grafana / grafana/shared-workflows
Zizmor: default config is no longer being used
- Dominant language
- Go
- Stars
- 26
- Forks
- 49
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 36
Description
There is a global config for Zizmor here:
https://github.com/grafana/shared-workflows/blob/main/.github/zizmor.yml
Previously, it was working as an "addition" to a Zizmor config local to the repository. Today, Zizmor started failing on my PR with this output:
```
�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
�[1m�[94m--> �[0m./.github/workflows/helm-release.yaml:65:11
�[1m�[94m|�[0m
�[1m�[94m65�[0m �[1m�[94m|�[0m uses: grafana/helm-charts/.github/workflows/update-helm-repo.yaml@main
�[1m�[94m|�[0m �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
�[1m�[94m|�[0m
�[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
�[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m
�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
�[1m�[94m--> �[0m./.github/workflows/publish-techdocs.yaml:17:11
�[1m�[94m|�[0m
�[1m�[94m17�[0m �[1m�[94m|�[0m uses: grafana/shared-workflows/.github/workflows/publish-techdocs.yaml@main
�[1m�[94m|�[0m �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
�[1m�[94m|�[0m
�[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
�[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m
�[32m50�[39m findings (�[1m�[93m7�[39m ignored, �[93m41�[39m suppressed�[0m): �[35m0�[39m informational, �[36m0�[39m low, �[33m0�[39m medium, �[31m2�[39m high
```
Copied from this [comment](https://github.com/grafana/k6-operator/pull/741#issuecomment-4070187704).
After [copy-pasting](https://github.com/grafana/k6-operator/pull/741/commits/854d1a3f40e5bd214cad99f27f0dccad52a0c597) global config to my local config, Zizmor check passed successfully.
In addition, the un-printable characters in the output are new too: Zizmor output was prettier in the past.
Could it be that some recent update to Zizmor workflow broke the "overlay" of configs?
Contributor guide
Assessment
This issue has not been assessed yet.