GitHub Actions workflows have no security issues detected by zizmor

githubactions_workflow_security_scan

Service: githubactionsSeverity: high

OfficialBuilt-inVerified

Categories:software-supply-chain

Resource Type:GitHubActionsWorkflow

Scan GitHub Actions workflow files for security issues such as template injection, excessive permissions, unpinned actions, and other misconfigurations using the zizmor static analysis tool.

Prowler prowler-provider-github

Risk

Insecure GitHub Actions workflows can lead to supply chain attacks, credential theft, code injection, and unauthorized access to repository secrets.

Run this check with Prowler

Run in Prowler Cloud

Run

prowler github --checks githubactions_workflow_security_scan

Recommendation

Review your GitHub Actions workflows for security best practices including pinning actions to commit SHAs, using minimal permissions, avoiding template injection, and securing workflow triggers.

Remediation

Other

1Review and fix the security issues identified by zizmor in your GitHub Actions workflow files.

Check Code

import json
from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.githubactions.githubactions_client import (
    githubactions_client,
)
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class githubactions_workflow_security_scan(Check):
    def execute(self) -> List[CheckReportGithub]:
        findings = []

        if not githubactions_client.scan_enabled:
            return findings

        for repo_id, repo in repository_client.repositories.items():
            repo_findings = githubactions_client.findings.get(repo_id, [])

            if not repo_findings:
                report = CheckReportGithub(
                    metadata=self.metadata(),
                    resource=repo,
                )
                report.status = "PASS"
                report.status_extended = f"Repository {repo.name} has no GitHub Actions workflow security issues detected by zizmor."
                findings.append(report)
            else:
                for f in repo_findings:
                    metadata_dict = {
                        "Provider": "github",
                        "CheckID": f.finding_id,
                        "CheckTitle": f"GitHub Actions workflows free of {f.ident} issues",
                        "CheckType": [],
                        "ServiceName": "githubactions",
                        "SubServiceName": "",
                        "ResourceIdTemplate": "",
                        "Severity": f.severity,
                        "ResourceType": "GitHubActionsWorkflow",
                        "ResourceGroup": "devops",
                        "Description": f.description[:400],
                        "Risk": f.description[:400],
                        "RelatedUrl": "",
                        "Remediation": {
                            "Code": {
                                "CLI": "",
                                "NativeIaC": "",
                                "Other": "",
                                "Terraform": "",
                            },
                            "Recommendation": {
                                "Text": f"Review the zizmor documentation for {f.ident}: {f.url}",
                                "Url": "",
                            },
                        },
                        "Categories": ["software-supply-chain"],
                        "DependsOn": [],
                        "RelatedTo": [],
                        "Notes": "",
                        "AdditionalURLs": [f.url] if f.url else [],
                    }
                    report = CheckReportGithub(
                        metadata=json.dumps(metadata_dict),
                        resource=repo,
                        resource_name=f.workflow_file,
                        resource_id=str(f.repo_id),
                        owner=f.repo_owner,
                    )
                    report.status = "FAIL"
                    report.status_extended = (
                        f"GitHub Actions security issue in {f.workflow_file} at {f.line_range}: "
                        f"{f.description}. "
                        f"Confidence: {f.confidence}. "
                        f"Details: {f.annotation}. "
                        f"URL: {f.workflow_url}"
                    )
                    findings.append(report)

        return findings

References

https://docs.zizmor.sh/