grafana / grafana/shared-workflows

Zizmor: default config is no longer being used

Open
#1,811 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
26
Forks
49
Avg merge
1d 6h
Merged PRs (30d)
36

Description

There is a global config for Zizmor here:
https://github.com/grafana/shared-workflows/blob/main/.github/zizmor.yml

Previously, it was working as an "addition" to a Zizmor config local to the repository. Today, Zizmor started failing on my PR with this output:
```
�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
�[1m�[94m--> �[0m./.github/workflows/helm-release.yaml:65:11
�[1m�[94m|�[0m
�[1m�[94m65�[0m �[1m�[94m|�[0m uses: grafana/helm-charts/.github/workflows/update-helm-repo.yaml@main
�[1m�[94m|�[0m �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
�[1m�[94m|�[0m
�[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
�[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[1m�[91merror[unpinned-uses]�[0m�[1m: unpinned action reference�[0m
�[1m�[94m--> �[0m./.github/workflows/publish-techdocs.yaml:17:11
�[1m�[94m|�[0m
�[1m�[94m17�[0m �[1m�[94m|�[0m uses: grafana/shared-workflows/.github/workflows/publish-techdocs.yaml@main
�[1m�[94m|�[0m �[1m�[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^�[0m �[1m�[91maction is not pinned to a hash (required by blanket policy)�[0m
�[1m�[94m|�[0m
�[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
�[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#unpinned-uses�[39m

�[32m50�[39m findings (�[1m�[93m7�[39m ignored, �[93m41�[39m suppressed�[0m): �[35m0�[39m informational, �[36m0�[39m low, �[33m0�[39m medium, �[31m2�[39m high
```
Copied from this [comment](https://github.com/grafana/k6-operator/pull/741#issuecomment-4070187704).

After [copy-pasting](https://github.com/grafana/k6-operator/pull/741/commits/854d1a3f40e5bd214cad99f27f0dccad52a0c597) global config to my local config, Zizmor check passed successfully.

In addition, the un-printable characters in the output are new too: Zizmor output was prettier in the past.

Could it be that some recent update to Zizmor workflow broke the "overlay" of configs?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.