DEVOPS-977: use v3 of zizmor github workflows#105
Conversation
github-actions
bot
changed the title
There was a problem hiding this comment.
Pull request overview
Updates the repository’s GitHub Actions security scan workflow to use v3 of the shared zizmor reusable workflows from MiraGeoscience/CI-tools.
Changes:
- Bump reusable workflow reference for zizmor “advanced security” from
@v2to@v3. - Bump reusable workflow reference for zizmor “annotate” from
@v2to@v3.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
.github/workflows/security_scan.yml
Outdated
| contents: read | ||
| actions: read | ||
| uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v2 | ||
| uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 |
There was a problem hiding this comment.
The job id call-workflow-zizmor-annotate is misleading here because this job runs the "advanced security" workflow (reusable-zizmor-advanced-security.yml). Consider renaming the job key to reflect what it actually executes to reduce confusion in logs and future needs: references.
.github/workflows/security_scan.yml
Outdated
| @@ -40,4 +40,4 @@ jobs: | |||
| checks: write | |||
| contents: read | |||
| actions: read | |||
| uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v2 | |||
| uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 | |||
There was a problem hiding this comment.
The job id call-workflow-zizmor-advanced-security is misleading here because this job runs the "annotate" workflow (reusable-zizmor-annotate.yml) for pull requests. Consider renaming the job key to match the workflow being called for clarity and to avoid confusion if other jobs depend on it via needs:.
andrewg-mira
force-pushed
the
DEVOPS-977-zizmor-patch
branch
from
d791949 to
4fa3854
Compare
sebhmg
left a comment
sebhmg
left a comment
There was a problem hiding this comment.
All required checks passed. Approving for merge.
DEVOPS-977 - Zizmor: Allow trusted tag-pinned github actions