mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-13 03:42:35 -06:00
Philip Conrad
019086bc3c
This PR contains fixes for all findings by the static analysis tool zizmor, and reduces the attack surface available in our GH Actions workflows by a decent margin. The most notable change: our post-tag workflow now does not use the actions cache, to prevent cache poisoning attacks. This will drive up release publishing times, but eliminates an attack vector on those releases. Other changes: - We also update all of our Slack alerting steps to use the official slackapi/slack-github-action project, instead of the archived project we were using before. - A new `yaml` change detection category to has been added to the `check-changes` job, allowing later jobs and steps in the pull-request workflow to run conditionally on YAML-based changes. - An explicit linting job that runs the zizmor Github Actions static analysis tool on the repo when YAML changes are detected. Signed-off-by: Philip Conrad <philip@chariot-chaser.net>