Bare pin comments + zizmor-action v0.6.0 (and the findings it surfaces) - #53
Conversation
…aces Move the release.yml zizmor ignore to its own line so Dependabot can maintain the bare version comment natively (same restructure as basecamp-sdk#458), and bump zizmor-action v0.5.2 -> v0.6.0 so the audit runs a zizmor that associates standalone ignore comments (v0.5.2 resolves a 1.23-era zizmor that does not). The newer zizmor surfaces real issues, fixed here rather than ignored: - create-github-app-token uses gain permission-contents scoping (write for the skills sync push; read for the seed templates' private-module access), with an annotated ignore for the seed templates' deliberate owner-wide default that ships disabled until seeded repos scope repositories: to their private modules - seed trivy-action was pinned to e368e328, a commit no tag points at; repin to ed142fd0 (v0.36.0), the SHA the rest of the fleet uses - seed compound pin comments get the same standalone-ignore restructure
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8f21544a02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s GitHub Actions security/audit setup to support the “bare pin comment” style for Dependabot-managed version comments and bumps zizmor-action to a version that correctly associates standalone # zizmor: ignore[...] annotations, addressing newly surfaced findings in seed workflows.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Changes:
- Bump
zizmorcore/zizmor-actionfromv0.5.2tov0.6.0in the repo audit workflow. - Restructure zizmor ignore annotations onto their own lines where needed (to keep pin comments “bare”).
- Update seed workflows to (a) repin Trivy action and (b) scope GitHub App token contents permissions (noting one seed permission mismatch in
sync-skills).
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
seed/.github/workflows/test.yml |
Adds scoped permission-contents: read to seeded App tokens for private module access. |
seed/.github/workflows/security.yml |
Repins Trivy action to a new SHA/tag and scopes App token contents permission for security scans. |
seed/.github/workflows/release.yml |
Splits zizmor ignores off pinned uses: lines and adds App token contents scoping (with a sync-skills permission that needs adjustment). |
.github/workflows/test.yml |
Bumps zizmor-action to v0.6.0 for improved ignore association. |
.github/workflows/release.yml |
Moves zizmor ignore to its own line and scopes the skills-sync App token to contents: write. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Review feedback (Codex): the Homebrew tap token pushes the formula and the skills token pushes skill files; both need permission-contents: write, not read. The skills token is already scoped via repositories: so its owner line needs no github-app ignore.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: da79000ed1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Part of the post-merge redesign of the comment-sync program (see basecamp/.github#10). Moving each
# zizmor: ignore[...]to its own line below the pin makes Dependabot itself maintain the bare# vX.Y.Zcomments — no push automation needed on its PRs.For this repo that requires bumping zizmor-action v0.5.2 → v0.6.0 first: v0.5.2 resolves a 1.23-era zizmor that doesn't associate standalone ignore comments. The newer zizmor surfaces real issues, fixed rather than suppressed:
create-github-app-tokenuses gainpermission-contents(write for the skills-sync push —scripts/sync-skills.shonly doesgit push; read for the seed templates' private-module access). The seed templates' owner-wide default (deliberate: ships disabled until a seeded repo scopesrepositories:) carries an annotated ignore.e368e328is a commit no tag points at (why the earlier catch-up couldn't fix its comment); repinned toed142fd0(v0.36.0), the fleet's SHA.zizmor 1.28: no findings, 22 ignored; actionlint clean.