fix(actions): refactor gh actions to fix CI

.github/workflows/alert-update-flags.yaml

@@ -10,16 +10,20 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   notification-update-flags:
     name: Send email with flag changes
     runs-on: cx-public-ubuntu-x64
-
     steps:
       - name: Checkout project
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
+          persist-credentials: false
       - name: Execute diff and send email
         env:
           AWS_REGION: ${{ secrets.EMAIL_AWS_REGION }}

.github/workflows/alert-update-terraform-modules.yaml

@@ -8,15 +8,20 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   notification-update-flags:
     name: Send email with terraform modules updates
     runs-on: cx-public-ubuntu-x64
-
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Execute diff and send email
         env:
           AWS_REGION: ${{ secrets.EMAIL_AWS_REGION }}
@@ -29,6 +34,8 @@ jobs:
             -u https://registry.terraform.io/v1/modules
       - name: Create Pull Request
         uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1
+        env:
+          GIT_SHA: ${{ github.sha }}
         with:
           title: "feat(queries): update terraform registry data on commons.json"
           token: ${{ secrets.KICS_BOT_PAT }}
@@ -38,5 +45,5 @@ jobs:
           body: |
             **Automated Changes**
             Updating terraform registry data on commons.json.
-            Triggered by SHA: _${{ github.sha }}_
+            Triggered by SHA: _"${GIT_SHA}"_
           labels: terraform

.github/workflows/cesar.yaml

@@ -9,18 +9,28 @@ env:
   ENGINE: "kics"
   REMOVE_HISTORY: "true"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read # for actions/checkout to fetch code
+  id-token: read # default deny-write baseline; the ci-projects job below elevates to write for AWS OIDC
+
 jobs:
   build:
+    name: Build KICS binary
     if: (github.event.label.name == 'cesar' && github.event.pull_request.mergeable == true)
     runs-on: cx-public-ubuntu-x64
-
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           path: kics
-
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+          persist-credentials: false
+      - name: Setup Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version-file: kics/go.mod
           cache-dependency-path: kics/go.sum
@@ -37,22 +47,29 @@ jobs:
           chmod +x ./bin/kics
 
       - name: Create Metadata File
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_ACTOR: ${{ github.actor }}
+          PR_HEAD_REF: ${{ github.head_ref }}
+          PR_BASE_REF: ${{ github.base_ref }}
         run: |
           COMMIT_TIMESTAMP=$(git -C "$GITHUB_WORKSPACE/kics" log -1 --format=%ct)
           METADATA_PATH="$GITHUB_WORKSPACE/pr-metadata.json"
           CURR_TIMESTAMP=$(date +%s)
           echo '{
             "seq": "'"${CURR_TIMESTAMP}"'",
-            "tag": "'"${{ github.event.number }}"'",
-            "comment": "'"${{ github.event.pull_request.title }}"'",
-            "commit": "'"${{ github.event.pull_request.head.sha }}"'",
-            "owner": "'"${{ github.actor }}"'",
-            "branch": "'"${{ github.head_ref }}"'",
+            "tag": "'"${PR_NUMBER}"'",
+            "comment": "'"${PR_TITLE}"'",
+            "commit": "'"${PR_HEAD_SHA}"'",
+            "owner": "'"${PR_ACTOR}"'",
+            "branch": "'"${PR_HEAD_REF}"'",
             "engine": "'"${ENGINE}"'",
             "platform": "'"${PLATFORM}"'",
             "version": "'"${ENGINE_VERSION}"'",
             "forkSeq": "'"${CURR_TIMESTAMP}"'",
-            "forkBranch": "'"${{ github.base_ref }}"'",
+            "forkBranch": "'"${PR_BASE_REF}"'",
             "removeHistory" : "'"${REMOVE_HISTORY}"'"
           }' > "$METADATA_PATH"
 
@@ -76,8 +93,10 @@ jobs:
           retention-days: 1
 
   ci-projects:
+    permissions:
+      id-token: write # run kics againts the projects
     needs: build
     uses: ./.github/workflows/run-projects.yaml
     with:
       machines-count: 10
-    secrets: inherit
+    secrets: inherit # zizmor: ignore[secrets-inherit] run-projects.yaml is an internal same-repo reusable workflow, fixed caller set (here + ci-projects.yaml), needs several CES_*/GH_TOKEN secrets for AWS OIDC + private executor-repo checkout

.github/workflows/check-apache-license.yaml

@@ -1,22 +1,31 @@
 name: check-apache-license
 on:
+  # zizmor: ignore[dangerous-triggers] needs secrets/write access to label & comment on PRs from forks;
+  # checkout never overrides ref, so it always checks out the trusted base branch, never the PR head,
+  # and no PR-supplied content is ever executed as code (only compared/sent as plain data)
   pull_request_target:
     types: [opened, synchronize, edited, reopened]
     branches:
       - master
+
 permissions:
   contents: read
 
 concurrency:
   group: check-apache-license-${{ github.event.pull_request.number }}
   cancel-in-progress: true
+
 jobs:
   check-license:
+    name: Check Apache License
     runs-on: cx-public-ubuntu-x64
     timeout-minutes: 1
     env:
       BODY: ${{ github.event.pull_request.body }}
       USERNAME: ${{ github.event.pull_request.user.login }}
+      KICS_BOT_PAT: ${{ secrets.KICS_BOT_PAT }}
+      REPOSITORY: ${{ github.repository }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
     - name: Checkout code
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -31,8 +40,8 @@ jobs:
     - name: Check for comment tag
       if: env.CHECK_FAILED != 'true'
       run: |
-        comments=$(curl -s -H "Authorization: token ${{ secrets.KICS_BOT_PAT }}" \
-            -X GET "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments")
+        comments=$(curl -s -H "Authorization: token "${KICS_BOT_PAT}"" \
+            -X GET "https://api.github.com/repos/"${REPOSITORY}"/issues/"${PR_NUMBER}"/comments")
         if echo "$comments" | grep -q "apache_license"; then
           echo "TAG_EXISTS=true" >> $GITHUB_ENV
         else
@@ -46,7 +55,7 @@ jobs:
           Deleting comment...
         comment-tag: apache_license
         mode: delete
-        github-token: ${{ secrets.KICS_BOT_PAT }}
+        github-token: "${KICS_BOT_PAT}"
     - name: Add comment if no license
       if: env.CHECK_FAILED == 'true'
       uses: step-security/actions-comment-pull-request@60cd38988a354b2d22b47612fb02a20e822d6048 # v3.0.2
@@ -55,7 +64,7 @@ jobs:
         comment-tag: apache_license
         mode: recreate
         create-if-not-exists: true
-        github-token: ${{ secrets.KICS_BOT_PAT }}
+        github-token: "${KICS_BOT_PAT}"
     - name: Workflow failed
       if: env.CHECK_FAILED == 'true'
       run: exit 1

.github/workflows/check-go-coverage.yaml

@@ -7,6 +7,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   coverage:
     name: generate-coverage
@@ -19,6 +23,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0
         with:
@@ -31,7 +36,9 @@ jobs:
           echo "Total number of tests :: ${TOTAL_TESTS}"
           echo "::set-output name=total_tests::${TOTAL_TESTS}"
       - name: Checks if Go coverage is at least 74%
-        if: steps.testcov.outputs.coverage < 74
+        env:
+          GO_COVERAGE: ${{ steps.testcov.outputs.coverage }}%
+        if: GO_COVERAGE < 74
         run: |
-          echo "Go coverage is lower than 74%: ${{ steps.testcov.outputs.coverage }}%"
+          echo "Go coverage is lower than 74%: "${GO_COVERAGE }"%"
           exit 1

.github/workflows/ci-projects.yaml

@@ -10,18 +10,30 @@ env:
   PLATFORM: "LINUX_X64"
   ENGINE: "kics"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read # for actions/checkout to fetch code
+
 jobs:
   build:
+    name: Build Kics to run againts projects
     if: github.event.pull_request.merged == true
     runs-on: cx-public-ubuntu-x64
-
+    permissions:
+      contents: read # for actions/checkout to fetch code
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
           path: kics
+          persist-credentials: false
 
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+      - name: Setup Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version-file: kics/go.mod
           cache-dependency-path: kics/go.sum
@@ -38,16 +50,22 @@ jobs:
           chmod +x ./bin/kics
 
       - name: Create Metadata File
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_SHA: ${{ github.sha }}
+          PR_ACTOR: ${{ github.actor }}
+          PR_BASE_REF: ${{ github.base_ref }}
         run: |
           COMMIT_TIMESTAMP=$(git -C "$GITHUB_WORKSPACE/kics" log -1 --format=%ct)
           METADATA_PATH="$GITHUB_WORKSPACE/pr-metadata.json"
           echo '{
             "seq": "'"${COMMIT_TIMESTAMP}"'",
-            "tag": "'"${{ github.event.number }}"'",
-            "comment": "'"${{ github.event.pull_request.title }}"'",
-            "commit": "'"${{ github.sha }}"'",
-            "owner": "'"${{ github.actor }}"'",
-            "branch": "'"${{ github.base_ref }}"'",
+            "tag": "'"${PR_NUMBER}"'",
+            "comment": "'"${PR_TITLE}"'",
+            "commit": "'"${PR_SHA}"'",
+            "owner": "'"${PR_ACTOR}"'",
+            "branch": "'"${PR_BASE_REF}"'",
             "engine": "'"${ENGINE}"'",
             "platform": "'"${PLATFORM}"'",
             "version": "'"${ENGINE_VERSION}"'"
@@ -74,7 +92,9 @@ jobs:
 
   ci-projects:
     needs: build
+    permissions:
+      id-token: write # required to pass id-token permission through to run-projects.yaml for AWS OIDC federation
     uses: ./.github/workflows/run-projects.yaml
     with:
       machines-count: 10
-    secrets: inherit
+    secrets: inherit # zizmor: ignore[secrets-inherit] run-projects.yaml is an internal same-repo reusable workflow, fixed caller set (here + cesar.yaml), needs several CES_*/GH_TOKEN secrets for AWS OIDC + private executor-repo checkout

.github/workflows/go-ci-coverage.yaml

@@ -8,6 +8,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   coverage:
     name: generate-coverage
@@ -20,6 +24,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0
         with:
@@ -32,18 +37,24 @@ jobs:
           echo "Total Tests :: ${TOTAL_TESTS}"
           echo "::set-output name=total_tests::${TOTAL_TESTS}"
       - name: Generate badge
+        env:
+          GO_COVERAGE: ${{ steps.testcov.outputs.coverage }}
+          GO_COLOR: ${{ steps.testcov.outputs.color }}
         run: |
           curl -L \
-            https://img.shields.io/badge/Go%20Coverage-${{ steps.testcov.outputs.coverage }}%25-${{ steps.testcov.outputs.color }}.svg > coverage.svg
+            https://img.shields.io/badge/Go%20Coverage-"${GO_COVERAGE}"%25-"${GO_COLOR}".svg > coverage.svg
           cat coverage.svg
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - name: Upload coverage svg Artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ runner.os }}-badge-latest
           path: coverage.svg
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - name: Upload coverage html Artifcat
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ runner.os }}-coverage-latest
           path: coverage.html
+
   publish:
     permissions:
       contents: write  # for Git to git push
@@ -55,6 +66,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: gh-pages
+          persist-credentials: true
       - name: Configure git commit author
         run: |
           git config --global user.name "KICSBot"