PE-8787: upgrade kairos v4.1.2 & kairos-init v0.16.1

[Yogeshwar-Pawade]

Summary

Bumps kairos to v4.1.2 and kairos-init to v0.16.1 across every base-image path, and drops the UKI-only KAIROS_VERSION=v3.5.9 workaround from Earthfile since the upstream sd-boot fix has shipped.

Version bumps

Target	kairos-init	KAIROS_VERSION
Ubuntu 22/24 (kairosify)	v0.16.1	v4.1.2 (Earthfile)
Ubuntu 24.04 UKI	v0.16.1	v4.1.2 (workaround removed)
OpenSUSE 15.6	v0.16.1	v4.1.2
SLEM 5.4/5.5	v0.16.1	v4.1.2
RHEL 8/9	v0.16.1	v4.1.2
RHEL 8/9 (satellite)	v0.16.1	v4.1.2
RHEL STIG 9 / STIG 9-FIPS	v0.16.1	v4.1.2
RHEL FIPS 8/9	v0.16.1	v4.1.2
Ubuntu FIPS 20/22/24	v0.16.1	v4.1.2

Files changed (13)

• Earthfile — bump ARG KAIROS_VERSION v4.0.4 → v4.1.2 and remove the IF IS_UKI=true LET KAIROS_VERSION=v3.5.9 END block
• rhel-core-images/Dockerfile.rhel{8,8.sat,9,9.sat}
• rhel-fips/Dockerfile.rhel{8,9}
• rhel-stig/Dockerfile.rhel9{,-fips}
• slem/Dockerfile
• ubuntu-fips/20.04/Dockerfile
• ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips
• ubuntu-fips/24.04/Dockerfile.ubuntu24.04-fips

Test plan

• Verify Reset preserves grub options as-before
• Verify upgrade path kairos 4.0.3 → 4.1.2.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	19
Total	19

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (12 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 50–108 (cols 8–13) — this step
• Line 57 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 52 (cols 8–11) — this run block
• Line 58 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 59 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 60 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 61 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 62 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 8 more location(s) in this file.

unpinned-uses — High (5 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 119 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 122 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 128 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 150 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.