ci: Add actionlint and zizmor workflow linting by jeffjensen · Pull Request #13 · jeffjensen/java-service-archetype

jeffjensen · 2026-09-10T19:00:15Z

Adds actionlint + zizmor linting for the GitHub Actions workflows, plus the
hardening to pass them clean. Same setup as dbunit/dbunit-extension.

`ci: Add actionlint and zizmor workflow linting`

New Lint workflows workflow — actionlint (schema + shellcheck) and
zizmor (workflow security, run with --strict-collection so a malformed
collected file fails the job), tool versions pinned, on .github/** PRs and a
weekly schedule.
.github/zizmor.yml — tags allowed for actions/* / github/* /
dependabot/*, commit SHA required for anything else.

`ci(dependabot): Add a cooldown before opening update PRs`

Seven-day cooldown on both the Maven and GitHub Actions updaters.

`ci: Harden the GitHub Actions workflows`

Least-privilege permissions: blocks and persist-credentials: false.
Dependency submission moved out of the build job into its own push-to-main
submit-dependencies job, so a contents: write token is never present while
mvn clean verify runs a build of pull-request code.
Move pages: write / id-token: write onto the Pages deploy job.
Guard the workflow_run-triggered jobs with a head_repository check and keep
the head_sha checkout, so they build exactly the tested commit and never
fork-controlled code. dangerous-triggers suppressed with a justification.
Quoted $GITHUB_OUTPUT and $(date …); step outputs routed through env:.
advanced-security/maven-dependency-submission-action pinned to a commit SHA
(v5 → v6.0.1).

Both linters pass clean locally. Merge before the ci/coderabbit-config PR —
that one's .github/** instruction refers to the linting added here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ

Summary by Sourcery

Harden GitHub Actions security and add automated workflow linting.

New Features:

Add automated actionlint and zizmor checks for GitHub Actions configuration changes, scheduled weekly and run on demand.

Bug Fixes:

Prevent workflow-run jobs from processing fork-controlled code by restricting them to successful runs from the current repository.
Separate dependency submission from pull request builds to avoid exposing write permissions during untrusted code execution.

Enhancements:

Harden GitHub Actions workflows with least-privilege permissions, disabled credential persistence, safer output handling, and narrowly scoped deployment permissions.
Require pinned third-party actions and configure approved reference policies for workflow security linting.
Add a seven-day Dependabot cooldown for Maven and GitHub Actions updates.

CI:

Pin workflow linting tools and enforce strict security-lint collection failures.

Summary by CodeRabbit

Security & Reliability
- Strengthened GitHub Actions permissions and credential handling.
- Restricted deployments and dependency submissions to trusted repository runs.
- Pinned workflow actions and added automated checks for workflow security and integrity.
Maintenance
- Added a seven-day cooldown for dependency updates.
- Improved dependency submission and documentation publishing workflow controls.

sourcery-ai · 2026-09-10T19:00:20Z

Reviewer's Guide

Introduces pinned actionlint and zizmor checks for GitHub Actions, then updates the existing CI, deployment, and documentation workflows to satisfy the linters and reduce supply-chain, token, checkout, and shell-injection risks.

Sequence diagram for isolated dependency submission

sequenceDiagram
    participant GitHub
    participant Build as Build any branch
    participant Submit as submit-dependencies
    participant DependencyAPI as GitHub dependency submission

    GitHub->>Build: Trigger workflow
    Build->>Build: actions/checkout@v7 with persist-credentials false
    Build->>Build: mvnw clean verify
    GitHub->>Submit: Run after build on push to main
    Submit->>Submit: actions/checkout@v7 with persist-credentials false
    Submit->>DependencyAPI: advanced-security/maven-dependency-submission-action@a64327a7329c9939cf675e458452febe1894a70c

File-Level Changes

Change	Details	Files
Add automated GitHub Actions workflow linting with pinned tooling and scheduled/targeted execution.	Run actionlint for workflow schema and shell checks. Run zizmor for workflow security analysis with pinned versions and read-only permissions. Configure zizmor policies for acceptable organizational tags, mandatory SHA pinning elsewhere, and documented self-repository exceptions.	`.github/workflows/lint-workflows.yml` `.github/zizmor.yml`
Reduce dependency-update and workflow execution risk through tighter permissions, credential handling, and isolated dependency submission.	Add seven-day Dependabot cooldowns for Maven and GitHub Actions updates. Set workflow and job permissions explicitly, disable checkout credential persistence, and pin the dependency submission action to a commit. Move dependency submission into a separate main-branch-only job with write permissions isolated from pull-request builds.	`.github/dependabot.yml` `.github/workflows/build-any-branch.yml` `.github/workflows/publish-docs.yml`
Harden workflow_run-based publishing and command/output handling while ensuring triggered publishing uses the repository default branch.	Remove triggering-run SHA checkouts from snapshot deployment and documentation publishing. Document and suppress zizmor dangerous-trigger findings based on branch filtering and lack of untrusted artifacts. Quote GitHub output and shell date substitutions, and pass step outputs through environment variables.	`.github/workflows/deploy-snapshot.yml` `.github/workflows/publish-docs.yml`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

coderabbitai · 2026-09-10T19:00:41Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d2949507-6e0d-4c6a-b2c7-b68133ab0cb1

📥 Commits

Reviewing files that changed from the base of the PR and between 4fe2072 and 80724d3.

📒 Files selected for processing (6)

.github/dependabot.yml
.github/workflows/build-any-branch.yml
.github/workflows/deploy-snapshot.yml
.github/workflows/lint-workflows.yml
.github/workflows/publish-docs.yml
.github/zizmor.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The pull request adds Dependabot cooldowns, tightens GitHub Actions permissions, guards workflow_run deployments, pins action dependencies, and adds scheduled actionlint and zizmor checks.

Changes

GitHub workflow hardening

Layer / File(s)	Summary
Dependency and action pinning policy `.github/dependabot.yml`, `.github/zizmor.yml`	Dependabot uses seven-day cooldowns for GitHub Actions and Maven updates. zizmor defines action pinning rules and repository-specific ignores.
Dependency submission permissions `.github/workflows/build-any-branch.yml`	The build job uses `contents: read`. Dependency submission runs in a separate `submit-dependencies` job on pushes to `main` with `contents: write`. Checkout steps disable persisted credentials.
Workflow run deployment guards `.github/workflows/deploy-snapshot.yml`, `.github/workflows/publish-docs.yml`	`workflow_run` jobs require successful runs from the current repository. Job permissions are scoped, checkout credentials are not persisted, and related output values are quoted or passed through environment variables.
Workflow linting `.github/workflows/lint-workflows.yml`	A new workflow runs pinned actionlint and zizmor checks on GitHub configuration changes, on a weekly schedule, and through manual dispatch.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 80724

This PR hardens CI/CD configuration by adding dependency cooldowns, tightening workflow permissions, guarding deployment workflows against fork-originated triggers, and adding automated linting for GitHub Actions workflows. No functional application code is affected, and verification confirmed the security guards (repository-origin checks, scoped permissions, credential handling) are implemented consistently. The change is safe to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding automated actionlint and zizmor workflow linting.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ci/workflow-linting

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sourcery-ai

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/dependabot.yml" line_range="15" />
<code_context>
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7

   - package-ecosystem: maven
</code_context>
<issue_to_address>
**nitpick:** The GitHub Actions updater uses a seven-day cooldown, but the requested configuration requires a three-day cooldown, so Actions update PRs are delayed four days longer than intended.

**Suggested fix:** Set the `github-actions` entry's `default-days` to `3` while keeping the Maven entry at `7`.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. The change alters GitHub Actions trust boundaries and the workflow-run deployment path, including jobs that can publish snapshots to Maven Central or deploy Pages. If the permissions or checkout assumptions are wrong, untrusted workflow code could gain write-capable credentials or incorrect content could be published externally; reverting stops future runs but does not undo a publication already made.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

Reduce the token exposure and shell-injection surface of the workflows without changing what they do: * Move dependency submission out of the build job into its own `submit-dependencies` job that only fires on pushes to main, so the `contents: write` token is never present while `mvn clean verify` runs a build of pull-request code. Set workflow-level `permissions: {}` and move `pages: write` / `id-token: write` off the docs workflow onto its Pages deploy job. * Set `persist-credentials: false` on the checkouts that never reuse the token for a `git` operation. * Drop the `workflow_run` checkout's `ref:` so Deploy Snapshot builds the default branch rather than the triggering commit, which on a `workflow_run` can be a fork's. * Quote `$GITHUB_OUTPUT` and the `$(date ...)` command substitution, and pass the resolved version through `env:` into the run step. * Pin `advanced-security/maven-dependency-submission-action` to a commit SHA; the floating `v5` tag has no matching release tag to name, so this moves to `v6.0.1`. * Record why the `workflow_run` triggers are not exploitable: the branch filter excludes fork PRs, the job checks out the default branch, and it reuses no artifact from the triggering run. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ

Give a bad or compromised release time to be yanked before Dependabot opens a PR for it: a seven-day cooldown on both the Maven and GitHub Actions updaters. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ

Add a "Lint workflows" workflow that runs actionlint (workflow schema plus shellcheck on `run:` scripts) and zizmor (workflow security) on every change under `.github/` and weekly on a schedule. Both tool versions are pinned. `.github/zizmor.yml` accepts tag pins for actions from GitHub's own orgs (`actions/*`, `github/*`, `dependabot/*`) and requires a commit SHA for anything else, and keeps the workspace-relative `./...` action syntax rather than the very recent `$/...` form. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YA7TRsrNp1TPrHn1KD6vnJ

jeffjensen · 2026-09-10T21:45:06Z

@coderabbitai review

coderabbitai · 2026-09-10T21:45:20Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

sourcery-ai Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread .github/dependabot.yml

jeffjensen force-pushed the ci/workflow-linting branch 2 times, most recently from 7ce7692 to 2a524fb Compare September 10, 2026 19:24

jeffjensen and others added 2 commits September 10, 2026 14:25

jeffjensen force-pushed the ci/workflow-linting branch from 2a524fb to 80724d3 Compare September 10, 2026 19:25

jeffjensen merged commit ebbdccc into main Sep 10, 2026
9 checks passed

jeffjensen deleted the ci/workflow-linting branch September 10, 2026 21:52

Navigation Menu

ci: Add actionlint and zizmor workflow linting - #13

ci: Add actionlint and zizmor workflow linting#13
jeffjensen merged 3 commits into
mainfrom
ci/workflow-linting

jeffjensen commented Sep 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

sourcery-ai Bot commented Sep 10, 2026 •

edited

Loading

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

Uh oh!

jeffjensen commented Sep 10, 2026

Uh oh!

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jeffjensen commented Sep 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!