[OPIK-6366] [INFRA] feat: add zizmor security scan for GitHub Actions workflows

.github/workflows/backend_tests.yml

@@ -23,8 +23,6 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 permissions:
   contents: read
-  checks: write
-  pull-requests: write
 
 jobs:
     # Automatically classify tests as unit/integration and split integration
@@ -53,6 +51,12 @@ jobs:
         name: ${{ matrix.name }}
         runs-on: ubuntu-latest
         timeout-minutes: ${{ matrix.timeout }}
+        # Only the "Publish Test Report" step needs these; keep them off the
+        # workflow-level default (least privilege).
+        permissions:
+          contents: read
+          checks: write
+          pull-requests: write
         defaults:
           run:
             working-directory: apps/opik-backend/

.github/workflows/build_and_publish_sdk.yaml

@@ -37,11 +37,14 @@ jobs:
         steps:
         - name: Setup
           id: setup
+          env:
+            INPUT_VERSION: ${{ inputs.version }}
+            REF_NAME: ${{ github.ref_name }}
           run: |
-            if [[ "${{inputs.version}}" == ""  ]]; then
-              echo "build_from=${{github.ref_name}}" | tee -a "$GITHUB_OUTPUT"
+            if [[ "${INPUT_VERSION}" == ""  ]]; then
+              echo "build_from=${REF_NAME}" | tee -a "$GITHUB_OUTPUT"
             else
-              echo "build_from=${{inputs.version}}" | tee -a "$GITHUB_OUTPUT"
+              echo "build_from=${INPUT_VERSION}" | tee -a "$GITHUB_OUTPUT"
             fi
         - name: Checkout
           uses: actions/checkout@v6
@@ -62,10 +65,12 @@ jobs:
             package_name: opik
 
         - name: Build pip package
+          env:
+            INPUT_VERSION: ${{ inputs.version }}
           run: |
                 cd sdks/python
                 pip3 install -U pip build
-                if [[ "${{inputs.version}}" != "" ]]; then export VERSION=${{inputs.version}};fi
+                if [[ "${INPUT_VERSION}" != "" ]]; then export VERSION="${INPUT_VERSION}";fi
                 python3 -m build --sdist --wheel --outdir dist/ .
 
         - name: Publish package distributions to PyPI

.github/workflows/build_and_push_docker.yaml

@@ -64,19 +64,23 @@ jobs:
     steps:
       - name: Generate build and merge matrices
         id: set-matrix
+        env:
+          BUILD_COMET_IMAGE: ${{ inputs.build_comet_image }}
+          BUILD_ARM64: ${{ inputs.build_arm64 }}
+          IMAGE: ${{ inputs.image }}
         run: |
           # Build 2D matrix: image_type x platform
           BUILD_MATRIX='{"image_type":["regular","comet"],"platform":["amd64","arm64"],"exclude":[]}'
           MERGE_MATRIX='{"image_type":["regular","comet"],"exclude":[]}'
-          
+
           # Exclude comet if build_comet_image is false
-          if [[ "${{ inputs.build_comet_image }}" != "true" ]]; then
+          if [[ "${BUILD_COMET_IMAGE}" != "true" ]]; then
             BUILD_MATRIX=$(echo "$BUILD_MATRIX" | jq '.exclude += [{"image_type":"comet"}]')
             MERGE_MATRIX=$(echo "$MERGE_MATRIX" | jq '.exclude += [{"image_type":"comet"}]')
           fi
-          
+
           # Exclude arm64 when the caller opts out, or for guardrails backend
-          if [[ "${{ inputs.build_arm64 }}" != "true" ]] || [[ "${{ inputs.image }}" == "opik-guardrails-backend" ]]; then
+          if [[ "${BUILD_ARM64}" != "true" ]] || [[ "${IMAGE}" == "opik-guardrails-backend" ]]; then
             BUILD_MATRIX=$(echo "$BUILD_MATRIX" | jq '.exclude += [{"platform":"arm64"}]')
           fi
 
@@ -108,11 +112,14 @@ jobs:
     steps:
       - name: Set image variables
         id: set_vars
+        env:
+          IMAGE_TYPE: ${{ matrix.image_type }}
+          IMAGE: ${{ inputs.image }}
         run: |
-          if [[ "${{ matrix.image_type }}" == "comet" ]]; then
-            IMAGE_NAME="${{ inputs.image }}-comet"
+          if [[ "${IMAGE_TYPE}" == "comet" ]]; then
+            IMAGE_NAME="${IMAGE}-comet"
           else
-            IMAGE_NAME="${{ inputs.image }}"
+            IMAGE_NAME="${IMAGE}"
           fi
           echo "image_name=$IMAGE_NAME" >> "$GITHUB_OUTPUT"
 
@@ -123,15 +130,18 @@ jobs:
 
       - name: Save opik-sandbox-executor-python
         if: inputs.image == 'opik-python-backend'
+        env:
+          IS_ADHOC: ${{ inputs.is_adhoc }}
+          INPUT_VERSION: ${{ inputs.version }}
         run: |
           # Use latest tag if adhoc build, otherwise use the specific version
-          if [[ "${{ inputs.is_adhoc }}" == "true" ]]; then
+          if [[ "${IS_ADHOC}" == "true" ]]; then
             TAG="latest"
           else
-            TAG="${{inputs.version}}"
+            TAG="${INPUT_VERSION}"
           fi
-          docker pull "${{env.DOCKER_REGISTRY}}/opik-sandbox-executor-python:$TAG"
-          docker save "${{env.DOCKER_REGISTRY}}/opik-sandbox-executor-python:$TAG" | gzip > apps/opik-python-backend/opik-sandbox-executor-python.tar.gz
+          docker pull "${DOCKER_REGISTRY}/opik-sandbox-executor-python:$TAG"
+          docker save "${DOCKER_REGISTRY}/opik-sandbox-executor-python:$TAG" | gzip > apps/opik-python-backend/opik-sandbox-executor-python.tar.gz
 
       - name: Checkout ai-spend plugin (private)
         if: inputs.image == 'opik-frontend' && matrix.image_type == 'comet'
@@ -217,11 +227,14 @@ jobs:
     steps:
       - name: Set image variables
         id: set_vars
+        env:
+          IMAGE_TYPE: ${{ matrix.image_type }}
+          IMAGE: ${{ inputs.image }}
         run: |
-          if [[ "${{ matrix.image_type }}" == "comet" ]]; then
-            IMAGE_NAME="${{ inputs.image }}-comet"
+          if [[ "${IMAGE_TYPE}" == "comet" ]]; then
+            IMAGE_NAME="${IMAGE}-comet"
           else
-            IMAGE_NAME="${{ inputs.image }}"
+            IMAGE_NAME="${IMAGE}"
           fi
           echo "image_name=$IMAGE_NAME" >> "$GITHUB_OUTPUT"
 
@@ -298,13 +311,19 @@ jobs:
           docker buildx imagetools create $TAG_ARGS $DIGESTS
 
       - name: Write Build Summary
+        env:
+          IMAGE_NAME: ${{ steps.set_vars.outputs.image_name }}
+          META_TAGS: ${{ steps.meta.outputs.tags }}
+          IMAGE: ${{ inputs.image }}
+          BUILD_ARM64: ${{ inputs.build_arm64 }}
+          REPOSITORY: ${{ github.repository }}
         run: |
-          echo "### Docker images pushed: ${{ steps.set_vars.outputs.image_name }}" >> "$GITHUB_STEP_SUMMARY"
-          echo "${{ steps.meta.outputs.tags }}" >> "$GITHUB_STEP_SUMMARY"
-          if [[ "${{ inputs.image }}" == "opik-guardrails-backend" ]] || [[ "${{ inputs.build_arm64 }}" != "true" ]]; then
+          echo "### Docker images pushed: ${IMAGE_NAME}" >> "$GITHUB_STEP_SUMMARY"
+          echo "${META_TAGS}" >> "$GITHUB_STEP_SUMMARY"
+          if [[ "${IMAGE}" == "opik-guardrails-backend" ]] || [[ "${BUILD_ARM64}" != "true" ]]; then
             echo "Built for platforms: linux/amd64" >> "$GITHUB_STEP_SUMMARY"
           else
             echo "Built for platforms: linux/amd64, linux/arm64" >> "$GITHUB_STEP_SUMMARY"
           fi
-          echo "- [View on GitHub Container Registry](https://github.com/${{ github.repository }}/pkgs/container/opik%2F${{ steps.set_vars.outputs.image_name }})" >> "$GITHUB_STEP_SUMMARY"
+          echo "- [View on GitHub Container Registry](https://github.com/${REPOSITORY}/pkgs/container/opik%2F${IMAGE_NAME})" >> "$GITHUB_STEP_SUMMARY"
 

.github/workflows/build_apps.yml

@@ -93,17 +93,22 @@ jobs:
 
         - name: Set version
           id: version
+          env:
+            INPUT_VERSION: ${{ inputs.version }}
+            INPUT_REF: ${{ inputs.ref }}
+            REF_NAME: ${{ github.ref_name }}
+            RUN_NUMBER: ${{ github.run_number }}
           run: |
-            if [[ "${{inputs.version}}" != "" ]]; then
-              VERSION=${{inputs.version}}
+            if [[ "${INPUT_VERSION}" != "" ]]; then
+              VERSION="${INPUT_VERSION}"
             else
               BASE_VERSION=$(cat version.txt)
-              BRANCH_NAME="${{ github.ref_name }}"
+              BRANCH_NAME="${REF_NAME}"
               if [[ "${BRANCH_NAME}" == "main" ]]; then
-                VERSION=${BASE_VERSION}-${{ github.run_number }}
+                VERSION="${BASE_VERSION}-${RUN_NUMBER}"
               elif [[ "${BRANCH_NAME}" =~ ^hotfix/.* ]]; then
                 # Special handling for hotfix branches
-                VERSION="${BASE_VERSION}-hotfix.${{ github.run_number }}"
+                VERSION="${BASE_VERSION}-hotfix.${RUN_NUMBER}"
               else
                 # Normalize branch name
                 fixedBranchName=$(echo "${BRANCH_NAME}" | sed 's/origin\///; s/\//-/g; s/_/-/g; s/.*/\L&/')
@@ -114,18 +119,18 @@ jobs:
                     fixedBranchName="${fixedBranchName%?}"
                   done
                 fi
-                VERSION="${BASE_VERSION}-${fixedBranchName}-${{ github.run_number }}"
+                VERSION="${BASE_VERSION}-${fixedBranchName}-${RUN_NUMBER}"
               fi
             fi
             echo "version=${VERSION}" | tee -a "$GITHUB_OUTPUT"
             echo "Version is ${VERSION}" >> "$GITHUB_STEP_SUMMARY"
 
-            if [ "${{inputs.ref}}" != "" ]; then
-              echo "build_from=${{inputs.ref}}" | tee -a "$GITHUB_OUTPUT"
-            elif [[ "${{inputs.version}}" == "" ]]; then
-              echo "build_from=${{github.ref_name}}" | tee -a "$GITHUB_OUTPUT"
+            if [ "${INPUT_REF}" != "" ]; then
+              echo "build_from=${INPUT_REF}" | tee -a "$GITHUB_OUTPUT"
+            elif [[ "${INPUT_VERSION}" == "" ]]; then
+              echo "build_from=${REF_NAME}" | tee -a "$GITHUB_OUTPUT"
             else
-              echo "build_from=${{inputs.version}}" | tee -a "$GITHUB_OUTPUT"
+              echo "build_from=${INPUT_VERSION}" | tee -a "$GITHUB_OUTPUT"
             fi
 
   build-backend:

.github/workflows/code_quality.yml

@@ -33,9 +33,6 @@ concurrency:
 
 permissions:
   contents: read
-  # Needed by the summary job to post/update the sticky timing comment on PRs.
-  # On fork PRs the token is read-only regardless, so that step is guarded.
-  pull-requests: write
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -228,6 +225,12 @@ jobs:
     if: always()
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    # Needed to post/update the sticky timing comment on PRs. On fork PRs the
+    # token is read-only regardless, so that step is guarded. Scoped to this
+    # job rather than the workflow default (least privilege).
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.github/workflows/docker-vulnerability-scan.yaml

@@ -34,11 +34,14 @@ jobs:
     steps:
       - name: Pull Docker image
         id: pull
+        env:
+          IMAGE: ${{ matrix.image }}
+          IMAGE_TAG: ${{ inputs.image-tag || 'main' }}
         run: |
-          IMAGE_URL="${{ env.DOCKER_REGISTRY }}/${{ matrix.image }}:${{ inputs.image-tag || 'main' }}"
+          IMAGE_URL="${DOCKER_REGISTRY}/${IMAGE}:${IMAGE_TAG}"
           echo "Pulling Docker image: ${IMAGE_URL}"
-          docker pull ${IMAGE_URL}
-          BASENAME=$(basename ${IMAGE_URL} | cut -d: -f1)
+          docker pull "${IMAGE_URL}"
+          BASENAME=$(basename "${IMAGE_URL}" | cut -d: -f1)
           REPORT_NAME="trivy_${BASENAME}.txt"
           echo "image-url=${IMAGE_URL}" >> "$GITHUB_OUTPUT"
           echo "report-name=${REPORT_NAME}" >> "$GITHUB_OUTPUT"

.github/workflows/documentation_preview_link.yml

@@ -14,7 +14,10 @@ jobs:
     run:
         runs-on: ubuntu-latest
         timeout-minutes: 15
-        permissions: write-all
+        # Only needs to check out the repo and post the preview-link PR comment.
+        permissions:
+          contents: read
+          pull-requests: write
         steps:
             - name: Checkout repository
               uses: actions/checkout@v6

.github/workflows/e2e_tests_post_merge_v2.yml

@@ -71,15 +71,19 @@ jobs:
 
       - name: "🔍 Get PR/commit information"
         id: get-pr-info
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          COMMIT_AUTHOR: ${{ github.event.head_commit.author.username }}
+          ACTOR: ${{ github.actor }}
         run: |
-          if [ "${{ github.event_name }}" == "push" ]; then
+          if [ "${EVENT_NAME}" == "push" ]; then
             # For push events, get the author from the commit
-            AUTHOR="${{ github.event.head_commit.author.username }}"
+            AUTHOR="${COMMIT_AUTHOR}"
             if [ -z "$AUTHOR" ]; then
-              AUTHOR="${{ github.actor }}"
+              AUTHOR="${ACTOR}"
             fi
           else
-            AUTHOR="${{ github.actor }}"
+            AUTHOR="${ACTOR}"
           fi
           echo "author=$AUTHOR" >> "$GITHUB_OUTPUT"
           echo "📝 Author: $AUTHOR"
@@ -116,8 +120,9 @@ jobs:
         env:
           OPIK_USAGE_REPORT_ENABLED: false
           COMPOSE_BAKE: false
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          echo "::group::Building Opik from branch: ${{ github.ref_name }}"
+          echo "::group::Building Opik from branch: ${REF_NAME}"
           cd ${{ github.workspace }}
           TOGGLE_WELCOME_WIZARD_ENABLED="false" TOGGLE_FORCE_WORKSPACE_VERSION="version_2" ./opik.sh --build
           echo "::endgroup::"
@@ -153,8 +158,8 @@ jobs:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           ALLURE_LAUNCH_NAME: "Opik v2 Post-Merge ${{ github.event.inputs.tier || 't1' }} - ${{ github.run_id }}"
+          TIER: ${{ github.event.inputs.tier || 't1' }}
         run: |
-          TIER="${{ github.event.inputs.tier || 't1' }}"
           echo "========================================"
           echo "🧪 Running v2 tier: $TIER"
           echo "========================================"
@@ -170,7 +175,7 @@ jobs:
           # Run tests with allurectl watch for TestOps integration
           # Capture output to extract the direct report URL
           set +e
-          allurectl watch -- npm run test:${TIER} 2>&1 | tee allure_output.log
+          allurectl watch -- npm run "test:${TIER}" 2>&1 | tee allure_output.log
           TEST_EXIT_CODE=${PIPESTATUS[0]}
           set -e
 
@@ -251,15 +256,20 @@ jobs:
       # ========================================
       - name: "📋 Generate job summary"
         if: always()
+        env:
+          TIER: ${{ github.event.inputs.tier || 't1' }}
+          TESTOPS_URL: ${{ steps.set-outputs.outputs.testops_url }}
+          TOTAL: ${{ steps.parse-results.outputs.total }}
+          PASSED: ${{ steps.parse-results.outputs.passed }}
+          FAILED: ${{ steps.parse-results.outputs.failed }}
+          SKIPPED: ${{ steps.parse-results.outputs.skipped }}
+          RUN_TESTS_OUTCOME: ${{ steps.run-tests.outcome }}
+          REF_NAME: ${{ github.ref_name }}
+          REPOSITORY: ${{ github.repository }}
+          COMMIT_SHA: ${{ github.sha }}
+          TRIGGER_LABEL: ${{ github.event_name == 'push' && 'Post-merge (push to main)' || 'Manual dispatch' }}
+          AUTHOR: ${{ steps.get-pr-info.outputs.author }}
         run: |
-          TIER="${{ github.event.inputs.tier || 't1' }}"
-          TESTOPS_URL="${{ steps.set-outputs.outputs.testops_url }}"
-
-          TOTAL="${{ steps.parse-results.outputs.total }}"
-          PASSED="${{ steps.parse-results.outputs.passed }}"
-          FAILED="${{ steps.parse-results.outputs.failed }}"
-          SKIPPED="${{ steps.parse-results.outputs.skipped }}"
-
           # Redirect stdout to the summary file for the remainder of this step
           exec >> "$GITHUB_STEP_SUMMARY"
 
@@ -268,12 +278,12 @@ jobs:
           echo ""
 
           # Status banner
-          if [ "${{ steps.run-tests.outcome }}" == "success" ]; then
+          if [ "${RUN_TESTS_OUTCOME}" == "success" ]; then
             echo "> ✅ **All tests passed!**"
-          elif [ "${{ steps.run-tests.outcome }}" == "failure" ]; then
+          elif [ "${RUN_TESTS_OUTCOME}" == "failure" ]; then
             echo "> ❌ **$FAILED test(s) failed** - Please review the results below"
           else
-            echo "> ⚠️ **Test run status: ${{ steps.run-tests.outcome }}**"
+            echo "> ⚠️ **Test run status: ${RUN_TESTS_OUTCOME}**"
           fi
           echo ""
 
@@ -283,10 +293,10 @@ jobs:
           echo "| Property | Value |"
           echo "|----------|-------|"
           echo "| **Tier** | \`$TIER\` |"
-          echo "| **Branch** | \`${{ github.ref_name }}\` |"
-          echo "| **Commit** | [\`${GITHUB_SHA:0:7}\`](https://github.com/${{ github.repository }}/commit/${{ github.sha }}) |"
-          echo "| **Trigger** | ${{ github.event_name == 'push' && 'Post-merge (push to main)' || 'Manual dispatch' }} |"
-          echo "| **Author** | @${{ steps.get-pr-info.outputs.author }} |"
+          echo "| **Branch** | \`${REF_NAME}\` |"
+          echo "| **Commit** | [\`${COMMIT_SHA:0:7}\`](https://github.com/${REPOSITORY}/commit/${COMMIT_SHA}) |"
+          echo "| **Trigger** | ${TRIGGER_LABEL} |"
+          echo "| **Author** | @${AUTHOR} |"
           echo ""
 
           # Results table
@@ -310,7 +320,7 @@ jobs:
           echo ""
 
           # Debugging section (only on failure)
-          if [ "${{ steps.run-tests.outcome }}" == "failure" ]; then
+          if [ "${RUN_TESTS_OUTCOME}" == "failure" ]; then
             echo "## 🔧 Debugging Guide"
             echo ""
             echo "### Quick steps to investigate failures:"