Harden the GitHub Actions workflows

[2ndkauboy]

Prompted by Sebastian Bergmann's Hardening GitHub Actions Workflows, which walks through the pass he did over PHPUnit's workflows with zizmor.

Measured against that article, most of the work was already done here: every uses: is a commit SHA with a version comment, Dependabot advances those pins, there is no pull_request_target, no workflow_run and no issue_comment anywhere, and the release workflows already pass event data through env: rather than splicing it into shell. This closes the two measures the repository had not adopted at all, plus the injection sites that were left.

zizmor goes from 30 findings to 0 (1 high, 25 medium, 1 low, 1 informational → none).

persist-credentials: false on every checkout

Not set anywhere before, so all twelve checkouts left a usable GITHUB_TOKEN in .git/config for the rest of the job — including the jobs that then run composer install and npm install, which is to say execute third-party code with a credential sitting on disk next to it.

Nothing depended on it: no workflow pushes with git, and every step that calls the API already sets GH_TOKEN itself.

Least-privilege permissions:

Seven workflows declared none and therefore ran at whatever the repository default is. The two that matter most are wordpress-plugin-deploy.yml and wordpress-plugin-asset-update.yml, which hand real wordpress.org SVN credentials to a third-party action.

• contents: read for the four test/static-analysis workflows and the two wordpress.org ones — they authenticate against SVN with their own credentials and never touch the GitHub API.
• permissions: {} in spam-detection-comparison.yml, whose single job already declares its own.

Event data through the environment

An expression is expanded before the shell ever sees the line, so what it expands to runs as code rather than being read as an argument.

The one that mattered is composer install ${{ inputs.composer-flags }} in .github/actions/setup-php/action.yml — zizmor's only high-severity finding, and every PHP job in the repository goes through it. Deliberately $COMPOSER_FLAGS unquoted: the flags are several words and have to split into several arguments, and word splitting is all that ever happens to an environment variable.

Smaller ones in wordpress-plugin-check.yml (github.event.repository.name, now bound once as a job-level PLUGIN_SLUG), attach-snapshot.yml and spam-detection-comparison.yml.

A Workflow hardening job

So the next regression does not need a blog post to be noticed. Plain pipx run zizmor rather than zizmorcore/zizmor-action: one fewer third-party action in the workflow that argues for fewer of them, and the action's SARIF upload would want security-events: write for a report that reads just as well in the log. The read-only job token is passed only to lift zizmor out of offline mode — the check it enables is whether a pinned hash is really a commit in the action's own repository, which is how an impostor pin gets caught.

The path filter widens accordingly, from this workflow and .github/actions/setup-php/** to all of .github/workflows/** and .github/actions/**.

Deliberately not here

• dependabot-cooldown on all three ecosystems — a real question, but one about dependency policy rather than workflows. Suppressed inline with the reasoning written down, and tracked in Consider a Dependabot cooldown for Composer, npm and GitHub Actions updates #855.
• The 10up SVN actions stay. The article's "replace third-party actions with gh" advice does not transfer: there is no built-in equivalent for the wordpress.org SVN dance. They are SHA-pinned and Dependabot moves them, which is the part that was actually load-bearing.

Verification

zizmor --persona=regular .github/ reports zero findings, online and offline. The release-time workflows cannot be exercised from a pull request; their diffs are the same two mechanical changes as everywhere else, and each API-calling step still sets GH_TOKEN explicitly.

[github-actions]

✅ WordPress Plugin Check Report

✅ Status: Passed

📊 Report

All checks passed! No errors or warnings found.

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check