diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index be5fed5650c..c076bda0c7b 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -25,6 +25,7 @@ jobs: with: # history is needed to run git cherry-pick below fetch-depth: 0 + persist-credentials: false - name: Use CLA approved github bot run: .github/scripts/use-cla-approved-bot.sh @@ -34,21 +35,25 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request env: NUMBER: ${{ github.event.inputs.number }} - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows - GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # pull requests from secrets.GITHUB_TOKEN do not run workflows + OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | - commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid) - title=$(gh pr view $NUMBER --json title --jq .title) + gh auth setup-git + commit=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid) + title=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json title --jq .title) branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}" git checkout -b $branch git cherry-pick $commit git push --set-upstream origin $branch - gh pr create --title "[$GITHUB_REF_NAME] $title" \ - --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \ - --base $GITHUB_REF_NAME + GH_TOKEN="$OTELBOT_TOKEN" gh pr create \ + --title "[$GITHUB_REF_NAME] $title" \ + --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \ + --base $GITHUB_REF_NAME diff --git a/.github/workflows/benchmark-tags.yml b/.github/workflows/benchmark-tags.yml index b9c597584b4..88f5596c0e8 100644 --- a/.github/workflows/benchmark-tags.yml +++ b/.github/workflows/benchmark-tags.yml @@ -25,6 +25,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ matrix.tag-version }} + persist-credentials: false - id: setup-java name: Set up Java for build diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index d479e73eb9f..9fa7e6aeb0f 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -28,6 +28,8 @@ jobs: run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - id: setup-java name: Set up Java for build diff --git a/.github/workflows/build-daily.yml b/.github/workflows/build-daily.yml index ce7bcbded10..5a2d8671deb 100644 --- a/.github/workflows/build-daily.yml +++ b/.github/workflows/build-daily.yml @@ -20,6 +20,8 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set up Java uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 diff --git a/.github/workflows/build-tracecontext-testsuite.yml b/.github/workflows/build-tracecontext-testsuite.yml index 39bd88f3c5e..e8cff209db0 100644 --- a/.github/workflows/build-tracecontext-testsuite.yml +++ b/.github/workflows/build-tracecontext-testsuite.yml @@ -21,6 +21,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Login to GitHub package registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8cdf11b7a99..26a8ba90975 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -40,6 +40,8 @@ jobs: jmh-based-tests: true steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - id: setup-java-test name: Set up Java ${{ matrix.test-java-version }} for tests @@ -56,16 +58,19 @@ jobs: distribution: temurin java-version: 21 - - name: Set up gradle + # This tests release branches but does not publish release artifacts. + - name: Set up gradle # zizmor: ignore[cache-poisoning] uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 - name: Build + shell: bash run: > ./gradlew build ${{ matrix.coverage && 'jacocoTestReport' || '' }} -PtestJavaVersion=${{ matrix.test-java-version }} - "-Porg.gradle.java.installations.paths=${{ steps.setup-java-test.outputs.path }}" + "-Porg.gradle.java.installations.paths=${TEST_JAVA_PATH}" "-Porg.gradle.java.installations.auto-download=false" env: + TEST_JAVA_PATH: ${{ steps.setup-java-test.outputs.path }} # JMH-based tests run only if this environment variable is set to true RUN_JMH_BASED_TESTS: ${{ matrix.jmh-based-tests }} DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} @@ -115,6 +120,8 @@ jobs: - 25 # renovate(graal-java-version) steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1.6.3 with: java-version: ${{ matrix.test-graal-version }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1346228c29c..aeca184f912 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set up Java 21 if: matrix.language == 'java' @@ -40,7 +42,8 @@ jobs: distribution: temurin java-version: 21 - - name: Set up gradle + # This workflow analyzes release branches but does not build or publish release artifacts. + - name: Set up gradle # zizmor: ignore[cache-poisoning] if: matrix.language == 'java' uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 diff --git a/.github/workflows/detect-api-changes.yml b/.github/workflows/detect-api-changes.yml index a3fffc04a79..ee84f99fd6b 100644 --- a/.github/workflows/detect-api-changes.yml +++ b/.github/workflows/detect-api-changes.yml @@ -4,10 +4,9 @@ on: # pull_request_target is used instead of pull_request so that the workflow has write access # (to post comments and apply labels) even when triggered by fork PRs. # - # SECURITY: this workflow must never checkout or execute any code from the PR branch. - # Doing so would allow malicious PRs to exfiltrate secrets. All we use from the PR - # is github.event.pull_request.number (an integer), which is safe. - pull_request_target: + # Required to label and comment on fork PRs; no PR code is checked out, and + # the PR number and head ref are passed through env and treated only as data. + pull_request_target: # zizmor: ignore[dangerous-triggers] types: [opened, synchronize, reopened, ready_for_review] permissions: {} @@ -23,6 +22,8 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-issues: write + permission-pull-requests: read - name: Check for API changes and update PR env: diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index 4c6a61a31b4..ef87d73cf84 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0 with: diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml index 62522858c51..6c2dfc7994a 100644 --- a/.github/workflows/gradle-wrapper-validation.yml +++ b/.github/workflows/gradle-wrapper-validation.yml @@ -12,6 +12,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false # this needs to be in its own workflow in order to make OSSF scorecard happy - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 diff --git a/.github/workflows/issue-management-feedback-label.yml b/.github/workflows/issue-management-feedback-label.yml index 56664b31c25..a9b5b4d845d 100644 --- a/.github/workflows/issue-management-feedback-label.yml +++ b/.github/workflows/issue-management-feedback-label.yml @@ -19,6 +19,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Remove labels env: diff --git a/.github/workflows/javadoc-crawler.yml b/.github/workflows/javadoc-crawler.yml index c8665a122da..4d4f5499cf6 100644 --- a/.github/workflows/javadoc-crawler.yml +++ b/.github/workflows/javadoc-crawler.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 with: diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml index 040df74da66..12a48e74689 100644 --- a/.github/workflows/prepare-patch-release.yml +++ b/.github/workflows/prepare-patch-release.yml @@ -12,6 +12,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - run: | if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x$ ]]; then @@ -52,18 +54,22 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows - GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # pull requests from secrets.GITHUB_TOKEN do not run workflows + OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | + gh auth setup-git message="Prepare release $VERSION" branch="otelbot/prepare-release-${VERSION}" git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "[$GITHUB_REF_NAME] $message" \ - --body "$message." \ - --base $GITHUB_REF_NAME + GH_TOKEN="$OTELBOT_TOKEN" gh pr create \ + --title "[$GITHUB_REF_NAME] $message" \ + --body "$message." \ + --base $GITHUB_REF_NAME diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml index d0af0f2b414..b89b36a8fd1 100644 --- a/.github/workflows/prepare-release-branch.yml +++ b/.github/workflows/prepare-release-branch.yml @@ -10,6 +10,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Verify prerequisites run: | @@ -35,9 +37,13 @@ jobs: # history is needed to allow fast-forward push below in case # re-running this workflow after merging additional PRs to main fetch-depth: 0 + persist-credentials: false - name: Create release branch + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | + gh auth setup-git version=$(.github/scripts/get-version.sh) version=${version//-SNAPSHOT/} if [[ $version =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then @@ -68,21 +74,25 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against the release branch env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows - GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # pull requests from secrets.GITHUB_TOKEN do not run workflows + OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | + gh auth setup-git message="Prepare release $VERSION" branch="otelbot/prepare-release-${VERSION}" git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \ - --body "$message." \ - --base $RELEASE_BRANCH_NAME + GH_TOKEN="$OTELBOT_TOKEN" gh pr create \ + --title "[$RELEASE_BRANCH_NAME] $message" \ + --body "$message." \ + --base $RELEASE_BRANCH_NAME create-pull-request-against-main: permissions: @@ -92,6 +102,8 @@ jobs: - prereqs steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set environment variables run: | @@ -124,12 +136,15 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against main env: - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows - GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # pull requests from secrets.GITHUB_TOKEN do not run workflows + OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | + gh auth setup-git message="Update version to $NEXT_VERSION" body="Update version to \`$NEXT_VERSION\`." branch="otelbot/update-version-to-${NEXT_VERSION}" @@ -137,6 +152,7 @@ jobs: git checkout -b $branch git commit -a -m "$message" git push --set-upstream origin $branch - gh pr create --title "$message" \ - --body "$body" \ - --base main + GH_TOKEN="$OTELBOT_TOKEN" gh pr create \ + --title "$message" \ + --body "$body" \ + --base main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 35d9da2b3af..7231a54779c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,6 +22,8 @@ jobs: fi - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 with: @@ -71,6 +73,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: main + persist-credentials: false - name: Check that change log update was merged to main run: | @@ -87,6 +90,7 @@ jobs: with: # tags are needed for the generate-release-contributors.sh script fetch-depth: 0 + persist-credentials: false - name: Generate release notes env: @@ -146,6 +150,8 @@ jobs: # add change log sync (if any) into this PR since the apidiff update # is required before any other PR can be merged anyway - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Copy change log section from release branch env: @@ -157,6 +163,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: main + persist-credentials: false - name: Merge change log to main env: @@ -219,13 +226,16 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against main env: VERSION: ${{ needs.release.outputs.version }} - # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows - GH_TOKEN: ${{ steps.otelbot-token.outputs.token }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # pull requests from secrets.GITHUB_TOKEN do not run workflows + OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }} run: | + gh auth setup-git message="Post-release updates for $VERSION" body="Post-release updates for \`$VERSION\`." branch="otelbot/post-release-updates-${VERSION}" @@ -233,6 +243,7 @@ jobs: git checkout -b $branch git commit -m "$message" git push --set-upstream origin $branch - gh pr create --title "$message" \ - --body "$body" \ - --base main + GH_TOKEN="$OTELBOT_TOKEN" gh pr create \ + --title "$message" \ + --body "$body" \ + --base main diff --git a/.github/workflows/reusable-link-check.yml b/.github/workflows/reusable-link-check.yml index 59fc7dcac7b..0af1e753659 100644 --- a/.github/workflows/reusable-link-check.yml +++ b/.github/workflows/reusable-link-check.yml @@ -13,6 +13,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # needed for merge-base used in modified-files mode + persist-credentials: false - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 diff --git a/.github/workflows/sonatype-guide-dependency-audit-daily.yml b/.github/workflows/sonatype-guide-dependency-audit-daily.yml index a09c000579f..ee3512c0067 100644 --- a/.github/workflows/sonatype-guide-dependency-audit-daily.yml +++ b/.github/workflows/sonatype-guide-dependency-audit-daily.yml @@ -17,6 +17,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 with: diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000000..d97b5797db1 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,20 @@ +name: Zizmor + +on: + push: + branches: + - main + - release/* + pull_request: + schedule: + - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday + workflow_dispatch: + +permissions: {} + +jobs: + zizmor: + permissions: + contents: read # for actions/checkout + security-events: write # for zizmor to upload SARIF results + uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0