8000 ci(hygiene): disable zizmor self-repository audit and pin zizmor by norrietaylor · Pull Request #1590 · gominimal/minimal · GitHub
[go: up one dir, main page]
Skip to content

ci(hygiene): disable zizmor self-repository audit and pin zizmor - #1590

Merged
norrietaylor merged 1 commit into
mainfrom
fix/ci-zizmor-self-repository
Sep 25, 2026
Merged

ci(hygiene): disable zizmor self-repository audit and pin zizmor#1590
norrietaylor merged 1 commit into
mainfrom
fix/ci-zizmor-self-repository

Conversation

@norrietaylor
@norrietaylor norrietaylor commented Sep 23, 2026 •
edited by coderabbitai Bot
Loading
Copy link
Copy Markdown
Member

Summary

The nightly hygiene job (.github/workflows/nightly-tests.yml) has failed every night since at least 2026-09-18 at the zizmor (workflow security) step. Latest failing run: https://github.com/gominimal/minimal/actions/runs/35825667564

Root cause. hygiene installed zizmor through taiki-e/install-action with tool: cargo-machete,zizmor, which always pulls the latest zizmor. zizmor 1.30.0 added a new audit, self-repository. It flags every uses: ./... reference and asks for GitHub's new uses: $/... syntax. There are 32 such references across 9 workflows, so zizmor .github/workflows/ exits 12 with 32 low findings.

Why the workflows are not rewritten. GitHub released the $/ syntax on github.com (changelog, 2026-07-30; it requires runner >= 2.336.0). I tested zizmor's auto-fix (zizmor --fix=unsafe-only), which changed exactly the 32 uses: lines. actionlint 1.7.12 then failed on all 32 of them:

  • actions: specifying action "$/.github/actions/..." in invalid format because ref is missing
  • reusable workflows: reusable workflow call "$/.github/workflows/..." is not following the format ...

actionlint 1.7.12 is the latest release, and $/ support is still an open issue (rhysd/actionlint#711). Adopting the new syntax now would just move the failure from zizmor to actionlint.

Fix.

  • Add .github/zizmor.yml with rules.self-repository.disable: true. A comment explains why and when to revisit: once an actionlint release accepts $/, drop the rule and run zizmor --fix=unsafe-only. zizmor finds the file automatically when its input is .github/workflows/.
  • Pin zizmor to zizmor@1.30.1 in the install step, so new audits arrive through a deliberate bump rather than an overnight break. The pinned install-action commit's manifest includes 1.30.1. actionlint is already pinned to the rhysd/actionlint:1.7.12 image.

Note: the nightly run still reports success even though hygiene failed. That is tracked separately in gominimal/inbox#620.

Testing

I ran the same commands as hygiene on this branch with zizmor 1.30.1 and actionlint 1.7.12. Both are official release binaries (linux arm64); the actionlint checksum was verified. Docker is not available in the sandbox, so actionlint ran as the binary rather than the image.

$ zizmor --version            # zizmor 1.30.1
$ zizmor .github/workflows/   # before: exit 12, "148 findings (3 ignored, 113 suppressed, 32 unsafe fixes): ... 32 low"
$ zizmor .github/workflows/   # after:  exit 0,  "No findings to report. Good job! (3 ignored, 113 suppressed)"
$ zizmor --no-config .github/workflows/   # exit 12 (confirms the new config is what gets picked up)
$ actionlint -color           # 1.7.12, exit 0, no output

With the $/ rewrite applied instead, actionlint exited 1 with 32 errors (see above), so that approach was dropped.

Checklist

  • Docs updated if behavior changed (n/a; CI config only, rationale is in .github/zizmor.yml)
  • BREAKING CHANGE: footer present if this is a breaking change (n/a)

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Updated automated repository checks to use a consistent tool version and adjusted validation settings. These changes affect internal maintenance workflows and do not alter app functionality.

@norrietaylor @claude
ci(hygiene): disable zizmor self-repository audit and pin zizmor
6a0e6ee 
zizmor 1.30.0 added the self-repository audit, which asks for GitHub's
new `uses: $/...` syntax instead of `uses: ./...`. The hygiene job
installed zizmor unpinned, so the new audit broke the nightly with 32
low findings. actionlint 1.7.12 (latest; also run by hygiene) rejects
`$/...` references, so the workflows cannot adopt the new syntax yet.

Disable the audit in a new .github/zizmor.yml, with a note to revisit
once actionlint supports `$/` (rhysd/actionlint#711), and pin zizmor to
1.30.1 so future audits arrive through a deliberate bump.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@norrietaylor
norrietaylor requested a review from a team as a code owner September 23, 2026 23:18
Copilot AI lite review requested due to automatic review settings September 23, 2026 23:18
@coderabbitai
coderabbitai Bot commented Sep 23, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 855dec1c-acdf-4746-b837-fca9d4d58913

📥 Commits

Reviewing files that changed from the base of the PR and between 85c9b4a and 6a0e6ee.

📒 Files selected for processing (2)
  • .github/workflows/nightly-tests.yml
  • .github/zizmor.yml

Included review availability: Your plan provides up to 5 included reviews per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The nightly hygiene job now installs zizmor version 1.30.1. A new zizmor configuration disables the self-repository rule and documents the actionlint syntax conflict.

Changes

Nightly hygiene

Layer / File(s) Summary
Pin and configure zizmor
.github/workflows/nightly-tests.yml, .github/zizmor.yml		 The hygiene job pins zizmor to version 1.30.1. The new configuration disables the self-repository rule and documents the actionlint syntax conflict and when to revisit the rule.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: bryan-minimal

Merge Risk: ⚪ Minimal · up to 6a0e6

The nightly hygiene change is ready to merge after normal checks; no unresolved issue is identified.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description check ✅ Passed The description includes a complete Summary, Testing section with command results, and Checklist. It explains the failure, root cause, fix, compatibility constraint, and verification evidence.
Title check ✅ Passed The title is concise, follows the required Conventional Commit format, and accurately describes both primary changes: disabling the zizmor self-repository audit and pinning zizmor.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

A rabbit checks the nightly run,
Zizmor’s version is pinned and set.
One rule rests in its config file,
While actionlint’s syntax gets a note.
The rabbit hops along, content.

Comment @coderabbitai help to get the list of available commands.

Copilot AI reviewed Sep 23, 2026
View reviewed changes
Copilot AI left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The reviewed CI changes address the hygiene failure and have been validated successfully.

Review effort: Lite
Findings: None

What changed in this PR

Stabilizes nightly hygiene checks by disabling an incompatible zizmor audit and pinning zizmor to v1.30.1.

Changes:

  • Added .github/zizmor.yml with rationale for disabling self-repository.
  • Pinned zizmor in the nightly workflow.
File Description
.github/​zizmor.yml Configures the temporary zizmor audit exclusion.
.github/​workflows/​nightly-tests.yml Pins the zizmor installation version.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@minimal-foundry
minimal-foundry Bot commented Sep 23, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

Approved: no findings at 6a0e6ee44b65.

Nothing to do.

Clobber: none: git log -- .github/workflows/nightly-tests.yml shows only dependabot install-action bumps recently, none of which pin zizmor or touch its config, so the change is a clean addition.

@norrietaylor norrietaylor mentioned this pull request Sep 23, 2026
Merged
1 of 2 tasks
minimal-foundry[bot]
minimal-foundry Bot approved these changes Sep 23, 2026
View reviewed changes
@minimal-foundry minimal-foundry Bot left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minimal-review — approved

Verdict APPROVE — No findings.

@minimal-foundry minimal-foundry Bot added the review:approved minimal-review approved the current head label Sep 23, 2026
@norrietaylor norrietaylor mentioned this pull request Sep 23, 2026
Merged
1 of 2 tasks
@norrietaylor
norrietaylor merged commit 9fd37f3 into main Sep 25, 2026
34 checks passed
@norrietaylor
norrietaylor deleted the fix/ci-zizmor-self-repository branch September 25, 2026 00:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes
@jtnkminimal jtnkminimal jtnkminimal approved these changes
@bryan-minimal bryan-minimal bryan-minimal approved these changes
@minimal-foundry minimal-foundry[bot] minimal-foundry[bot] approved these changes

Assignees

No one assigned

Labels

review:approved minimal-review approved the current head

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@norrietaylor @jtnkminimal @bryan-minimal
0