Add Secure Software Development Lifecycle / Software Bill Of Materials actions

.github/workflows/ci.yml

@@ -21,15 +21,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [actionlint, zizmor]
+        target: [actionlint]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Run ${{ matrix.target }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: make ${{ matrix.target }}
 
   slack_action_payload:

.github/workflows/sbom.yml

@@ -0,0 +1,19 @@
+name: ssdlc-sbom
+
+on:
+  release:
+    types: [published]
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  actions: read
+
+jobs:
+  sbom:
+    uses: mozilla/ssdlc-actions/.github/workflows/ssdlc-sbom.yml@5cc2b20e42d53d1643853f12244fbec9ed2f2e0c
+    with:
+      sbom_name: ${{ github.event.release.tag_name || github.sha }}

.github/workflows/ssdlc-actions.yml

@@ -0,0 +1,17 @@
+name: SSDLC Actions
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  code-security-analysis:
+    permissions:
+      security-events: write # required for uploading code scanning alerts
+    uses: mozilla/ssdlc-actions/.github/workflows/code-security-analysis-public-repo.yml@ca8be48f3c06204fb16a3bd5ffa6d916782bbc76 # v1

Makefile

@@ -1,7 +1,3 @@
 .PHONY: actionlint
 actionlint: ## lint github action workflows
 	docker compose -f docker-compose.tools.yml run --rm actionlint
-
-.PHONY: zizmor
-zizmor: ## run zizmor to check for security issues in GitHub Actions workflows
-	docker compose -f docker-compose.tools.yml run --rm zizmor ./.github

docker-compose.tools.yml

@@ -10,9 +10,3 @@ services:
   actionlint:
     extends: base
     image: rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
-
-  zizmor:
-    extends: base
-    image: ghcr.io/zizmorcore/zizmor:1.26.1@sha256:d1117e5dbd9ee4970644067b534ab6ab50371f3c6f7f4d05446eb603a6e78f48
-    environment:
-      - GH_TOKEN