From be59233c0b43aecf82337f42c2296dd9816010ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Max=20Str=C3=BCbing?= <mxstrbng@gmail.com>
Date: Wed, 12 Aug 2026 07:43:24 +0000
Subject: [PATCH] ci: fix zizmor template-injection findings and stop the lint
 being skippable

The release workflow interpolated `${{ github.event.inputs.releaseVersion }}`
and `${{ github.ref_name }}` directly into `run:` blocks, which zizmor's
template-injection audit reports as high severity. Pass both through `env:`
and reference them as shell variables instead, matching the pattern already
used by the "Tag release" and "Push tag" steps in the same file.

These findings reached main because the zizmor job lived in test.yml behind a
`paths:` filter that did not cover the workflow files zizmor audits, so the
commit that introduced them never ran the lint. Every later PR touching a
filtered path then failed on the pre-existing findings.

Move the job to its own workflow that runs on all pushes and pull requests
with no `paths:` filter, so a change to a workflow can no longer skip the
lint that guards it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml |  8 ++++++--
 .github/workflows/test.yml    | 14 --------------
 .github/workflows/zizmor.yml  | 29 +++++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 16 deletions(-)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 026952b3511..ff5c2c19c39 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -74,12 +74,16 @@ jobs:
             - name: Run prebuild
               run: cd docs && npm run prebuild
             - name: Create version snapshot
-              run: cd docs && npx docusaurus docs:version ${{ github.event.inputs.releaseVersion }}
+              run: cd docs && npx docusaurus docs:version "${RELEASE_VERSION}"
+              env:
+                  RELEASE_VERSION: ${{ github.event.inputs.releaseVersion }}
             - name: Commit versioned docs
               if: ${{ github.event.inputs.dry_run != 'true' }}
               run: |
                   git config user.name "github-actions[bot]"
                   git config user.email "github-actions[bot]@users.noreply.github.com"
                   git add docs/versions.json docs/versioned_docs/ docs/versioned_sidebars/
-                  git commit -m "docs: snapshot version ${{ github.ref_name }}" || echo "No changes to commit"
+                  git commit -m "docs: snapshot version ${REF_NAME}" || echo "No changes to commit"
                   git push
+              env:
+                  REF_NAME: ${{ github.ref_name }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9b16d5ca902..4351d4f47e7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -53,17 +53,3 @@ jobs:
             - name: Create k8s Kind Cluster
               uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
             - run: npm run integration-test
-    zizmor:
-        runs-on: ubuntu-latest
-        name: GitHub Actions security lint
-        permissions:
-            contents: read
-        steps:
-            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-              with:
-                  persist-credentials: false
-            - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
-              with:
-                  advanced-security: false
-                  persona: pedantic
-                  min-severity: medium
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000000..432e0bdc397
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,29 @@
+name: Zizmor
+
+# Deliberately unfiltered by `paths`. This job audits everything under
+# .github/, so gating it on a path list means a change to a workflow can
+# skip the lint that guards that very workflow -- which is how two
+# high-severity template-injection findings reached main unnoticed.
+on:
+    push:
+        branches: [master, main]
+    pull_request:
+        branches: [master, main]
+
+permissions: {}
+
+jobs:
+    zizmor:
+        runs-on: ubuntu-latest
+        name: GitHub Actions security lint
+        permissions:
+            contents: read
+        steps:
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  persist-credentials: false
+            - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+              with:
+                  advanced-security: false
+                  persona: pedantic
+                  min-severity: medium