Merge pull request #481 from vechain/fix/zizmor-security-fixes-20251110-101130

mikeredmond · web-flow · commit 6311fd7f5a88 · 2025-11-11T10:29:04.000Z
[zizmor] Security fixes for workflow vulnerabilities
diff --git a/.github/workflows/deploy-api-lambda.yaml b/.github/workflows/deploy-api-lambda.yaml
@@ -20,13 +20,13 @@ jobs:
           uses: actions/checkout@v4
 
         - name: Configure AWS credentials
-          uses: aws-actions/configure-aws-credentials@v4
+          uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
           with:
               role-to-assume: ${{ secrets.AWS_ACC_ROLE }}
               aws-region: ${{ env.AWS_REGION }}
 
         - name: Setup SAM CLI
-          uses: aws-actions/setup-sam@v2
+          uses: aws-actions/setup-sam@c71dd89d980e49367c70391e8ada4353f52f2800 # v2
           with:
               use-installer: true
               token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/deploy-cloudfront.yaml b/.github/workflows/deploy-cloudfront.yaml
@@ -50,7 +50,7 @@ jobs:
                   done
 
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
               with:
                   role-to-assume: ${{ secrets.AWS_ACC_ROLE }}
                   aws-region: ${{ env.AWS_REGION }}
diff --git a/.github/workflows/deploy-preview.yaml b/.github/workflows/deploy-preview.yaml
@@ -1,19 +1,51 @@
 name: Deploy Preview Environment
 
 on:
-    pull_request_target:
+    pull_request_target:  # zizmor: ignore[dangerous-triggers] - Mitigated with label-based approval
+        types: [labeled, synchronize, opened, reopened]
         branches:
             - main
         paths: ['examples/homepage/**', 'packages/vechain-kit/**', 'yarn.lock']
 
 permissions:
     contents: read
-    id-token: write
-    pull-requests: write
 
 jobs:
+    # Job 1: Post instruction comment for external PRs
+    comment-external-pr:
+        runs-on: ubuntu-latest
+        permissions:
+            pull-requests: write
+        if: |
+            github.event.pull_request.head.repo.full_name != github.repository &&
+            github.event.action == 'opened'
+        steps:
+            - name: Comment on external PR
+              uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+              with:
+                  issue-number: ${{ github.event.pull_request.number }}
+                  body: |
+                      ## 👋 Thanks for your contribution!
+                      
+                      Since this PR comes from a forked repository, preview deployment requires approval from a maintainer for security reasons.
+                      
+                      **Next steps:**
+                      1. A maintainer will review your code
+                      2. If approved, they'll add the `safe-to-deploy` label to trigger deployment
+                      3. **After each new commit**, the maintainer will need to remove and re-add the label for security
+                      
+                      This ensures every version of the code is explicitly reviewed before deployment. Thank you for your patience! 🙏
+
+    # Job 2: Deploy (runs for internal PRs OR when external PR gets labeled)
     deploy:
         runs-on: ubuntu-latest
+        permissions:
+            id-token: write
+            pull-requests: write
+        # Security gate: Only run when 'safe-to-deploy' label is ADDED OR from internal branch
+        if: |
+            (github.event.label.name == 'safe-to-deploy') ||
+            (github.event.pull_request.head.repo.full_name == github.repository)
         env:
             NEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID: ${{ secrets.NEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID }}
             NEXT_PUBLIC_PRIVY_APP_ID: ${{ secrets.NEXT_PUBLIC_PRIVY_APP_ID }}
@@ -34,11 +66,12 @@ jobs:
               run: |
                   sanitized_branch_name=$(echo "$BRANCH_NAME" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]//g')
                   echo "processedBranchName=$sanitized_branch_name" >> $GITHUB_OUTPUT
-                  echo "NEXT_PUBLIC_BASE_PATH=/$sanitized_branch_name" >> $GITHUB_ENV
+                  echo "basePath=/$sanitized_branch_name" >> $GITHUB_OUTPUT
 
             - name: Build App
               env:
                   NODE_OPTIONS: '--max-old-space-size=8192'
+                  NEXT_PUBLIC_BASE_PATH: ${{ steps.process-branch-name.outputs.basePath }}
               run: |
                   yarn install
                   yarn install:all
@@ -51,7 +84,7 @@ jobs:
                   done
 
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
               with:
                   role-to-assume: ${{ secrets.AWS_ACC_ROLE }}
                   aws-region: ${{ env.AWS_REGION }}
@@ -65,7 +98,6 @@ jobs:
                   AWS_MAX_ATTEMPTS=10 aws cloudfront create-invalidation --distribution-id ${{ secrets.AWS_PREVIEW_CLOUDFRONT_DISTRIBUTION_ID }} --paths '/' '/*'
 
             - name: Create Deployment Comment
-              if: github.event.action == 'opened' || github.event.action == 'reopened'
               uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
               with:
                   issue-number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/destroy-preview-env.yaml b/.github/workflows/destroy-preview-env.yaml
@@ -19,7 +19,7 @@ jobs:
       BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ secrets.AWS_ACC_ROLE }}
           aws-region: eu-west-1
diff --git a/.github/workflows/publish-vechain-kit.yaml b/.github/workflows/publish-vechain-kit.yaml
@@ -7,12 +7,13 @@ on:
 
 permissions:
     contents: read
-    packages: write
-    id-token: write # Required for OIDC
 
 jobs:
     publish-to-github-packages:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            packages: write
         steps:
             - uses: actions/checkout@v4
               with:
@@ -36,13 +37,16 @@ jobs:
             - name: Publish VeChain-Kit to GitHub Packages
               run: |
                   cd packages/vechain-kit
-                  yarn version --immediate ${{ github.ref_name }}
+                  yarn version --immediate ${GITHUB_REF_NAME}
                   npm publish --tag latest
               env:
                   NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     publish-to-npmjs:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
         steps:
             - uses: actions/checkout@v4
               with:
@@ -66,5 +70,5 @@ jobs:
             - name: Publish VeChain-Kit to npmjs.org
               run: |
                   cd packages/vechain-kit
-                  yarn version --immediate ${{ github.ref_name }}
+                  yarn version --immediate ${GITHUB_REF_NAME}
                   npm publish --tag latest
diff --git a/.github/workflows/scan-workflows.yaml b/.github/workflows/scan-workflows.yaml
@@ -11,10 +11,11 @@ permissions: {}
 
 jobs:
   zizmor:
-    uses: vechain/github-actions-public/.github/workflows/scan-workflows.yaml@cf384c612d562dbc17022d23ed094751e92921e5 # v.1.0.0
+    uses: vechain/github-actions-public/.github/workflows/scan-workflows.yaml@77660aeff2fac9bbb704b3a2ce786814d0b632fa # v.1.1.0
     with:
       persona: 'auditor'
       min_severity: 'medium'
+      min_confidence: 'high'
     permissions:
       contents: read
       actions: read
diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml
@@ -4,7 +4,7 @@ on:
     push:
         branches:
             - main
-    pull_request_target:
+    pull_request:
 
 jobs:
     sonar-scan:
@@ -25,7 +25,7 @@ jobs:
                   restore-keys: ${{ runner.os }}-sonar
 
             - name: SonarCloud Scan
-              uses: sonarsource/sonarcloud-github-action@master
+              uses: sonarsource/sonarcloud-github-action@ba3875ecf642b2129de2b589510c81a8b53dbf4e # master
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
