From 8075958891cfa83206385d76f34cf9504eb473af Mon Sep 17 00:00:00 2001 From: Morgan Chen Date: Fri, 26 Jun 2026 15:51:36 -0700 Subject: [PATCH 1/4] chore(ci): Fix zizmor security findings in workflows Resolved findings flagged by zizmor: - Added explicit global `contents: read` permissions to `ci.yml`, `nightly.yml`, and `release.yml`. - Configured checkouts to set `persist-credentials: false` in `ci.yml`, `nightly.yml`, and the staging phase of `release.yml`. - Added explicit `persist-credentials: true` with a `# zizmor: ignore[artipacked]` comment to the checkout step in the publishing phase of `release.yml`, where credentials are required for git commands inside `publish_preflight_check.sh`. --- .github/workflows/ci.yml | 7 +++++++ .github/workflows/nightly.yml | 4 ++++ .github/workflows/release.yml | 8 ++++++++ 3 files changed, 19 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5bf78a56..f995f8d7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,9 @@ name: Continuous Integration on: pull_request +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest @@ -12,6 +15,8 @@ jobs: steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + with: + persist-credentials: false - name: Set up Python 3.13 for emulator uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 @@ -53,6 +58,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + with: + persist-credentials: false - name: Set up Python 3.9 uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 with: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index d60b3cd0..3a9d14c7 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -22,6 +22,9 @@ on: repository_dispatch: types: [firebase_nightly_build] +permissions: + contents: read + jobs: nightly: @@ -32,6 +35,7 @@ jobs: uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 with: ref: ${{ github.event.client_payload.ref || github.ref }} + persist-credentials: false - name: Set up Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6bbf19aa..aaab4c8d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,6 +32,9 @@ on: types: - firebase_build +permissions: + contents: read + jobs: stage_release: # To publish a release, merge a PR with the title prefix '[chore] Release ' to main @@ -47,6 +50,8 @@ jobs: steps: - name: Checkout source for staging uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 @@ -106,6 +111,9 @@ jobs: steps: - name: Checkout source for publish uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + with: + # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow. + persist-credentials: true # zizmor: ignore[artipacked] # Download the artifacts created by the stage_release job. - name: Download release candidates From 4895a0503b70b061c2ab928469d03e3d04d3ed35 Mon Sep 17 00:00:00 2001 From: Morgan Chen Date: Thu, 9 Jul 2026 09:31:05 -0700 Subject: [PATCH 2/4] chore(deps): Bump actions/checkout to v7.0.0 and actions/setup-python to v6.3.0 --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/nightly.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f995f8d7..10d1a682 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,12 +14,12 @@ jobs: python: ['3.9', '3.10', '3.11', '3.12', '3.13', 'pypy3.9'] steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Set up Python 3.13 for emulator - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.13' - name: Setup functions emulator environment @@ -29,7 +29,7 @@ jobs: pip install -r integration/emulators/functions/requirements.txt deactivate - name: Set up Python ${{ matrix.python }} - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python }} - name: Install dependencies @@ -57,11 +57,11 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Set up Python 3.9 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: 3.9 - name: Install dependencies diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 3a9d14c7..57240b23 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -32,13 +32,13 @@ jobs: steps: - name: Checkout source for staging - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.event.client_payload.ref || github.ref }} persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: 3.9 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index aaab4c8d..510a1352 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -49,12 +49,12 @@ jobs: steps: - name: Checkout source for staging - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # 5.6.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: 3.9 @@ -110,7 +110,7 @@ jobs: steps: - name: Checkout source for publish - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # 4.3.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # Ignored since the GITHUB_TOKEN needs to be persisted for this workflow. persist-credentials: true # zizmor: ignore[artipacked] From 391c8d1cfd58fd67e104245c7874c86ee50ad80f Mon Sep 17 00:00:00 2001 From: Morgan Chen Date: Thu, 9 Jul 2026 09:35:37 -0700 Subject: [PATCH 3/4] bump setup-java and setup-node --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 10d1a682..fe92c0fc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,11 +39,11 @@ jobs: - name: Test with pytest run: pytest - name: Set up Node.js 20 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # 6.4.0 with: node-version: 20 - name: Set up Java 21 - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # 5.1.0 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # 5.5.0 with: distribution: 'temurin' java-version: '21' From d73d0d7b19773794cd98547f18537b2a8e161840 Mon Sep 17 00:00:00 2001 From: Morgan Chen Date: Thu, 9 Jul 2026 09:43:47 -0700 Subject: [PATCH 4/4] add missing --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fe92c0fc..32ef50ae 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,11 +39,11 @@ jobs: - name: Test with pytest run: pytest - name: Set up Node.js 20 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # 6.4.0 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 20 - name: Set up Java 21 - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # 5.5.0 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 with: distribution: 'temurin' java-version: '21'