root - chore: defense - lint workflows with zizmor by jaredwray · Pull Request #168 · Hyphen/nodejs-sdk

jaredwray · 2026-10-09T21:37:40Z

Summary

This pull request adds a zizmor workflow lint in section 4.

Status

DEFENSE_IN_DEPTH.md: zizmor, checkout credentials, and the release cache → (PR #168 pending). Socket Firewall → PR #167.

Verification

.github/workflows/check-workflows.yaml runs on pull requests and on pushes to main.
The action pins are current. npx actions-up --dry-run reports no updates.
zizmor 1.30.1 reports no findings on the workflows.
A pull request uses annotations. That format fails the job when findings exist.
A push uploads SARIF.
The release job sets package-manager-cache: false. A pnpm cache there makes zizmor fail.
Checkouts that do not push set persist-credentials: false. A persisted credential makes zizmor fail.
Test audit: this pull request adds, changes, or deletes no test.
CI is still running on commit dd78f6a.

Notes

zizmor exits with findings on the workflows before this change. The release cache is a high finding. Credential persistence is a low finding. This pull request fixes both so the new check can pass.
zizmor --format=sarif exits 0 when findings exist. A pull request therefore uses annotations.

Reference

defense-in-depth-nodejs § 4

The new workflow runs zizmor on every pull request. zizmor fails while checkouts persist credentials. zizmor also fails while the release job caches pnpm. Those settings are now fixed. Co-authored-by: Jared Wray <me@jaredwray.com>

chatgpt-codex-connector · 2026-10-09T21:37:53Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T21:41:30.020886Z	`278d8ea`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

The checklist names the open pull request. Co-authored-by: Jared Wray <me@jaredwray.com>

github-advanced-security · 2026-10-09T21:38:02Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

gemini-code-assist

Code Review

This pull request updates the DEFENSE_IN_DEPTH.md checklist to mark the Socket Firewall integration as completed and labels several other security items as pending. A review comment correctly points out a discrepancy: the PR description mentions adding the zizmor workflow lint, but the corresponding workflow file is missing from the changes.

gemini-code-assist · 2026-10-09T21:38:50Z

- [ ] Every job installs Socket Firewall (`SocketDev/action` SHA-pinned, `firewall-version` pinned); `pnpm install` / `npm install` run as `sfw pnpm install` / `sfw npm install` (PR #167 pending)
- [ ] `.github/workflows/check-workflows.yaml` lints workflows with zizmor on every PR
+- [x] Every job installs Socket Firewall (`SocketDev/action` SHA-pinned, `firewall-version` pinned); `pnpm install` / `npm install` run as `sfw pnpm install` / `sfw npm install` — PR #167
+- [ ] `.github/workflows/check-workflows.yaml` lints workflows with zizmor on every PR (PR #168 pending)


The pull request title and description state that this PR adds the zizmor workflow lint (.github/workflows/check-workflows.yaml), but the actual workflow file is missing from the changes in this pull request. Please include the workflow file in this PR, or clarify if this tracking document update is intended to be submitted separately.

The workflow file is in commit 278d8ea. .github/workflows/check-workflows.yaml runs zizmor on every pull request. The zizmor check passed on commit 04e7545. DEFENSE_IN_DEPTH.md line 32 stays open until this pull request merges.

codecov · 2026-10-09T21:40:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f620df3) to head (dd78f6a).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #168   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          639       639           
  Branches       146       151    +5     
=========================================
  Hits           639       639

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 278d8ea043

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-09T21:41:27Z

+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          # Fork PRs cannot upload SARIF (read-only token). Lint with annotations instead.
+          advanced-security: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}


Make zizmor fail when a pull request has findings

On same-repository pull requests, this expression enables Advanced Security. The action documentation states that this mode does not fail when zizmor reports findings. Thus, an unsafe workflow can pass this check unless separate code-scanning merge protection exists. Disable Advanced Security for pull requests, or configure that protection.

Useful? React with 👍 / 👎.

The finding is correct. zizmor --format=sarif exits 0 when findings exist, so Advanced Security does not fail the job. Commit dd78f6a sets advanced-security to false on a pull request and enables annotations. The annotation format exits non-zero when findings exist. A push still uploads SARIF.

chatgpt-codex-connector · 2026-10-09T21:41:27Z

+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read


Replace the comment fragment with a complete sentence

The new SARIF upload. comment has no verb. Replace the fragment with a complete descriptive sentence, as the repository requires.

AGENTS.md reference: AGENTS.md:L24-L24

Useful? React with 👍 / 👎.

The finding is correct. The comment had no verb. Commit dd78f6a replaces it with complete sentences. The SARIF upload needs the permission. GitHub ignores the write grant on a fork pull request.

A pull request sets advanced-security to false. Annotations make the job fail when zizmor reports findings. A push still uploads SARIF. Co-authored-by: Jared Wray <me@jaredwray.com>

ci: lint workflows with zizmor

278d8ea

The new workflow runs zizmor on every pull request. zizmor fails while checkouts persist credentials. zizmor also fails while the release job caches pnpm. Those settings are now fixed. Co-authored-by: Jared Wray <me@jaredwray.com>

docs: record pull request 168 on the zizmor item

04e7545

The checklist names the open pull request. Co-authored-by: Jared Wray <me@jaredwray.com>

gemini-code-assist Bot reviewed Oct 9, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Oct 9, 2026

View reviewed changes

ci: fail the zizmor job on pull request findings

dd78f6a

A pull request sets advanced-security to false. Annotations make the job fail when zizmor reports findings. A push still uploads SARIF. Co-authored-by: Jared Wray <me@jaredwray.com>

jaredwray merged commit c1d7fcd into main Oct 11, 2026
10 checks passed

jaredwray deleted the cursor/defense-actions-zizmor-24d8 branch October 11, 2026 00:38

jaredwray mentioned this pull request Oct 11, 2026

root - chore: defense - use kebab-case workflow names #169

Merged

1 of 2 tasks

Navigation Menu

Repository navigation

root - chore: defense - lint workflows with zizmor - #168

root - chore: defense - lint workflows with zizmor#168
jaredwray merged 3 commits into
mainfrom
cursor/defense-actions-zizmor-24d8

jaredwray commented Oct 9, 2026 •

edited by cursor Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Oct 9, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Oct 9, 2026

Uh oh!

cursor Bot Oct 9, 2026

Uh oh!

codecov Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Uh oh!

cursor Bot Oct 9, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Uh oh!

cursor Bot Oct 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jaredwray commented Oct 9, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Status

Verification

Notes

Reference

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-advanced-security AI commented Oct 9, 2026

What Enabling Code Scanning Means:

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jaredwray commented Oct 9, 2026 •

edited by cursor Bot

Loading

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading

codecov Bot commented Oct 9, 2026 •

edited

Loading