Kairos init

[Dr-N00B]

Pending:

1. MAAS changes
2. AMI image verification. Changes are present.

[bulwark-spectrocloud]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.