ci: remediate zizmor findings by opentelemetrybot · Pull Request #8592 · open-telemetry/opentelemetry-java

opentelemetrybot · 2026-07-12T04:06:28Z

Tracked in open-telemetry/sig-security#293.

Resolves existing findings from the OpenTelemetry shared workflow.

The workflow:

runs the regular persona on pull requests, pushes to main, release/*, and a randomized weekly schedule;
uploads results to GitHub code scanning;
uses the shared workflow pinned to an immutable commit.

Zizmor remediation

This change also resolves findings from these zizmor rules:

After merge

Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

github-advanced-security · 2026-07-12T04:06:43Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

opentelemetry-pr-dashboard · 2026-07-13T12:46:35Z

Pull request dashboard status

Status last refreshed: 2026-07-21 04:38:34 UTC.

Waiting on: Author
Next step: Move out of draft to request review.

This automated status or its linked feedback items may be incorrect. If something looks wrong, report it with the result you expected.

codecov · 2026-07-13T16:48:28Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.64%. Comparing base (09d6c17) to head (3804041).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #8592   +/-   ##
=========================================
  Coverage     91.64%   91.64%           
  Complexity    10348    10348           
=========================================
  Files          1013     1013           
  Lines         27380    27380           
  Branches       3218     3218           
=========================================
  Hits          25092    25092           
  Misses         1558     1558           
  Partials        730      730

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR adds and hardens GitHub Actions workflows to remediate Zizmor findings (including credential persistence, cache-poisoning, dangerous triggers, and GitHub App token permission scoping), and introduces a dedicated Zizmor workflow that uploads SARIF results to code scanning.

Changes:

Add a repository zizmor workflow using the OpenTelemetry shared workflow pinned to an immutable commit and with least-privilege permissions.
Reduce credential exposure by setting persist-credentials: false on actions/checkout across multiple workflows.
Apply targeted Zizmor remediations (explicit GitHub App token permissions, zizmor: ignore[...] annotations where appropriate, and safer env usage in build commands).

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	New Zizmor workflow wired for PR/push/schedule with SARIF upload permissions and pinned reusable workflow.
.github/workflows/sonatype-guide-dependency-audit-daily.yml	Disable persisted checkout credentials.
.github/workflows/reusable-link-check.yml	Disable persisted checkout credentials.
.github/workflows/release.yml	Disable persisted checkout credentials; tighten GitHub App token permissions; configure git auth for post-release pushes.
.github/workflows/prepare-release-branch.yml	Disable persisted checkout credentials; adjust git auth/token permissions for branch/PR automation.
.github/workflows/prepare-patch-release.yml	Disable persisted checkout credentials; adjust GitHub App token permissions for PR automation.
.github/workflows/javadoc-crawler.yml	Disable persisted checkout credentials.
.github/workflows/issue-management-feedback-label.yml	Disable persisted checkout credentials.
.github/workflows/gradle-wrapper-validation.yml	Disable persisted checkout credentials.
.github/workflows/fossa.yml	Disable persisted checkout credentials.
.github/workflows/detect-api-changes.yml	Document and annotate `pull_request_target` usage; scope GitHub App token permissions.
.github/workflows/codeql.yml	Disable persisted checkout credentials; annotate gradle setup for Zizmor cache-poisoning rule.
.github/workflows/build.yml	Disable persisted checkout credentials; annotate gradle setup; move expression-derived path into env to avoid template-injection concerns.
.github/workflows/build-tracecontext-testsuite.yml	Disable persisted checkout credentials.
.github/workflows/build-daily.yml	Disable persisted checkout credentials.
.github/workflows/benchmark.yml	Disable persisted checkout credentials.
.github/workflows/benchmark-tags.yml	Disable persisted checkout credentials.
.github/workflows/backport.yml	Disable persisted checkout credentials; scope GitHub App token permissions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/prepare-release-branch.yml:78

In create-pull-request-against-release-branch, the workflow now requests an app token with permission-contents: write, but the subsequent step that does git push --set-upstream origin $branch does not re-run gh auth setup-git after switching GH_TOKEN to the app token. With persist-credentials: false, this makes the push rely on whatever git auth state was configured earlier in the job (currently set up using secrets.GITHUB_TOKEN), which can lead to pushes being attributed to GITHUB_TOKEN (and potentially not triggering downstream workflows). Configure git auth in the PR-creation step itself so the push definitely uses the app token.

        with:
          client-id: ${{ vars.OTELBOT_CLIENT_ID }}
          private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

trask · 2026-07-21T04:37:06Z

cc @trask to review first

opentelemetrybot requested a review from a team as a code owner July 12, 2026 04:06

opentelemetry-pr-dashboard Bot mentioned this pull request Jul 12, 2026

Pull Request Dashboard #8439

Open

maryliag reviewed Jul 13, 2026

View reviewed changes

Comment thread .github/workflows/zizmor.yml Outdated

opentelemetrybot changed the title ~~Adopt shared zizmor workflow~~ Add shared zizmor workflow Jul 13, 2026

trask mentioned this pull request Jul 15, 2026

Track organization-wide zizmor rollout open-telemetry/sig-security#293

Open

14 tasks

opentelemetrybot added 10 commits July 20, 2026 19:34

Add shared zizmor workflow

05807ae

Fix blocking zizmor findings

793e219

Add shared zizmor workflow

df9e851

Add trailing newline

997d97e

Clarify CodeQL release branch comment

145fab7

Document zizmor schedule

d542326

Run zizmor on all pull requests

927eaa4

Scan release branch pushes with zizmor

f2415da

Update shared zizmor workflow to v0.4.0

4d91042

ci: remediate zizmor findings

77f553a

opentelemetrybot force-pushed the zizmor-rollout/pilot-20260711 branch from 3319e1b to 77f553a Compare July 21, 2026 02:34

opentelemetrybot changed the title ~~Add shared zizmor workflow~~ ci: remediate zizmor findings Jul 21, 2026

trask requested a review from Copilot July 21, 2026 02:47

Copilot started reviewing on behalf of trask July 21, 2026 02:47 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread .github/workflows/backport.yml

Comment thread .github/workflows/prepare-patch-release.yml

Comment thread .github/workflows/prepare-release-branch.yml

ci: preserve authenticated workflow pushes

f3435d1

trask requested a review from Copilot July 21, 2026 03:07

Copilot started reviewing on behalf of trask July 21, 2026 03:08 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

ci: authenticate release pull request push

8f865cb

trask requested a review from Copilot July 21, 2026 03:28

Copilot started reviewing on behalf of trask July 21, 2026 03:29 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

ci: preserve workflow push credentials

3804041

trask requested a review from Copilot July 21, 2026 03:51

Copilot started reviewing on behalf of trask July 21, 2026 03:52 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

trask marked this pull request as draft July 21, 2026 04:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: remediate zizmor findings#8592

ci: remediate zizmor findings#8592
opentelemetrybot wants to merge 13 commits into
open-telemetry:mainfrom
opentelemetrybot:zizmor-rollout/pilot-20260711

opentelemetrybot commented Jul 12, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Jul 12, 2026

Uh oh!

Uh oh!

opentelemetry-pr-dashboard Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

trask commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

opentelemetrybot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Zizmor remediation

After merge

Uh oh!

github-advanced-security AI commented Jul 12, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

opentelemetry-pr-dashboard Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull request dashboard status

Uh oh!

codecov Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

trask commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

opentelemetrybot commented Jul 12, 2026 •

edited

Loading

opentelemetry-pr-dashboard Bot commented Jul 13, 2026 •

edited

Loading

codecov Bot commented Jul 13, 2026 •

edited

Loading