From f05eb87869b766cf099a6c10f9948261ea51c1e9 Mon Sep 17 00:00:00 2001 From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com> Date: Sat, 11 Jul 2026 19:23:02 -0700 Subject: [PATCH 1/8] Add shared zizmor workflow --- .github/workflows/zizmor.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..3bd749a --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,18 @@ +name: Zizmor + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: '53 6 * * 4' + workflow_dispatch: + +permissions: + contents: read + security-events: write + +jobs: + zizmor: + uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1 \ No newline at end of file From 98dd4b223e4df020616c58d62160b18af96cd03d Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Sat, 11 Jul 2026 19:30:29 -0700 Subject: [PATCH 2/8] Fix blocking zizmor findings --- .github/workflows/auto-update-semconv.yml | 2 ++ .github/workflows/codeql.yml | 3 ++- .github/workflows/prepare-release-branch.yml | 2 ++ .github/workflows/release.yml | 1 + 4 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/auto-update-semconv.yml b/.github/workflows/auto-update-semconv.yml index 9e5d0b3..8d1a6c7 100644 --- a/.github/workflows/auto-update-semconv.yml +++ b/.github/workflows/auto-update-semconv.yml @@ -56,6 +56,8 @@ jobs: with: client-id: ${{ vars.OTELBOT_SEMANTIC_CONVENTIONS_JAVA_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_SEMANTIC_CONVENTIONS_JAVA_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cbd2276..1bf11e9 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,7 +38,8 @@ jobs: distribution: temurin java-version: 21 - - name: Set up gradle + # This analyzes release branches but does not build or publish release artifacts. + - name: Set up gradle # zizmor: ignore[cache-poisoning] if: matrix.language == 'java' uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml index e4c93f4..c8bf4b8 100644 --- a/.github/workflows/prepare-release-branch.yml +++ b/.github/workflows/prepare-release-branch.yml @@ -67,6 +67,7 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against the release branch env: @@ -115,6 +116,7 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against main env: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2f63d6c..3b9ef1d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -202,6 +202,7 @@ jobs: with: client-id: ${{ vars.OTELBOT_CLIENT_ID }} private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }} + permission-pull-requests: write - name: Create pull request against main env: From 070f7afff4c4fe33fbb6f06cebffc8844d89c0be Mon Sep 17 00:00:00 2001 From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com> Date: Sat, 11 Jul 2026 20:47:59 -0700 Subject: [PATCH 3/8] Add shared zizmor workflow --- .github/workflows/zizmor.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 3bd749a..b3593af 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -9,10 +9,11 @@ on: - cron: '53 6 * * 4' workflow_dispatch: -permissions: - contents: read - security-events: write +permissions: {} jobs: zizmor: + permissions: + contents: read # for actions/checkout + security-events: write # for zizmor to upload SARIF results uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1 \ No newline at end of file From 879f588914f71a0366514db26e84275b5e177bbc Mon Sep 17 00:00:00 2001 From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com> Date: Sat, 11 Jul 2026 21:42:45 -0700 Subject: [PATCH 4/8] Add trailing newline --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index b3593af..7283733 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -16,4 +16,4 @@ jobs: permissions: contents: read # for actions/checkout security-events: write # for zizmor to upload SARIF results - uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1 \ No newline at end of file + uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1 From cea188d7dd1ba97743f343eb342c050e22190aa7 Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Sat, 11 Jul 2026 22:16:35 -0700 Subject: [PATCH 5/8] Clarify CodeQL release branch comment --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1bf11e9..bc3d6d2 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,7 +38,7 @@ jobs: distribution: temurin java-version: 21 - # This analyzes release branches but does not build or publish release artifacts. + # This workflow analyzes release branches but does not build or publish release artifacts. - name: Set up gradle # zizmor: ignore[cache-poisoning] if: matrix.language == 'java' uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 From 29bc64a7ec590dc3aa1cb64cbb7356b15c7bc81f Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Sun, 12 Jul 2026 18:13:20 -0700 Subject: [PATCH 6/8] Document zizmor schedule --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 7283733..7c9f5e4 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -6,7 +6,7 @@ on: pull_request: branches: [main] schedule: - - cron: '53 6 * * 4' + - cron: '53 6 * * 4' # weekly at 06:53 UTC on Thursday workflow_dispatch: permissions: {} From c39d992ac48d7878ac1b5d6a12807d59a93020f6 Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Sun, 12 Jul 2026 18:26:13 -0700 Subject: [PATCH 7/8] Run zizmor on all pull requests --- .github/workflows/zizmor.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 7c9f5e4..58cbe28 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -4,7 +4,6 @@ on: push: branches: [main] pull_request: - branches: [main] schedule: - cron: '53 6 * * 4' # weekly at 06:53 UTC on Thursday workflow_dispatch: From 736f02550f595f0ed0e1f3dd0dabd297dff2d0ab Mon Sep 17 00:00:00 2001 From: Trask Stalnaker Date: Sun, 12 Jul 2026 18:46:32 -0700 Subject: [PATCH 8/8] Scan release branch pushes with zizmor --- .github/workflows/zizmor.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 58cbe28..198a576 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -2,7 +2,9 @@ name: Zizmor on: push: - branches: [main] + branches: + - main + - release/* pull_request: schedule: - cron: '53 6 * * 4' # weekly at 06:53 UTC on Thursday