fix(zizmor): scan fork PRs in annotation mode instead of skipping - #3
Merged
Conversation
Forward-port of EUDCH/.github#6. Fork PRs get a read-only GITHUB_TOKEN, so the SARIF upload to the Security tab is impossible and the reusable workflow skipped them entirely, leaving external contributors' workflow changes (the highest-risk, most worth scanning) unchecked until after merge. Downgrade fork PRs to annotation mode (advanced-security: false) instead of skipping: findings surface as inline annotations. advanced-security is always forced off on a fork PR, so annotations is enabled for every fork PR without colliding with the mutually-exclusive advanced-security path. The report-vs- block decision matches a same-repo PR: advisory under enforce: false, blocking under enforce: true (and still always blocking for advanced-security: false callers). Non-fork behaviour is byte-identical. zizmor is static analysis and never executes the scanned workflows, so running it on fork content is safe.
There was a problem hiding this comment.
Pull request overview
Updates the reusable .github/workflows/zizmor.yml workflow so fork-based pull requests are analyzed in “annotation mode” instead of being skipped, bringing behavior in line with the referenced upstream org workflow and improving pre-merge coverage for external contributors.
Changes:
- Replace the fork-PR skip gate with fork detection (
IS_FORK_PR) and conditional behavior. - Force
advanced-securityoff and enable inlineannotationsfor fork PRs while preserving non-fork behavior. - Adjust
continue-on-error/ enforcement flow so “report-only” stays advisory on fork PRs, but enforce/blocking modes still block on findings.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward-port of EUDCH/.github#6 (EUDCH/.github#6, merged) so both orgs' reusable zizmor workflows handle fork PRs identically.
Problem
The reusable zizmor workflow skips fork PRs entirely. Because external contributors can only open fork PRs, the population whose workflow changes are most worth scanning gets no pre-merge zizmor coverage; their changes are only scanned on push to
mainafter merge (detection, not prevention).Fix
Don't skip fork PRs — downgrade them to annotation mode (
advanced-security: false, no SARIF upload, findings as inline annotations).advanced-securityis always forced off on a fork PR, soannotationsis enabled for every fork PR (includingadvanced-security: falsecallers) without colliding with the mutually-exclusive advanced-security path.The report-vs-block decision matches what the same change gets on a same-repo PR:
advanced-security: true,enforce: falseadvanced-security: true,enforce: trueadvanced-security: falseNon-fork behaviour is byte-identical. The workflow logic is identical to the merged EUDCH version (only the org name in the usage-example header comment differs). zizmor is static analysis and never executes the scanned workflows, so running it on fork content is safe.
Verification
actionlintclean;zizmor v1.26.1on the edited workflow: no findings.advanced-security: truecallers).