From 74a49fafdb98c9db24fc5cd08859c0dcc674d3b8 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 14:21:19 -0700 Subject: [PATCH] ci: move zizmor ignores to their own lines so Dependabot maintains pin comments Dependabot rewrites bare version comments natively but cannot touch compound ones carrying a trailing zizmor ignore. One line per pin plus a standalone ignore below it (same restructure as basecamp-sdk#458) makes Dependabot the first line of defense with no push automation needed on its PRs. Also normalizes zizmor-action to v0.6.0 so the audit runs a zizmor that associates standalone ignore comments (the 1.23-era resolution of older action versions does not). --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e378abb..cfe3856 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,7 +41,8 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: go-version-file: go.mod