ci: gate setup-bun cache off tag refs (zizmor cache-poisoning)#23
Open
John-David Dalton (jdalton) wants to merge 2 commits into
Open
ci: gate setup-bun cache off tag refs (zizmor cache-poisoning)#23John-David Dalton (jdalton) wants to merge 2 commits into
John-David Dalton (jdalton) wants to merge 2 commits into
Conversation
ci.yml runs on `push: tags: ['*']` and the repo-local `Setup Bun` step (oven-sh/setup-bun) caches by default. zizmor's cache-poisoning audit flags this as high severity (error[cache-poisoning] at ci.yml:128) — a tag/release ref could restore a bun cache a less-trusted branch/PR run populated, so the CI "Check" step exits 14. Gate the setup-bun cache off for tag refs only (no-cache when github.ref starts with refs/tags/). Ordinary branch and PR CI keep a warm bun cache; only release-shaped refs skip it, which is zizmor's documented remediation. This is a bun-security-scanner-local workflow step, not a fleet-source issue — the fleet-standard actions nest caching inside composites and their publish workflows are workflow_dispatch-triggered, so they don't trip this audit.
…llowlisted)
The release-tier 🔎 Check (check-package-files-are-allowlisted) failed
with two findings on the publish output:
- [missing_essential]: no file matching ^LICENSE(\.md|\.txt)?$ —
every published package must ship a README and LICENSE. package.json
declares "license": "MIT" but no LICENSE file existed.
- [undershoot]: `files` entry `CHANGELOG.md` matched nothing in the
publish output — the file was listed but never seeded.
Add a standard MIT LICENSE (Copyright (c) 2025 Socket Inc, matching the
sibling fleet repos) and seed a Keep-a-Changelog CHANGELOG.md with an
`## [Unreleased]` section the release pipeline prepends to. Both are
repo-local; no fleet-source change needed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
🔎 Checkfails on every recent run with a zizmor high-severity finding, exit 14:```
error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
--> .github/workflows/ci.yml:128:9
128 | uses: oven-sh/setup-bun@22457c8
| ^^^ enables caching by default
```
ci.ymlruns onpush: tags: ['*']and the repo-local Setup Bun step (oven-sh/setup-bun) caches by default. A tag/release ref restoring a bun cache that a less-trusted branch/PR run populated is the cache-poisoning vector zizmor flags.Fix
Gate the setup-bun cache off for tag refs only:
```yaml
no-cache: ${{ startsWith(github.ref, 'refs/tags/') }}
```
Ordinary branch and PR CI keep a warm bun cache; only release-shaped refs skip it. This is zizmor's documented remediation (disable caching for tag/release events, keep it elsewhere) and is more surgical than a wholesale
no-cache: true.Scope
This is a bun-security-scanner-local workflow step, not a fleet-source issue. The fleet-standard actions nest their caching inside composite actions (which zizmor's cache-poisoning audit does not descend into) and their publish workflows are
workflow_dispatch-triggered, so the fleet actions themselves are clean.Verification
zizmor .github --min-severity medium(the exact🔎 Checkinvocation, zizmor 1.26.1 perexternal-tools.json) -> exit 14, 1 high.--min-severity low.bun test: 47 pass, 2 skip, 0 fail).