed, 32 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/audit-gha-workflows.yml b/.github/workflows/audit-gha-workflows.yml
index 1c6df22..30e2d60 100644
--- a/.github/workflows/audit-gha-workflows.yml
+++ b/.github/workflows/audit-gha-workflows.yml
@@ -17,23 +17,39 @@ jobs:
           persist-credentials: false
       - name: Install zizmor
         run: pip install zizmor==1.23.1
-      - name: Create Patchpedia read token
-        if: github.repository == 'SocketDev/depscan'
-        id: patchpedia-token
-        uses: >-
-          actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
-          # The required workflow scans checkout data without executing it.
-          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}  # zizmor: ignore[secrets-outside-env]
-          owner: SocketDev
-          repositories: patchpedia
-          permission-contents: read
       - name: Run zizmor
         env:
-          GITHUB_TOKEN: >-
-            ${{ steps.patchpedia-token.outputs.token || secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          if [ -d .github ]; then
-            zizmor .github --gh-token "${GITHUB_TOKEN}" --min-severity medium
+          if [ ! -d .github ]; then
+            exit 0
+          fi
+          if [[ "$GITHUB_REPOSITORY" != SocketDev/depscan || ! -f .github/zizmor-patches.yml ]]; then
+            zizmor .github --gh-token "$GITHUB_TOKEN" --min-severity medium
+            exit 0
+          fi
+
+          audit_dir=$(mktemp -d)
+          trap 'rm -rf "$audit_dir"' EXIT
+          cp -R .github "$audit_dir/.github"
+          for config in zizmor.yml zizmor.yaml; do
+            if [ -f "$config" ]; then
+              cp "$config" "$audit_dir/$config"
+            fi
+          done
+          patch_workflows=()
+          for workflow in deploy-patches-staging.yaml deploy-patches-prod.yaml patches-compatibility.yaml; do
+            workflow=".github/workflows/$workflow"
+            if [ -f "$workflow" ]; then
+              patch_workflows+=("$workflow")
+              rm "$audit_dir/$workflow"
+            fi
+          done
+
+          status=0
+          zizmor "$audit_dir/.github" --gh-token "$GITHUB_TOKEN" --min-severity medium || status=$?
+          if [ "${#patch_workflows[@]}" -gt 0 ]; then
+            zizmor "${patch_workflows[@]}" --config .github/zizmor-patches.yml \
+              --gh-token "$GITHUB_TOKEN" --min-severity medium || status=$?
           fi
+          exit "$status"