chore(ci): bump zizmor 1.25.2 -> 1.29.0 — the auditor that gates our merges was four minors behind - #379
Merged
Merged
Conversation
The first bump surfaced by the new pin report (#378). zizmor audits these workflows and gates the merge, so four minors behind meant auditing our own supply chain with a scanner missing four releases of rules — the reason #373 called it the one that matters. Verified locally first: 1.29.0 against the current workflows reports no new findings (offline mode, so the online audits are not covered there). The Workflow audit check on this PR runs it ONLINE with a token, which is the real gate — and this PR's own zizmor job is exactly the verification the old bot-PR design promised and never once delivered (#376).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first bump surfaced by the new pin report (#378), and the one #373 called out as mattering most.
zizmor audits these workflows and gates the merge — it queries the GitHub Advisory Database so a
CVE disclosed against a pinned action fails the check. Four minors behind meant auditing our own
supply chain with a scanner missing four releases of rules, with nothing anywhere reporting that.
What was run
zizmor 1.29.0against the current workflows, before writing the bump:So this is a clean bump, not a bump plus a pile of new findings to triage.
Caveat, and it is the important one: that local run was in zizmor's offline mode, which
disables the online audits — including
known-vulnerable-actions, the one that actually queries theadvisory database. The Workflow audit check on this PR runs it online with a token, and that is
the real gate. If it finds something the local run could not, that finding is the point of this
PR, not an obstacle to it.
make lint-actionsandyamllint --strictclean.Why this PR is worth noting beyond the version number
This is exactly the verification the old bot-PR design promised and never once delivered (#376): the
new tool running its own check, on the branch that bumps it. It just took a human opening the PR,
because
GITHUB_TOKENcannot push a workflow file.Remaining on #378 after this: actionlint
1.7.7→1.7.12, diff-cover10.3.0→10.5.1,jq
1.7.1→1.8.2. Each wants the same treatment — one PR, its own check as the gate. jq's is theonly one that also needs a recomputed
JQ_SHA256.