CI: add `zizmor` security scanning for GitHub Actions workflows by Aniketsy · Pull Request #31457 · numpy/numpy

Aniketsy · 2026-05-18T14:39:23Z

PR summary

In this PR we're adding zizmor in the github actions workflow, initial discussion was with @jorenham 😊 and then we had discussion in the numpy community meeting with other members.

First time committer introduction

No, i've contributed before in numpy

AI Disclosure

yes i've took help of llm to fix some errors which i faced during running zizmor locally and rest i've followed from my numtype pr to add zizmor

github-advanced-security · 2026-05-18T14:39:58Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

agriyakhetarpal · 2026-05-18T14:54:39Z

+    permissions:
+      contents: read
+      pull-requests: write


Similar to how you added the top-level permissions: {} in .github/workflows/zizmor.yml, that would be useful in this file (and in all other files as well).

Eh, why? This isn't needed in any other files

I suggested it for consistency with all files and hygiene reasons – just felt odd that one file has permissions: {} at the top level and others don't. Also, permissions: {} is stricter than contents: read, and it's helpful to have for those jobs that don't need to check out user code, such as the labeler, Mypy primer, etc.

It shouldn't be consistent though, mypy_primer_comment and labeler are special. There's no need to add a lot more churn to change nothing in actual permissions in other yaml files.

Co-authored-by: Agriya Khetarpal <74401230+agriyakhetarpal@users.noreply.github.com>

Aniketsy · 2026-05-19T04:20:41Z

@agriyakhetarpal thanks for the review ❤️

rgommers

Thanks @Aniketsy. Adding zizmor in CI seems like a good idea now, I think it improved to the point where most of the UX issues and noise are gone, and it adds some security hardening that is useful.

rgommers · 2026-05-19T08:33:16Z

+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read # Only needed for private repos. Needed to clone the repo.
+      actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.


These two lines can be removed it looks like, given that this is not a private repo.

rgommers · 2026-05-19T08:36:44Z

+      uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+      with:
+        inputs: .github/
+        persona: pedantic


Please make this regular (or, equivalently, remove the line completely). pedantic isn't all that useful, and sometimes annoying - "pedantic" has a negative connotation for a reason.

rgommers · 2026-05-19T08:44:56Z

@@ -0,0 +1,5 @@
+rules:
+  dangerous-triggers:


I suggest to remove this, in favor of a # zizmor: ignore[dangerous-triggers] comment in these two workflow files themselves, with a short justification ("safe: no PR-head checkout, no code execution, only pull-requests: write").

These workflows are currently safe, but there's not a single indication that there's a potential issue there, and future changes to those files can always happen, so a local warning is good.

Plus, it avoids having to update this separate config file in case the line number changes.

rgommers · 2026-05-19T08:45:41Z

+  push:
+    branches: [main]
+  pull_request:
+    branches: ["**"]


The usual pattern is:

branches: - main - maintenance/**

rgommers · 2026-05-19T08:51:12Z

    permissions:
      pull-requests: write  # to add labels
+      contents: read # to read .github/pr-prefix-labeler.yml
+      issues: write # to add labels


This isn't what this action does, it only labels PRs. So I don't think this can be right - please remove this last line.

rgommers · 2026-05-19T08:52:01Z

  steps:
    - name: Extract warnings
      shell: bash
+      env:


I don't mind these changes, but for clarity: there was no issue here.

please let me know , if we should revert these changes

no, fine to keep this change

Aniketsy · 2026-05-20T11:11:36Z

@rgommers thanks for the review 😊 , and sharing pointers, i'll look into the ci- failures shortly.

stefanv · 2026-05-20T18:28:19Z

Still need to make Zizmor pass:

 INFO audit: zizmor: 🌈 completed .github/workflows/zizmor.yml
Error: labeler.yml:3: use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely
Error: linux.yml:441: unpinned image references: container image is unpinned
Error: mypy_primer_comment.yml:4: use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely
Warning: scorecards.yml:28: action's hash pin has mismatched or missing version comment: points to commit 93ea575cb5d8
Warning: scorecards.yml:53: action's hash pin has mismatched or missing version comment: points to commit 807578363a78
Warning: wheels.yml:59: action's hash pin has mismatched or missing version comment: points to commit 06ea2833eef6
Warning: windows.yml:100: action's hash pin has mismatched or missing version comment: points to commit 06ea2833eef6

Approved, since everything seems to be in place, other than those fixes.

Aniketsy · 2026-05-21T11:06:30Z

i've fixed the errors we were getting , do we need to worry about warning?

Warning: scorecards.yml:28: action's hash pin has mismatched or missing version comment: points to commit 93ea575cb5d8
Warning: scorecards.yml:53: action's hash pin has mismatched or missing version comment: points to commit 807578363a78
Warning: wheels.yml:59: action's hash pin has mismatched or missing version comment: points to commit 06ea2833eef6
Warning: windows.yml:100: action's hash pin has mismatched or missing version comment: points to commit 06ea2833eef6

jorenham · 2026-05-21T11:12:02Z

do we need to worry about warning?

The warnings look legitimate, so I'd say so.

Aniketsy · 2026-05-22T03:54:44Z

@jorenham I'm not able to see ci-fail log, do you have any idea for this .

agriyakhetarpal · 2026-05-22T05:56:39Z

Yes, Zizmor is passing now: https://github.com/numpy/numpy/actions/runs/26234123656/job/77202376754?pr=31457. Thanks!

Assuming that the macOS x86-64 conda py3.12 job is what you meant, apparently it just froze while running the test suite; probably a case of GitHub acting up...

rgommers · 2026-05-22T09:31:52Z

      - name: Setup MSVC (32-bit)
        if: ${{ matrix.buildplat[1] == 'win32' }}
-        uses: bus1/cabuild/action/msdevshell@e22aba57d6e74891d059d66501b6b5aed8123c4d  # v1
+        uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe  # v1


Did you manually review all code changes between these SHAs? If not, you shouldn't bump the pin, that defeats part of the purpose of pinning.

Did you manually review all code changes between these SHAs?

no, should i look into this, or revert back changes, i updated as we were getting warning of mismatch sha commit

rgommers · 2026-05-22T09:35:37Z

       # There are few options for i686 images at https://quay.io/organization/pypa,
       # use the glibc2.28 one
-      image: quay.io/pypa/manylinux_2_28_i686
+      image: quay.io/pypa/manylinux_2_28_i686@sha256:817099eabdaf534fd802079ed185b62b97f1fc5e7027db9a14fd7540931819b9


Pinning Docker images is something we haven't done before. It's a tradeoff; there are benefits too, but unless Dependabot bumps these similarly to other pins, it'll probably go out of date. Did you check if those bumps will happen?

but unless Dependabot bumps these similarly to other pins, it'll probably go out of date.

yes, i agree

Did you check if those bumps will happen?

i'll look into this.

@Aniketsy just a gentle ping, would be nice to resolve this and get this in!

@seberg yes, sorry for the delay 😿 , i'll update today , i need to verify and review the code between sha as per review point.

Aniketsy · 2026-06-03T13:52:29Z

i have resolved conflict of this file .github/workflows/scorecards.yml by accepting incoming changes from main ...we're getting Warning: scorecards.yml:53: action's hash pin has mismatched or missing version comment: points to commit 807578363a78

any thoughts on this ?

Aniketsy · 2026-06-04T05:32:07Z

(numpy-dev) C:\Users\Aniket.DESKTOP-074O80J\numpy\numpy>zizmor .github/workflows
 INFO zizmor: 🌈 zizmor v1.24.1
 INFO audit: zizmor: 🌈 completed .github/workflows\circleci.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\codeql.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\compiler_sanitizers.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\cygwin.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\dependency-review.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\emscripten.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\labeler.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\linux-ibm.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\linux.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\linux_blas.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\linux_qemu.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\linux_riscv64.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\linux_simd.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\macos.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\mypy_primer.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\mypy_primer_comment.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\pixi-packages.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\scorecards.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\stubtest.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\typecheck.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\wheels.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\windows.yml
 INFO audit: zizmor: 🌈 completed .github/workflows\zizmor.yml
No findings to report. Good job! (2 ignored, 72 suppressed)

add zizmor in workflow

10f5792

jorenham added the component: CI label May 18, 2026

jorenham requested a review from rgommers May 18, 2026 14:42

agriyakhetarpal reviewed May 18, 2026

View reviewed changes

Update .github/workflows/zizmor.yml

92345b9

Co-authored-by: Agriya Khetarpal <74401230+agriyakhetarpal@users.noreply.github.com>

add top-level permission :{}

8184739

rgommers requested changes May 19, 2026

View reviewed changes

address review comments

979d60e

stefanv approved these changes May 20, 2026

View reviewed changes

fix-format and pin sha

1d5cb3a

Aniketsy and others added 3 commits May 21, 2026 17:03

fix warning

17d18fd

Merge branch 'main' into fix-zizmor

d4f55fa

Update bus1/cabuild msdevshell SHA to latest v1

53b09a4

rgommers reviewed May 22, 2026

View reviewed changes

Merge branch 'main' into fix-zizmor

c0529f1

Aniketsy and others added 2 commits June 4, 2026 10:19

Update CodeQL SARIF upload action version

933a041

track bus1/cabuild updates via Dependabot

94cd24e

Uh oh!

Conversation

Aniketsy commented May 18, 2026

PR summary

First time committer introduction

AI Disclosure

Uh oh!

github-advanced-security AI commented May 18, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Aniketsy commented May 19, 2026

Uh oh!

rgommers left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Aniketsy commented May 20, 2026

Uh oh!

stefanv commented May 20, 2026

Uh oh!

Aniketsy commented May 21, 2026

Uh oh!

jorenham commented May 21, 2026

Uh oh!

Aniketsy commented May 22, 2026

Uh oh!

agriyakhetarpal commented May 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Aniketsy commented Jun 3, 2026

Uh oh!

Aniketsy commented Jun 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants