ci: satisfy zizmor policy in remaining workflows - #2941
Open
IzaakGough wants to merge 1 commit into
Open
Conversation
The GitHub Actions Scan check runs zizmor over any workflow file a PR touches, and fails on its mandatory rules and on medium findings. validate.yml was already brought in line; this does the same for the other four. Actions are pinned to the commit each moving tag resolves to today, so nothing changes about what runs. Adds read-only permissions blocks to test.yml and readmes-updated.yml, contents: write to release.yml since it creates releases, and passes a step output through env in readmes-updated.yml instead of interpolating it into the run body. Verified with zizmor 1.25.2 and the org config the check downloads: no mandatory or medium findings remain.
Contributor
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
IzaakGough
marked this pull request as ready for review
August 13, 2026 10:16
Member
|
Sorry I didn't see this. I have another PR to add a release action for kits and it forced me to fix zizmor already so this may not be necessary. |
Author
|
no worries, I can close this if not needed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The GitHub Actions Scan check runs zizmor over any workflow file a PR touches, and fails on its mandatory rules (
unpinned-uses,template-injection, and five others) as well as on any medium finding.validate.ymlwas brought in line in #2928; this does the same for the other four, so touching them no longer blocks a PR.test.ymlandreadmes-updated.ymlgetcontents: read;release.ymlgetscontents: writebecauserelease.shcreates releases.readmes-updated.ymlpasses the npm prefix step output throughenvrather than interpolating it into therunbody, which is thetemplate-injectionfinding.Verified locally with zizmor 1.25.2 and the org config the check downloads: no mandatory and no medium findings remain across all five workflows. Six low
artipackedfindings (checkout withoutpersist-credentials: false) are left as they are, since the gate allows low.validate.ymlstays on the checkout and setup-node pins it already has, v3.6.0 and v3.8.1 against the v3.7.0 and v3.9.1 pinned here, rather than widening the diff.