kingchenc
49c0fd7dd5
Clears the remaining zizmor code-scanning findings on this repo. **Fixed** - `dependabot-cooldown` (5): a 7-day cooldown on every update ecosystem (cargo, npm, pip, ci-pip, github-actions) so Dependabot waits a week after a release before opening the bump PR. **Accepted via `.github/zizmor.yml`** (no workflow code changed) - `template-injection` (sync-about.yml): false positive — every expansion is the internal `grep -c` indicator count, not attacker-controllable. - `use-trusted-publishing` (release.yml): OIDC migration tracked separately. - `superfluous-actions` (release.yml): `softprops/action-gh-release` kept deliberately. Verified with zizmor 1.25.2: 0 findings.
50 lines
2.1 KiB
YAML
50 lines
2.1 KiB
YAML
# zizmor configuration — https://docs.zizmor.sh/configuration/
|
|
#
|
|
# cache-poisoning (release.yml):
|
|
# The release pipeline restores build caches (Swatinem/rust-cache for the Rust
|
|
# compilation, actions/setup-node) as a deliberate, accepted optimisation.
|
|
# zizmor flags these under cache-poisoning because release.yml publishes
|
|
# artifacts to crates.io / PyPI / npm, so a poisoned cache could in theory
|
|
# reach a released build. Our caches are maintainer-controlled and the
|
|
# restore speedup is kept on purpose; we accept this risk rather than running
|
|
# cache-free release builds. (Six of the eight hits are actions/setup-node,
|
|
# which zizmor reports at "Low" confidence.)
|
|
#
|
|
# artipacked (sync-about.yml):
|
|
# The sync-about job checks out with persisted credentials on purpose: it
|
|
# pushes the indicator-count fix-up back to the PR head branch (git commit +
|
|
# git push), which needs the token in the runner's git config. It uploads no
|
|
# artifacts, so the persisted token is never packaged or leaked; accept it.
|
|
#
|
|
# template-injection (sync-about.yml):
|
|
# False positive. Every flagged expansion is steps.count.outputs.count, the
|
|
# indicator count produced by an internal `grep -c` over lib.rs. It is not
|
|
# attacker-controllable, so there is nothing to inject.
|
|
#
|
|
# use-trusted-publishing (release.yml):
|
|
# Informational suggestion to use OIDC trusted publishing for PyPI / npm
|
|
# instead of long-lived tokens. A worthwhile migration, but it reconfigures
|
|
# the live publish pipeline on the registry side; tracked separately rather
|
|
# than blocking on it here.
|
|
#
|
|
# superfluous-actions (release.yml):
|
|
# The GitHub release step uses softprops/action-gh-release. The runner ships
|
|
# `gh`, so this is replaceable by a script step, but the action is stable and
|
|
# battle-tested; we keep it deliberately.
|
|
rules:
|
|
cache-poisoning:
|
|
ignore:
|
|
- release.yml
|
|
artipacked:
|
|
ignore:
|
|
- sync-about.yml
|
|
template-injection:
|
|
ignore:
|
|
- sync-about.yml
|
|
use-trusted-publishing:
|
|
ignore:
|
|
- release.yml
|
|
superfluous-actions:
|
|
ignore:
|
|
- release.yml
|