Harden GHA#90
Conversation
|
✅ All contributors to this pull request have signed the TensorZero CLA. Thank you! |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ad3033f620
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
I have read the Contributor License Agreement (CLA) and hereby sign the CLA. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80d1a9cd92
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 80d1a9c. Configure here.
3 participants
Note
Medium Risk
Workflow changes adjust permissions, concurrency, and action versions, which can impact CI/benchmark execution and merge-queue behavior if misconfigured.
Overview
Hardens GitHub Actions execution. Existing
CIandBenchmarkworkflows now use workflow-levelconcurrency, least-privilegepermissions, and SHA-pinned actions (withpersist-credentials: falseon checkout).Adds security enforcement. Introduces a new
securityworkflow that runspinact(fails on unpinneduses:) andzizmor(uploads SARIF to code scanning), plus a final gate job that treats skips as failures in merge queue.Adds
.github/zizmor.ymlto tunezizmorrules/ignores to avoid duplicate findings withpinactand document intentional exceptions (e.g.,dtolnay/rust-toolchainand unpinned Postgres image).Reviewed by Cursor Bugbot for commit 36b59fc. Bugbot is set up for automated code reviews on this repo. Configure here.