← Watch feed

Informational 18 Bitcoin Committed Jul 27, 2026 · 10:10 UTC

chore(ci): applying zizmor findings to UI flows workflow [no changelog]

Trezor/Trezor firmware

2752c296 View source ↗

Public commit record

What the developer wrote

Authored by Michal Kazda

77/100 · Adequate

chore(ci): applying zizmor findings to UI flows workflow
[no changelog]

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body

The short version

What changed, and why it matters

This commit tightens two GitHub Actions workflow files that run translation-related UI tests. It moves broad workflow-level AWS login permission down to only the specific jobs that need it, stops Git from keeping reusable login credentials after checking out code, and replaces direct use of user-provided language input with an environment variable to reduce injection risks. These are defensive hardening changes rather than fixes for a known active attack.

Recommended action

Treat as routine CI hardening. Review that all jobs needing AWS OIDC have id-token: write, verify no other user inputs are directly interpolated into shell scripts, and consider running zizmor or a similar linter continuously on workflow changes.

Security signals we found

Workflow permission scope reduction (id-token: write moved to job level)

actions/checkout persist-credentials: false added

User-controlled workflow input (inputs.languages) moved to environment variable before shell interpolation

Artifact path changed to new build output location

Commit title references zizmor (GitHub Actions static analysis/hardening tool)

Technical analysis

Evidence from the diff

The patch applies zizmor-recommended hardening to .github/workflows/crowdin-ui-check.yml and crowdin-ui-check-reuse.yml. Changes include: (1) scoping id-token: write permission from workflow-level to job-level in the reusable workflow and adding it to the reusable-workflow call sites; (2) setting persist-credentials: false on actions/checkout to prevent long-lived Git credentials in the runner; (3) moving inputs.languages into an env var (INPUTS_LANGUAGES) before interpolation into shell commands to mitigate template-injection; and (4) updating artifact paths from core/build/unix/trezor-emu-core to core/build-xtask/artifacts/latest/firmware-emu. No product firmware code is changed.

Changed components

.github/workflows/crowdin-ui-check.yml.github/workflows/crowdin-ui-check-reuse.yml

Inspect captured patch +19 / −9

diff --git a/.github/workflows/crowdin-ui-check-reuse.yml b/.github/workflows/crowdin-ui-check-reuse.yml
index a75b8c10..f3f28a75 100644
--- a/.github/workflows/crowdin-ui-check-reuse.yml
+++ b/.github/workflows/crowdin-ui-check-reuse.yml
@@ -8,12 +8,11 @@ on:
         required: true
         type: string
 
-permissions:
-  id-token: write  # for fetching OIDC token for AWS
 
 env:
   CROWDIN_COMMENT_PATH: ${{ github.workspace }}/tests/core-crowdin-comment.md
   TREZOR_PYTEST_LOGS_DIR: ${{ github.workspace }}/tests/
+  INPUTS_LANGUAGES: ${{ inputs.languages }}
 
 jobs:
   core_context_tests:
@@ -25,6 +24,9 @@ jobs:
         model: [T2T1, T3B1, T3T1, T3W1]
         language: ${{ fromJSON(inputs.languages) }}
 
+    permissions:
+      id-token: write  # for fetching OIDC token for AWS
+
     env:
       TREZOR_PROFILING: 0
       TREZOR_MODEL: ${{ matrix.model }}
@@ -37,11 +39,12 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # actions/download-artifact@v8.0.0
         with:
           name: core-emu-${{ matrix.model }}-universal-debuglink-noasan
-          path: core/build/unix
-      - run: chmod +x core/build/unix/trezor-emu-core*
+          path: core/build-xtask/artifacts/latest
+      - run: chmod +x core/build-xtask/artifacts/latest/firmware-emu*
       - uses: ./.github/actions/environment
       - run: nix-shell --run "uv run make -C core test_emu_multicore"
       - run: tail -v -n50 tests/trezor*.log || true
@@ -59,17 +62,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
+        with:
+          persist-credentials: false
       - run: sleep 1m  # to avoid GitHub API rate limit
       - run: |
-          python ci/make_crowdin_comment.py "${{ github.run_id }}" '${{ inputs.languages }}' > ${{ env.CROWDIN_COMMENT_PATH }}
-          cat ${{ env.CROWDIN_COMMENT_PATH }} >> $GITHUB_STEP_SUMMARY
+          python ci/make_crowdin_comment.py "${{ github.run_id }}" "${INPUTS_LANGUAGES}" > ${CROWDIN_COMMENT_PATH}
+          cat ${CROWDIN_COMMENT_PATH} >> $GITHUB_STEP_SUMMARY
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7  # aws-actions/configure-aws-credentials@v6.0.0
         with:
           role-to-assume: arn:aws:iam::538326561891:role/gh_actions_deploy_dev_firmware_data
           aws-region: eu-west-1
-      - run: python ci/make_summary_htmls.py "index" '${{ inputs.languages }}' "tests/ui_tests/reporting/"
-      - run: python ci/make_summary_htmls.py "diff" '${{ inputs.languages }}' "tests/ui_tests/reporting/"
+      - run: python ci/make_summary_htmls.py "index" "${INPUTS_LANGUAGES}" "tests/ui_tests/reporting/"
+      - run: python ci/make_summary_htmls.py "diff" "${INPUTS_LANGUAGES}" "tests/ui_tests/reporting/"
       - name: Upload per-language HTML summaries to S3
         run: |
           cd tests/ui_tests/reporting/
diff --git a/.github/workflows/crowdin-ui-check.yml b/.github/workflows/crowdin-ui-check.yml
index 7d3fb399..c051bcd3 100644
--- a/.github/workflows/crowdin-ui-check.yml
+++ b/.github/workflows/crowdin-ui-check.yml
@@ -39,13 +39,14 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # actions/checkout@v6.0.2
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: ./.github/actions/environment
       - run: nix-shell --run "uv run make -C core build_unix_frozen"
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # actions/upload-artifact@v7.0.0
         with:
           name: core-emu-${{ matrix.model }}-universal-debuglink-noasan
           path: |
-            core/build/unix/trezor-emu-core*
+            core/build-xtask/artifacts/latest/firmware-emu*
           retention-days: 7
 
   # Context tests for Core. Generates screenshots of UI flows of curated list of tests
@@ -53,6 +54,8 @@ jobs:
   core_context_tests_single_language:
     needs: core_emu
     if: ${{ !inputs.all-languages }}
+    permissions:
+      id-token: write  # for fetching OIDC token for AWS in reusable workflow jobs
     uses: ./.github/workflows/crowdin-ui-check-reuse.yml
     with:
       languages: '["en", "${{ inputs.language }}"]'
@@ -60,6 +63,8 @@ jobs:
   core_context_tests_all_languages:
     needs: core_emu
     if: ${{ inputs.all-languages }}
+    permissions:
+      id-token: write  # for fetching OIDC token for AWS in reusable workflow jobs
     uses: ./.github/workflows/crowdin-ui-check-reuse.yml
     with:
       languages: '["en", "cs", "fr", "de", "es", "pt"]'

Risk score

Why this scored 18/100

Our methodology →

Potential impact 2/30

Exploitability 2/25

Stealth signal 3/15

Affected reach 2/15

Confidence 6/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 18/100

Community notes

Related watches

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding

test(core): test RLP self-encoding bytestrings

chore(core): remove sha1 from regular FW