From 33c9e08b1ba3b5398058b3fa4285cbe302c9db9b Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 14:21:14 -0700 Subject: [PATCH] ci: move zizmor ignores to their own lines so Dependabot maintains pin comments Dependabot rewrites bare version comments natively but cannot touch compound ones carrying a trailing zizmor ignore. One line per pin plus a standalone ignore below it (same restructure as basecamp-sdk#458) makes Dependabot the first line of defense with no push automation needed on its PRs. Also normalizes zizmor-action to v0.6.0 so the audit runs a zizmor that associates standalone ignore comments (the 1.23-era resolution of older action versions does not). --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1afac14..9d5541f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -100,7 +100,7 @@ jobs: - name: Run actionlint uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 - name: Run zizmor - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 with: advanced-security: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 89a0756..999a91f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,7 +41,8 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: go-version-file: go.mod