Skip to content

CHORE Zizmor: branch protection for GH workflows #3103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
BenjaminBossan wants to merge 3 commits into
base: main
Choose a base branch
from
+17 −5
Open

CHORE Zizmor: branch protection for GH workflows #3103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1285d79
CHORE Zizmor: branch protection for GH workflows
BenjaminBossan Mar 16, 2026
9c73348
Remove wrong branch protection rule
BenjaminBossan Mar 16, 2026
a46d174
Fix Zizmor config
BenjaminBossan Mar 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/build_docker_images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ env:
jobs:
latest-cpu:
name: "Latest Peft CPU [dev]"
# GH Environment for extra protection: https://github.com/huggingface/peft/settings/environments
environment: branch-protection-main
Comment on lines +21 to +22
Copy link
Collaborator

@githubnemo githubnemo Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this mean that when testing a change for, say, building & pushing the container the build will now fail at the push stage since the secret is not available? Maybe we should document that this will limit the token availability to main so that we don't trip over this in the future.

Copy link
Member Author

@BenjaminBossan BenjaminBossan Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When testing a change to the docker build, we only run https://github.com/huggingface/peft/blob/main/.github/workflows/test-docker-build.yml, i.e. only building it but not pushing it, so that should be fine. AFAICT, we don't have testing where we also push the docker image.

runs-on:
group: aws-general-8-plus
steps:
Expand Down Expand Up @@ -51,6 +53,8 @@ jobs:

latest-cuda:
name: "Latest Peft GPU [dev]"
# GH Environment for extra protection: https://github.com/huggingface/peft/settings/environments
environment: branch-protection-main
runs-on:
group: aws-general-8-plus
steps:
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/deploy_method_comparison_app.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ permissions: {}

jobs:
deploy:
# GH Environment for extra protection: https://github.com/huggingface/peft/settings/environments
environment: branch-protection-main
runs-on: ubuntu-latest
steps:
- name: Checkout code
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/tests-main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ permissions: {}

jobs:
tests:
# GH Environment for extra protection: https://github.com/huggingface/peft/settings/environments
environment: branch-protection-main
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down
14 changes: 9 additions & 5 deletions .github/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,15 @@ rules:
# the docker buildx binary is cached and zizmor warns about a cache poisoning attack.
# OTOH this cache would make us more resilient against an intrusion on docker-buildx' side.
# There is no obvious benefit so we leave it as it is.
- build_docker_images.yml:37:9
- build_docker_images.yml:70:9
- build_docker_images.yml:103:9
- build_docker_images.yml:136:9
- build_docker_images.yml:169:9
- build_docker_images.yml:39:9
- build_docker_images.yml:74:9
secrets-outside-env:
ignore:
# Zizmor warns about HF_TOKEN being used there but the token is not exposed to external users:
# > With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository.
# https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets#using-secrets-in-a-workflow
# Moreover, the workflow needs to be manually triggered by maintainers, who will review the code first
- tests.yml:131:25
unpinned-images:
ignore:
# We want to test these images with the latest version and we're not using them
Expand Down
Loading