fix(agentic-engineering): forbid foreground remote polling #81
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🔍 Scan for Workflow Vulnerabilities | |
| permissions: {} | |
| on: | |
| workflow_call: | |
| ### Required Workflow Triggers ### | |
| pull_request: | |
| merge_group: | |
| ################################## | |
| jobs: | |
| # A required workflow whose only job is skipped can remain unsatisfied. | |
| # Classify every event in an unconditional, zero-permission job so merge | |
| # groups complete green as a deliberate no-op while the scan stays skipped. | |
| eligibility: | |
| permissions: {} | |
| runs-on: ubuntu-latest | |
| outputs: | |
| scan: ${{ steps.classify.outputs.scan }} | |
| steps: | |
| - name: 🛡️ Harden runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: 🔎 Classify advisory scan event | |
| id: classify | |
| if: github.event_name != 'merge_group' | |
| run: echo "scan=true" >> "$GITHUB_OUTPUT" | |
| - name: ✅ Complete merge-group required-workflow run | |
| id: no-op | |
| if: steps.classify.outputs.scan != 'true' | |
| run: >- | |
| echo "::notice::The pull-request advisory scan already ran; | |
| completing this merge-group workflow as a safe no-op." | |
| zizmor: | |
| needs: eligibility | |
| if: needs.eligibility.outputs.scan == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read # only needed for private repos | |
| actions: read # only needed for private repos | |
| steps: | |
| - name: 🛡️ Harden runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: 📑 Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 🔍 Check for zizmor config | |
| id: config | |
| run: | | |
| if [ -f "zizmor.yml" ]; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: 🌈 Zizmor | |
| uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 | |
| with: | |
| config: ${{ steps.config.outputs.exists == 'true' && 'zizmor.yml' || '' }} |