Unable to use online audits

[seifertm]

zizmor is being integrated into pytest-asyncio.

In that setup, zizmor is already run as a pre-commit hook. The pre-commit hook doesn't require a GitHub token so that contributors aren't forced to set up a token. As a result, the hook only runs the checks that don't require a GH_TOKEN.

I want to enable the additional zizmor checks as part of the pipeline. This doesn't seem to be possible with this reusable workflow.

My understanding is that a GitHub token is automatically provided for each workflow run , but secrets have to be passed explicitly to reusable workflows. Since this workflow doesn't accept any secrets, that means the zizmore workflow cannot make use of it at the moment.

My questions are:

1. Do you think it makes sense to accepts a GitHub token as a secret?
2. If so, which permissions would be required on the token?

[webknjaz]

The built-in GH token secret is exposed automatically, AFAIK, as a special case. No need to do anything explicitly. Just that security-events privilege is the only thing needed.

[woodruffw]

Yep, I believe @webknjaz is right -- with that said I believe the workflow does need GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} in the env: block to zizmor to enable the online audits. But that should't require a new user input 🙂

[seifertm]

Actually, I tried passing the token as an env var just before I opened this issue, but that failed due to invalid syntax.
The GH docs only mention that it's possible to pass inputs and secrets to a workflow, but not environment variables.

I have no experience with reusable workflows. Am I missing something?

[woodruffw]

Actually, I tried passing the token as an env var just before I opened this issue, but that failed due to invalid syntax.

Oh sorry, I said that in a confusing way -- I meant that the reusable workflow needs that env: block, not your calling workflow.

In other words, this is a bug within the workflow itself, so I'll send a PR fixing it in a moment.

[webknjaz]

The new HEAD to pin to post #2 is 3bb5e95068d0f44b6d2f3f7e91379bed1d2f96a8.

cc @jakob-keller FYI aiobotocore needs a bump

[jakob-keller]

The new HEAD to pin to post #2 is 3bb5e95068d0f44b6d2f3f7e91379bed1d2f96a8.

cc @jakob-keller FYI aiobotocore needs a bump

It's included in aio-libs/aiobotocore#1363