Skip to content

Conversation

@ecoussoux-ansys
Copy link
Contributor

This PR introduces the ansys/actions/check-actions-security action in the workflow file .github/workflows/ci_cd.yml and consequently in the CI of pyedb as requested in #1567.

This action is using zizmor to perform an audit of the workflows defined in .github/workflows/ci_cd.yml and .github/workflows/label.yml.
The PR addresses the findings surfaced by the zizmor audit on the workflow files (performed locally), resulting in the following changes:

  • All actions (both from ansys/actions as well as external ones) used in workflow files are now pinned with a commit SHA,
  • The argument persist-credentials: false is now systematically used with the action actions/checkout,
  • permissions are now defined on a job by job basis and none are granted at the workflow level. Jobs that do not use secrets are not granted any specific permissions,
  • Template expansions (${{ ... }}) are removed from plain run steps inside jobs. Inputs and relevant context variables are expanded in the env block instead.

The approach for introducing the ansys/actions/check-actions-security action is explained in details here and instructions for fixing common workflow vulnerabilities are provided here.
For further reference, such changes have been conducted in a few other pyansys projects already: ansys/pre-commit-hooks#352, ansys/ansys-tools-visualization-interface#366, ansys/pyansys-geometry#2277. The parameters used for the action and its position within the workflow have been defined based on these implementations.
The latest release v10.1.4 of ansys/actions is used.

Close #1567.

@ecoussoux-ansys ecoussoux-ansys self-assigned this Oct 7, 2025
@ecoussoux-ansys ecoussoux-ansys changed the title CI: Add "ansys/actions/check-actions-security" action and related fixes CI: Add ansys/actions/check-actions-security action and related fixes Oct 7, 2025
@github-actions github-actions bot added the maintenance Package and maintenance related label Oct 7, 2025
@codecov-commenter
Copy link

codecov-commenter commented Oct 7, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.29%. Comparing base (934ae73) to head (9d4f1f6).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1575   +/-   ##
=======================================
  Coverage   72.29%   72.29%           
=======================================
  Files         260      260           
  Lines       39345    39345           
=======================================
  Hits        28443    28443           
  Misses      10902    10902           
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Collaborator

@svandenb-dev svandenb-dev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@svandenb-dev svandenb-dev merged commit 25d0e0d into main Oct 8, 2025
29 checks passed
@svandenb-dev svandenb-dev deleted the ci/add-actions-security-check branch October 8, 2025 13:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci/cd maintenance Package and maintenance related

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[MAINTENANCE] Missing or outdated ansys/actions/check-actions-security action in ansys/pyedb

4 participants