Mint read-only App token for zizmor audit - #29

LLM Description written by Claude Code:claude-fable-5-1

The required Audit GitHub Actions check aborts in any repository that pins an action or reusable workflow from another private Socket repository. zizmor's online impostor-commit and ref-confusion audits list the target repository's refs; the repository GITHUB_TOKEN cannot read another private repository, the error is fatal, and zizmor exits with fatal: no audit was performed. First instance: depscan#26088, which pins SocketDev/patchpedia/.github/workflows/*-drop.yaml@<sha> (failing job). zizmor 1.23.1 has no per-file or per-repository escape (ignore rules filter findings after the audit; upstream zizmor#1350 recommends a token with access).

Change

When the audited repository provides vars.ZIZMOR_AUDIT_APP_CLIENT_ID, secrets.ZIZMOR_AUDIT_APP_PRIVATE_KEY and vars.ZIZMOR_AUDIT_REPOSITORIES, mint a contents: read installation token restricted to the repositories named in ZIZMOR_AUDIT_REPOSITORIES and pass it to zizmor. Everything else falls back to GITHUB_TOKEN, so repositories without those values behave exactly as today.

• Minting is skipped for Dependabot actors and cross-repository pull requests (neither receives Actions secrets) and runs with continue-on-error, so a failed mint still falls back instead of failing the audit.
• Report token source logs minted or fallback GITHUB_TOKEN so the effective mode is visible in the job log.
• actions/create-github-app-token is pinned to the same SHA depscan uses (v3.2.0). The token is revoked in the action's post step.
• secrets-outside-env is suppressed inline for the one secret reference; this workflow intentionally runs without an environment. Negative check: removing the comment yields one Medium finding (exit 13).

Provisioning (platform, before any repository opts in)

1. Create a dedicated GitHub App (for example socket-zizmor-audit) with repository permissions Metadata: read and Contents: read only, no other permissions, no webhook.
2. Install it on the org, limited to the repositories that audited workflows reference (for depscan: patchpedia) plus the consuming repositories.
3. Add org variable ZIZMOR_AUDIT_APP_CLIENT_ID and org secret ZIZMOR_AUDIT_APP_PRIVATE_KEY, visible only to consuming repositories.
4. Each consuming repository sets ZIZMOR_AUDIT_REPOSITORIES (comma-separated) to exactly the private repositories its workflows pin. depscan: patchpedia.

The first revision of this PR reused the Socket PR App credentials. Review feedback rejected that: its installation-wide token would expose every installed repository if leaked, and that App's private key can mint contents: write, pull-requests: write and actions: write tokens, so it is not a read-only credential. This revision keeps the key that this job can see limited to an App whose installation is itself read-only and repository-scoped.

Trust boundary

Pre-existing: the audit reads zizmor.yml, ignore comments and .gitignore from the PR checkout. New: the audit job holds a short-lived read-only token for the allowlisted repositories, used only for zizmor's API calls (zizmor does not execute workflows), and can reference the dedicated App's private key when the repository exposes it.

Validation

• zizmor==1.23.1 .github --min-severity medium on this branch: no findings, exit 0.
• actionlint 1.7.12: clean, including the multi-line if:.
• The PR's own Audit GitHub Actions run scans this file (1 ignored finding = the inline comment). Required workflows run the master definition on PRs, so the new steps execute live only after merge; live proof is a fresh depscan#26088 run showing audit token: minted once provisioning is done.

This replaces the closed #28, which scoped a depscan-specific impostor-commit exception via a double scan; this change keeps provenance auditing enabled everywhere.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FqKyQNqkiw7aakGFPCTg9t