Harden Github Actions workflows

[jaimergp]

I'd like to apply Zizmor to core napari repositories to harden our supply chain security story.

• Add zizmor to pre-commit napari#8247
•  Add zizmor to pre-commit, only high severity for now #272

[jaimergp]

This is an org-wide audit for all high severity findings. Not suuuper concerning, but there are some action items.

419 findings (228 ignored, 165 suppressed, 9 fixable): 0 unknown, 0 informational, 0 low, 0 medium, 26 high

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> bermuda/.github/workflows/wheels.yml:3:1
   |
 3 | / on:
 4 | |   push:
...  |
11 | |     branches:
12 | |       - "**"
   | |____________^ generally used when publishing artifacts generated at runtime
13 |
...
69 |         - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
70 |         - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> docs/.github/workflows/auto_author_assign.yml:4:1
  |
4 | / on:
5 | |   pull_request_target:
6 | |     types: [opened, reopened]
  | |_____________________________^ pull_request_target is almost always used insecurely
  |
  = note: audit confidence → Medium

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> docs/.github/workflows/edit_pr_description.yml:2:1
  |
2 | / on:
3 | |   # see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
... |
8 | |       - reopened
9 | |       - edited
  | |______________^ pull_request_target is almost always used insecurely
  |
  = note: audit confidence → Medium

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> docs/.github/workflows/labeler.yml:3:1
  |
3 | / on:
4 | | - pull_request_target
  | |_____________________^ pull_request_target is almost always used insecurely
  |
  = note: audit confidence → Medium

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> docs/.github/workflows/remove_ready_to_merge.yml:3:1
  |
3 | / on:
4 | |   pull_request_target:
5 | |     types: [closed]
6 | |   workflow_call:
  | |________________^ pull_request_target is almost always used insecurely
  |
  = note: audit confidence → Medium

error[excessive-permissions]: overly broad permissions
  --> docs/.github/workflows/triggered_target_build.yml:21:3
   |
21 |   issues: write
   |   ^^^^^^^^^^^^^ issues: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[excessive-permissions]: overly broad permissions
  --> docs/.github/workflows/triggered_target_build.yml:22:3
   |
22 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High

error[template-injection]: code injection via template expansion
  --> docs/.github/workflows/triggered_target_build.yml:60:25
   |
56 |         run: |
   |         ^^^ this run block
57 |           ALLOWED_TARGETS="html html-noplot docs slimfast slimgallery"
58 |
59 |           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
60 |             TARGET="${{ github.event.inputs.make_target }}"
   |                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> napari/.github/workflows/benchmarks.yml:110:47
    |
 97 |         run: |
    |         ^^^ this run block
 98 |           set -euxo pipefail
...
109 |             CONTENDER_REF=${GITHUB_SHA}
110 |             echo "Baseline:  ${BASE_REF} (${{ github.event.pull_request.base.label }})"
    |                                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> napari/.github/workflows/benchmarks.yml:120:27
    |
 97 |         run: |
    |         ^^^ this run block
 98 |           set -euxo pipefail
...
119 |             EVENT_NAME="manual trigger"
120 |             BASE_REF="${{ github.event.inputs.base_ref }}"
    |                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> napari/.github/workflows/benchmarks.yml:121:32
    |
 97 |         run: |
    |         ^^^ this run block
 98 |           set -euxo pipefail
...
120 |             BASE_REF="${{ github.event.inputs.base_ref }}"
121 |             CONTENDER_REF="${{ github.event.inputs.contender_ref }}"
    |                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
  --> napari/.github/workflows/benchmarks_report.yml:12:1
   |
12 | / on:
13 | |   workflow_run:
14 | |     workflows: [Benchmarks]
15 | |     types:
16 | |       - completed
   | |_________________^ workflow_run is almost always used insecurely
   |
   = note: audit confidence → Medium

error[github-env]: dangerous use of environment file
  --> napari/.github/workflows/benchmarks_report.yml:65:9
   |
65 | /         run: |
66 | |           if [[ -f pr_number ]]; then
67 | |             echo "PR_NUMBER=$(cat pr_number)" >> "$GITHUB_ENV"
68 | |           fi
   | |____________^ write to GITHUB_ENV may allow code execution
   |
   = note: audit confidence → Low

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
  --> napari/.github/workflows/edit_pr_description.yml:3:1
   |
 3 | / on:
 4 | |   # see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
...  |
11 | |   workflow_call:
12 | | # see https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
   | |_________________________________________________________________________________^ pull_request_target is almost always used insecurely
   |
   = note: audit confidence → Medium

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> napari/.github/workflows/labeler.yml:3:1
  |
3 | / on:
4 | | - pull_request_target
  | |_____________________^ pull_request_target is almost always used insecurely
  |
  = note: audit confidence → Medium

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> napari/.github/workflows/remove_ready_to_merge.yml:3:1
  |
3 | / on:
4 | |   pull_request_target:
5 | |     types: [closed]
6 | |   workflow_call:
  | |________________^ pull_request_target is almost always used insecurely
  |
  = note: audit confidence → Medium

error[template-injection]: code injection via template expansion
   --> napari/.github/workflows/reusable_run_tox_test.yml:140:50
    |
139 |         run: |
    |         ^^^ this run block
140 |           python tools/split_qt_backend.py 0 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
    |                                                  ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> napari/.github/workflows/reusable_run_tox_test.yml:141:50
    |
139 |         run: |
    |         ^^^ this run block
140 |           python tools/split_qt_backend.py 0 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
141 |           python tools/split_qt_backend.py 1 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
    |                                                  ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> napari/.github/workflows/reusable_run_tox_test.yml:142:50
    |
139 |         run: |
    |         ^^^ this run block
140 |           python tools/split_qt_backend.py 0 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
141 |           python tools/split_qt_backend.py 1 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
142 |           python tools/split_qt_backend.py 2 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
    |                                                  ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> napari/.github/workflows/reusable_run_tox_test.yml:143:50
    |
139 |         run: |
    |         ^^^ this run block
140 |           python tools/split_qt_backend.py 0 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
141 |           python tools/split_qt_backend.py 1 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
142 |           python tools/split_qt_backend.py 2 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
143 |           python tools/split_qt_backend.py 3 ${{ inputs.qt_backend }} >> "$GITHUB_ENV"
    |                                                  ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> napari/.github/workflows/upgrade_test_constraints.yml:103:28
    |
101 |         run: |
    |         ^^^ this run block
102 |           echo "FULL_NAME=${{ github.repository }}" >> "$GITHUB_ENV"
103 |           echo "BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
    |                            ^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> napari-console/.github/workflows/test_and_deploy.yml:6:1
   |
 6 | / on:
 7 | |   push:
...  |
14 | |       - main
15 | |   workflow_dispatch:
   | |____________________^ generally used when publishing artifacts generated at runtime
16 |
...
30 |           uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
31 | /         with:
32 | |           python-version: ${{ matrix.python-version }}
33 | |           cache: "pip"
   | |______________________^ opt-in for caching here
   |
   = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> napari-graph/.github/workflows/test_and_deploy.yml:6:1
    |
  6 | / on:
  7 | |   push:
...   |
 16 | |       - main
 17 | |   workflow_dispatch:
    | |____________________^ generally used when publishing artifacts generated at runtime
 18 |
...
101 |         - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
102 | /         with:
103 | |           python-version: "3.x"
104 | |           cache-dependency-path: pyproject.toml
105 | |           cache: 'pip'
    | |______________________^ opt-in for caching here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> napari-plugin-manager/.github/workflows/test_and_deploy.yml:6:1
    |
  6 | / on:
  7 | |   push:
...   |
 14 | |       - main
 15 | |   workflow_dispatch:
    | |____________________^ generally used when publishing artifacts generated at runtime
 16 |
...
145 |         - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
146 | /         with:
147 | |           python-version: "3.x"
148 | |           cache-dependency-path: pyproject.toml
149 | |           cache: 'pip'
    | |______________________^ opt-in for caching here
    |
    = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> napari-tiff/.github/workflows/test_and_deploy.yml:9:1
   |
 9 | / on:
10 | |   push:
...  |
18 | |   # Allows you to run this workflow manually from the Actions tab
19 | |   workflow_dispatch:
   | |____________________^ generally used when publishing artifacts generated at runtime
20 |
...
72 |         - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
73 | /         with:
74 | |           python-version: "3.x"
75 | |           cache-dependency-path: pyproject.toml
76 | |           cache: 'pip'
   | |______________________^ opt-in for caching here
   |
   = note: audit confidence → Low

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> npe2/.github/workflows/ci.yml:3:1
    |
  3 | / on:
  4 | |   push:
...   |
  9 | |   pull_request: {}
 10 | |   workflow_dispatch:
    | |____________________^ generally used when publishing artifacts generated at runtime
 11 |
...
128 |         - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
129 | /         with:
130 | |           python-version: "3.x"
131 | |           cache-dependency-path: setup.cfg
132 | |           cache: 'pip'
    | |______________________^ opt-in for caching here
    |
    = note: audit confidence → Low

419 findings (228 ignored, 165 suppressed, 9 fixable): 0 unknown, 0 informational, 0 low, 0 medium, 26 high

[psobolewskiPhD]

Thanks @jaimergp
CC: @willingc i know you were also advocating something along these lines.
I think it makes a lot of sense from the standpoint of trying to "sell" ourselves to organizations. Just being able to show we are cognizant of supply chain security and taking steps is important, even if we don't fix everything immediately.