From 441274a1589f57ffa469db89453b6f22b024f43e Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 14:21:25 -0700 Subject: [PATCH] ci: move zizmor ignores to their own lines so Dependabot maintains pin comments Dependabot rewrites bare version comments natively but cannot touch compound ones carrying a trailing zizmor ignore. One line per pin plus a standalone ignore below it (same restructure as basecamp-sdk#458) makes Dependabot the first line of defense with no push automation needed on its PRs. --- .github/workflows/release.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7561246..80c1fea 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,8 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] -- workflow only triggers on tag push and workflow_dispatch; cache is keyed by lockfile hash and default branch + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + # zizmor: ignore[cache-poisoning] -- workflow only triggers on tag push and workflow_dispatch; cache is keyed by lockfile hash and default branch with: node-version: 22 cache: npm @@ -120,7 +121,8 @@ jobs: # Node 24 bundles npm 11.16, past the 11.5.1 that OIDC trusted publishing # requires. Publishing therefore uses the npm shipped in the verified Node # tarball rather than installing one from the registry at release time. - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] -- workflow only triggers on tag push and workflow_dispatch; cache is keyed by lockfile hash and default branch + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + # zizmor: ignore[cache-poisoning] -- workflow only triggers on tag push and workflow_dispatch; cache is keyed by lockfile hash and default branch with: node-version: 24 registry-url: https://registry.npmjs.org @@ -192,7 +194,8 @@ jobs: - name: Create GitHub Release if: github.event_name == 'push' - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 # zizmor: ignore[superfluous-actions] -- action is more maintainable than inline gh release commands + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 + # zizmor: ignore[superfluous-actions] -- action is more maintainable than inline gh release commands with: generate_release_notes: true prerelease: ${{ contains(steps.version.outputs.version, '-') }}