open-telemetry / open-telemetry/shared-workflows
Support Zizmor SARIF uploads from private repositories
@trask is already working on this.
Since Sep 17, 2026.
- Dominant language
- No language data
- Stars
- 7
- Forks
- 18
- Avg merge
- 22h 1m
- Merged PRs (30d)
- 75
Description
The reusable Zizmor workflow cannot upload SARIF results from private repositories. github/codeql-action/upload-sarif reads workflow-run metadata during processing, which requires actions: read in both the caller and reusable workflow.
Adding actions: read to the existing reusable job changes its permission contract. Callers that upgrade without granting the new permission can be rejected before the job runs, even though public repositories do not need it.
Add a backward-compatible private-repository path, such as a separate reusable workflow or an explicit opt-in that leaves existing public callers unchanged.
Acceptance criteria:
- A private repository caller can complete the Zizmor audit and SARIF upload.
- Existing public caller configuration continues to work unchanged.
- Consumer documentation shows the private-repository configuration.
- The behavior is verified from a private repository.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.