Zizmor by benalleng · Pull Request #1886 · payjoin/rust-payjoin

benalleng · 2026-09-16T17:47:36Z

This PR introduces the zizmor CI hardening

I know there are a lot of file changes here but ultimately we just want consistency in the first commit.

Closes #1840

Coded with Big Pickle

Pull Request Checklist

Please confirm the following before requesting review:

I have disclosed my use of
AI
in the body of this PR.
I have read CONTRIBUTING.md and rebased my branch to produce hygienic commits.

coveralls · 2026-09-16T17:51:41Z

Coverage Report for CI Build 38962872602

Coverage remained the same at 87.475%

Details

Coverage remained the same as the base build.
Patch coverage: No coverable lines changed in this PR.
No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	17860
Covered Lines:	15623
Line Coverage:	87.47%
Coverage Strength:	319.44 hits per line

💛 - Coveralls

benalleng · 2026-09-29T14:51:29Z

@chavic I think you would be best to take a look here just because I think you might be interested in this.

caarloshenriq

Concept ACK

Hardening looks right (zizmor offline 362 → 0 locally). One real bug:

smoke-npm is broken. Replayed the run block against a locally-built tarball:

ERR_MODULE_NOT_FOUND: Cannot find package '@ubjs/core'
imported from dist/nodejs/generated/payjoin.js

The tar -x unpacks only the package's dist and never installs the runtime dep @ubjs/core. Doesn't show here because javascript.yml doesn't trigger on .github-only PRs, but publish-npm needs smoke-npm, so it'll block the next payjoin-ffi PR and JS release. npm install --ignore-scripts ../pkg/payjoin-*.tgz keeps deps resolving.

spacebear21

cACK

Regarding the broken smoke-npm job, I wonder if we can/should add triggers on .github files? Feels like any change to how a job runs should at least be checked in the PR changing it.

benalleng · 2026-10-09T19:14:25Z

I added a commit that adds on self file change run the job. I didn't apply it to workflow_call jobs or ones that made PRs as I don't think that makes sense as they often use manual triggers for testing.

Edit: squashed it into the prepare commit

spacebear21

utACK

caarloshenriq

tACK

DanGould

Pinning commit hashes turns off Dependabot alerts for these actions (GitHub only alerts on semver refs like @v4, not hashes), so we would add a .github/dependabot.yml for the github-actions ecosystem to keep the pins current, otherwise this is a regression

DanGould · 2026-10-12T13:53:22Z

Also wondering if dropping GH_TOKEN from the zizmor template was intentional? because there's no rationale included. Without it zizmor runs offline and skips ref-version-mismatch, impostor-commit and known-vulnerable-actions

benalleng · 2026-10-12T16:30:10Z

Also wondering if dropping GH_TOKEN from the zizmor template was intentional?

Ahh yes, I did not use the template straight from the zizmor documentation I can add that

benalleng · 2026-10-12T19:04:30Z

I added an additional update-actions-pin cron job to hopefully bump pins for workflows where the dependabot will fail as dependabot does not understand how to bump branches like dtolnay/rust-toolchain@1.85.0, it can only bump release tags.

DanGould

Some ~sane sounding bot feedback + the conversation we had offline. Almost there ..

Thanks for sticking with this. Let's drop the last commit as discussed out of band. To push edits to workflow files, the pin bump job needs a token with the workflows permission, and a token like that can run arbitrary code in CI. That's a lot of trust for about five pins. The rust-toolchain pins only freeze the action's wrapper, since the toolchain is still picked when the job runs, so a manual bump now and then is fine. That leaves a few things:

The nightly toolchain job edits rust.yml, and with the token limited to contents and pull requests (nightly-maintenance.yml#L47-L48) its push will be rejected. Please add permission-workflows: write there. Master's token gets that permission implicitly.
Dependabot only reads .github/workflows with directory: / (dependabot.yml#L17), so the pins in .github/actions/setup-nix won't get bumped. directories: ["/", "/.github/actions/*"] covers both. While you're in there, could you pin determinate-nix-action to v3.23.2 instead of main so dependabot can track it?
The uv entry points at the root (dependabot.yml#L6), but uv.lock is in payjoin-ffi/python.
Optional: the test-* jobs in flake-maintenance (#L64-L86) run against master's flake.lock, not the updated one. The PR that update-flake-lock opens already runs those workflows, so I think they can go.

It also needs a rebase. The only conflict is in crates-release.yml.

spacebear21

ACK 9b4f547

Add on own edit checks for workflows that may have impacts on PR success Fix smoke to allow CI to pass This also adds a specific lockfile `smoke/package.json` so the CI job does not install anything ad-hoc which would violate the zizmor checks.

Following the zizmor hash pinning we need a dependabot job to update our workflow action checks to keep things current.

spacebear21

reACK

Resolved

benalleng requested review from DanGould and spacebear21 as code owners September 16, 2026 17:47

benalleng force-pushed the zizmor branch from 209e951 to 7f5d28b Compare September 16, 2026 17:47

benalleng force-pushed the zizmor branch from 7f5d28b to 0650631 Compare September 16, 2026 17:55

benalleng marked this pull request as draft September 16, 2026 17:58

benalleng force-pushed the zizmor branch from 0650631 to 99acf89 Compare September 16, 2026 18:10

benalleng marked this pull request as ready for review September 18, 2026 15:11

benalleng requested a review from chavic September 21, 2026 12:35

benalleng force-pushed the zizmor branch from 99acf89 to 60db13e Compare September 21, 2026 18:57

benalleng assigned chavic Sep 29, 2026

caarloshenriq reviewed Sep 29, 2026

View reviewed changes

spacebear21 previously approved these changes Oct 9, 2026

View reviewed changes

benalleng dismissed spacebear21’s stale review via 0c6935a October 9, 2026 19:02

benalleng force-pushed the zizmor branch from 60db13e to 0c6935a Compare October 9, 2026 19:02

benalleng force-pushed the zizmor branch 3 times, most recently from ecf2491 to c1ddd44 Compare October 9, 2026 20:00

benalleng requested a review from spacebear21 October 9, 2026 20:00

spacebear21 previously approved these changes Oct 9, 2026

View reviewed changes

caarloshenriq approved these changes Oct 11, 2026

View reviewed changes

DanGould requested changes Oct 12, 2026

View reviewed changes

Comment thread .github/workflows/crates-release.yml

benalleng dismissed spacebear21’s stale review via f3b9e5a October 12, 2026 16:45

benalleng force-pushed the zizmor branch 3 times, most recently from 2dc5c14 to 125c560 Compare October 12, 2026 18:08

benalleng force-pushed the zizmor branch from 125c560 to 4ebedd0 Compare October 12, 2026 18:13

benalleng requested a review from DanGould October 12, 2026 18:30

benalleng force-pushed the zizmor branch 3 times, most recently from da804d8 to 704964d Compare October 15, 2026 17:50

DanGould previously requested changes Oct 16, 2026

View reviewed changes

Comment thread .github/dependabot.yml Outdated

benalleng force-pushed the zizmor branch 5 times, most recently from 1a09cc2 to 9b4f547 Compare October 16, 2026 17:00

benalleng requested a review from DanGould October 16, 2026 17:23

spacebear21 previously approved these changes Oct 16, 2026

View reviewed changes

benalleng dismissed spacebear21’s stale review via 6aa89d2 October 16, 2026 20:29

benalleng force-pushed the zizmor branch from 9b4f547 to 6aa89d2 Compare October 16, 2026 20:29

benalleng added 4 commits October 16, 2026 16:31

Prepare CI jobs for zizmor checks

58ca3e1

Add on own edit checks for workflows that may have impacts on PR success Fix smoke to allow CI to pass This also adds a specific lockfile `smoke/package.json` so the CI job does not install anything ad-hoc which would violate the zizmor checks.

lock lockfile for fuzz build CI job

79764ec

Introduce zizmor CI checks

e6dde22

Add dependabot configuration for updating non-semver refs

a547617

Following the zizmor hash pinning we need a dependabot job to update our workflow action checks to keep things current.

benalleng force-pushed the zizmor branch from 6aa89d2 to a547617 Compare October 16, 2026 20:31

spacebear21 approved these changes Oct 16, 2026

View reviewed changes

benalleng merged commit 94cfdce into payjoin:master Oct 17, 2026
57 checks passed

benalleng mentioned this pull request Oct 17, 2026

Action and dep fixes #1990

Merged

3 tasks done

Conversation

benalleng commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coveralls commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 38962872602

Coverage remained the same at 87.475%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

benalleng commented Sep 29, 2026

Uh oh!

caarloshenriq left a comment

Choose a reason for hiding this comment

Uh oh!

spacebear21 left a comment

Choose a reason for hiding this comment

Uh oh!

benalleng commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

spacebear21 left a comment

Choose a reason for hiding this comment

Uh oh!

caarloshenriq left a comment

Choose a reason for hiding this comment

Uh oh!

DanGould left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DanGould commented Oct 12, 2026

Uh oh!

benalleng commented Oct 12, 2026

Uh oh!

benalleng commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DanGould left a comment • edited by benalleng Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

spacebear21 left a comment

Choose a reason for hiding this comment

Uh oh!

spacebear21 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

benalleng commented Sep 16, 2026 •

edited

Loading

coveralls commented Sep 16, 2026 •

edited

Loading

benalleng commented Oct 9, 2026 •

edited

Loading

benalleng commented Oct 12, 2026 •

edited

Loading

DanGould left a comment •

edited by benalleng

Loading