CI: Add ansys/actions/check-actions-security action and related fixes
#6743
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…nes for those using secrets
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6743 +/- ##
==========================================
- Coverage 83.25% 83.16% -0.10%
==========================================
Files 246 246
Lines 77491 77493 +2
==========================================
- Hits 64519 64445 -74
- Misses 12972 13048 +76 🚀 New features to boost your workflow:
|
Samuelopez-ansys
previously approved these changes
Oct 9, 2025
There was a problem hiding this comment.
Thanks for those changes @ecoussoux-ansys I left a few changes propositions
SMoraisAnsys
approved these changes
Oct 10, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces the
ansys/actions/check-actions-securityaction in the workflow file.github/workflows/ci_cd.ymland consequently in the CI ofpyaedtas requested in #6713.This action is using
zizmorto perform an audit of the workflows defined in the.github/workflowsfolder.More information on the approach for introducing the action is provided here, while instructions for fixing common workflow vulnerabilities and the rationale for addressing them are provided here.
The PR addresses the findings surfaced by the
zizmoraudit on the workflow files (performed locally), resulting in the following changes:persist-credentials: falseis now systematically used with the actionactions/checkout,(${{ ... }})are removed from plain run steps inside jobs. Inputs and relevant context variables are expanded in theenvblock instead,permissionsare now defined on a job by job basis while none are granted at the workflow level. Jobs that do not use secrets are not granted any specific permission,label.ymlfile is fixed,ci_cd.ymlis fixed (more details on this fix here).Note that
zizmorfindings of the type "note[self-hosted-runner]: runs on a self-hosted runner" (see related documentation here) are not addressed by the present changes.These findings cannot actually be fixed (since self-hosted runners are required for
pyaedt), but they can be silenced: Based on the implementation of this particular check, it appears that not putting theself-hostedparameter of the job'sruns-onargument first will result inzizmornot raising a finding. However, GitHub's documentation states thatself-hostedmust come first in the array provided forruns-on, hence the decision to not apply any change to get rid of the related findings.A different approach was adopted in ansys/pyedb#1575 due to the presence - prior to that PR - of array declarations for
runs-onwithself-hostednot being declared as the first item (which does not seem to be causing issues in the workflow).For further reference, here are a few PRs applying similar changes from other pyansys projects: ansys/pre-commit-hooks#352, ansys/ansys-tools-visualization-interface#366, ansys/pyansys-geometry#2277.
Lastly, the latest release v10.1.4 of
ansys/actionsis used here.Close #6713.