Skip to content

Address zizmor audit reports - #14598

Merged
delucis merged 2 commits into
mainfrom
chris/harden-ci
Sep 22, 2026
Merged

delucis merged 2 commits into
mainfrom
chris/harden-ci

Conversation

@delucis

@delucis delucis commented Sep 22, 2026

Copy link
Copy Markdown
Member

Description (required)

This PR addresses issues reported by Zizmor in https://github.com/withastro/docs/security/code-scanning

  • Avoids any risk of template injection in deploy preview scripts (I think this one was a bit of a technically true but in reality not actually vulnerable one, but still doesn’t hurt to improve it). It switches to use environment variables for strings needed in the scripts as recommended in https://github.com/actions/github-script#passing-inputs-to-the-script
  • Adds a comment to ignore the report about the workflow_run trigger

Uses environment variables for strings needed in the scripts as recommended in https://github.com/actions/github-script#passing-inputs-to-the-script
@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown

Preview deployment

✅ Deployment complete!

@HiDeoo HiDeoo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a small nit up to you, but otherwise the changes look correct to me 👍

Comment thread .github/workflows/deploy-preview.yml Outdated
@delucis
delucis merged commit 492b63f into main Sep 22, 2026
9 checks passed
@delucis
delucis deleted the chris/harden-ci branch September 22, 2026 12:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants