Add zizmor security auditing

.github/workflows/build.yml

@@ -7,6 +7,10 @@ on:
   workflow_call:
   workflow_dispatch:
 
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
@@ -80,6 +84,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: marcelotduarte/python-msilib
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -90,14 +95,17 @@ jobs:
         with:
           activate-environment: true
           cache-dependency-glob: "pyproject.toml"
-          enable-cache: true
+          enable-cache: false
 
       - name: Bump new dev version
         if: github.event_name != 'release'
         run: ./ci/bump-version.sh build-dev
 
       - name: Build sdist and wheels
-        run: ./ci/build-wheel.sh "${{ matrix.tag }}"
+        run: ./ci/build-wheel.sh "${MATRIX_TAG}"
+        env:
+          BUILD_SDIST: true
+          MATRIX_TAG: ${{ matrix.tag }}
 
       - name: Upload the artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -114,7 +122,7 @@ jobs:
       name: pypi
       url: https://pypi.org/p/python-msilib
     permissions:
-      id-token: write
+      id-token: write # MANDATORY: Required for OIDC Trusted Publishing
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)

.github/workflows/ci.yml

@@ -11,8 +11,15 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   pre_commit:
+    name: Pre commit
+    permissions:
+      contents: write # Required for pre-commit-ci lite
+      id-token: write # Required for pre-commit-ci lite
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -21,6 +28,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: j178/prek-action@e98a699c41eb69ab013a45817a0406469a748f8d # v2.0.5
         with:
@@ -30,6 +39,7 @@ jobs:
         if: always()
 
   type_check:
+    name: Type check
     runs-on: ${{ matrix.os }}-${{ matrix.os_version }}
     strategy:
       fail-fast: false
@@ -49,6 +59,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
         with:
@@ -57,17 +69,20 @@ jobs:
           enable-cache: true
 
       - name: Install dependencies
-        run: ci/install-tools.sh --dev --tests
+        run: ci/install-tools.sh --tests
 
       - name: Type check
-        run: ty check
+        run: uv check --quiet --preview-features=check-command --no-sync
 
   build_wheel:
     name: Build wheels
     uses: ./.github/workflows/build.yml
     needs:
       - pre_commit
       - type_check
+    permissions:
+      contents: read
+      id-token: write # Required for nested job 'publish'
 
   testpypi:
     name: Publish package to TestPyPI
@@ -80,7 +95,7 @@ jobs:
       name: ${{ github.event_name }}
       url: https://test.pypi.org/p/python-msilib
     permissions:
-      id-token: write
+      id-token: write # MANDATORY: Required for OIDC Trusted Publishing
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -104,6 +119,7 @@ jobs:
           verbose: true
 
   tests:
+    name: Run tests
     needs:
       - build_wheel
     runs-on: ${{ matrix.os }}-${{ matrix.os-version }}
@@ -133,6 +149,7 @@ jobs:
           sparse-checkout: |
             pyproject.toml
             tests
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -152,9 +169,11 @@ jobs:
           pattern: python-msilib-wheel-${{ matrix.os }}*
           path: wheelhouse
 
-      - name: Install dependencies
+      - name: Install dependencies to test
+        run: uv pip install -r pyproject.toml --upgrade --group tests
+
+      - name: Install python-msilib from wheelhouse
         run: |
-          uv pip install -r pyproject.toml --upgrade --group tests
           uv pip install python-msilib -f wheelhouse \
               --no-build --no-deps --no-index --prerelease=allow --reinstall
 
@@ -169,12 +188,12 @@ jobs:
           include-hidden-files: true
 
   coverage:
+    name: Coverage
     needs:
       - tests
     permissions:
-      actions: read
-      contents: write
-      pull-requests: write
+      contents: write # Required for editing existing comments.
+      pull-requests: write # Required for publishing new comments in pull requests.
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -196,7 +215,7 @@ jobs:
         id: coverage_comment
         uses: py-cov-action/python-coverage-comment-action@5d8df5979747514c914e1c5a12335a7cf9a2745f # v4.1
         with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           MERGE_COVERAGE_FILES: true
 
       - name: Store Pull Request comment to be posted

.github/workflows/codeql.yml

@@ -20,6 +20,10 @@ on:
   schedule:
     - cron: "0 0 * * 1"
 
+concurrency:
+  group: sec-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
@@ -28,9 +32,9 @@ jobs:
     name: Analyze
     runs-on: ubuntu-latest
     permissions:
-      actions: read
+      actions: read # MANDATORY
       contents: read
-      security-events: write
+      security-events: write # Needed to upload the results to code-scanning dashboard.
 
     strategy:
       fail-fast: false
@@ -47,6 +51,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/coverage.yml

@@ -1,11 +1,19 @@
 name: Post coverage comment
 
-on:
+# We're using workflow_run to post a coverage comment on external PRs. This is
+# safe because we don't checkout the external code or interact with the
+# external code in any way but extracting an artifact containing the comment to
+# post, and post it.
+on: # zizmor: ignore[dangerous-triggers]
   workflow_run:
     workflows: ["CI"]
     types:
       - completed
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
@@ -15,16 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
     permissions:
-      # Gives the action the necessary permissions for publishing new
-      # comments in pull requests.
-      pull-requests: write
-      # Gives the action the necessary permissions for editing existing
-      # comments (to avoid publishing multiple comments in the same PR)
-      contents: write
+      pull-requests: write # Required for publishing new comments in pull requests.
+      # Avoid publishing multiple comments in the same PR.
+      contents: write # Required for editing existing comments.
       # Gives the action the necessary permissions for looking up the
       # workflow that launched this workflow, and download the related
       # artifact that contains the comment to be published
-      actions: read
+      actions: read # Required
     steps:
       # DO NOT run actions/checkout here, for security reasons
       # For details, refer to https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
@@ -36,7 +41,7 @@ jobs:
       - name: Post comment
         uses: py-cov-action/python-coverage-comment-action@5d8df5979747514c914e1c5a12335a7cf9a2745f # v4.1
         with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           GITHUB_PR_RUN_ID: ${{ github.event.workflow_run.id }}
           MINIMUM_GREEN: 80
           MINIMUM_ORANGE: 50

.github/workflows/dependency-review.yml

@@ -9,11 +9,16 @@
 name: Dependency Review
 on: [pull_request]
 
+concurrency:
+  group: sec-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   dependency-review:
+    name: Dependency Review
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -23,5 +28,8 @@ jobs:
 
       - name: Checkout Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/scorecards.yml

@@ -14,25 +14,24 @@ on:
   push:
     branches: ["main"]
 
-# Declare default permissions as read only.
-permissions: read-all
+concurrency:
+  group: sec-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions: {}
 
 jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
-      # Needed to upload the results to code-scanning dashboard.
-      security-events: write
-      # Needed to publish results and get a badge (see publish_results below).
-      id-token: write
+      security-events: write # Needed to upload the results to code-scanning dashboard.
+      id-token: write # Needed to publish results and get a badge (see publish_results below).
       contents: read
-      actions: read
-      # To allow GraphQL ListCommits to work
-      issues: read
-      pull-requests: read
-      # To detect SAST tools
-      checks: read
+      actions: read # MANDATORY
+      issues: read # To allow GraphQL ListCommits to work
+      pull-requests: read # MANDATORY
+      checks: read # To detect SAST tools
 
     steps:
       - name: Harden the runner (Audit all outbound calls)

.gitignore

@@ -87,24 +87,24 @@ ipython_config.py
 #   However, in case of collaboration, if having platform-specific dependencies or dependencies
 #   having no cross-platform support, pipenv may install dependencies that don't work, or not
 #   install all needed dependencies.
-#Pipfile.lock
+Pipfile.lock
 
 # UV
 #   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
 #   This is especially recommended for binary packages to ensure reproducibility, and is more
 #   commonly ignored for libraries.
-#uv.lock
+uv.lock
 
 # poetry
 #   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
 #   This is especially recommended for binary packages to ensure reproducibility, and is more
 #   commonly ignored for libraries.
 #   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
-#poetry.lock
+poetry.lock
 
 # pdm
 #   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
-#pdm.lock
+pdm.lock
 #   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
 #   in version control.
 #   https://pdm.fming.dev/latest/usage/project/#working-with-version-control