ci: Integrate zizmor checks to repo #818
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe pull request adds a new entry to the pre-commit configuration in the Changes
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.pre-commit-config.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (9)
- GitHub Check: 🧪 Tests / pytest@🐍3.9@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.12@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.11@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.12@macos-13
- GitHub Check: 🧪 Tests / pytest@🐍3.11@macos-13
- GitHub Check: 🧪 Tests / pytest@🐍3.10@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.10@macos-13
- GitHub Check: 🧹 Linters / pre-commit@🐍3.13@ubuntu-latest
- GitHub Check: pre-commit
🔇 Additional comments (1)
.pre-commit-config.yaml (1)
68-72: LGTM! Good addition to the security tooling.The integration of Zizmor as a pre-commit hook complements the existing security checks (gitleaks, detect-aws-credentials, detect-private-key) and provides additional coverage alongside CodeQL, specifically for GitHub Actions analysis.
| # Github Action static analysis tool | ||
| - repo: https://github.com/woodruffw/zizmor-pre-commit | ||
| rev: v1.3.1 | ||
| hooks: | ||
| - id: zizmor |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Verify Zizmor version and consider additional configuration options.
The integration looks good, but let's verify a few things:
🏁 Script executed:
#!/bin/bash
# Description: Check if there are any issues or security advisories for zizmor-pre-commit
# Check for issues and PRs that might indicate problems with v1.3.1
gh api graphql -f query='
{
repository(owner: "woodruffw", name: "zizmor-pre-commit") {
issues(first: 5, states: OPEN) {
nodes {
title
body
createdAt
}
}
releases(first: 1) {
nodes {
tagName
createdAt
}
}
}
}'Length of output: 422
🌐 Web query:
What is the latest version of zizmor-pre-commit and what are its recommended configuration options?
💡 Result:
The latest version of zizmor-pre-commit is v1.1.1, as shown in configuration examples from multiple repositories including CPython's official GitHub repository[1][3]. This version is recommended for integration with pre-commit frameworks.
Recommended configuration options:
repos:
- repo: https://github.com/woodruffw/zizmor-pre-commit
rev: v1.1.1 # Latest stable release
hooks:
- id: zizmorKey implementation details:
- The hook requires no additional arguments by default[1]
- Primarily targets YAML files in GitHub Actions workflows (
/.github/workflows/)[6][7] - Works alongside other pre-commit hooks like Ruff and Black in typical Python project setups[3][6]
For security-focused repositories, consider combining it with complementary hooks like:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.4.0
hooks:
- id: check-yaml
- id: detect-private-keyCitations:
- 1: https://github.com/woodruffw/zizmor-pre-commit
- 2: https://stefaniemolin.com/articles/devx/pre-commit/setup-guide/
- 3: https://github.com/python/cpython/blob/main/.pre-commit-config.yaml
- 4: https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md
- 5: https://pre-commit.com
- 6: https://github.com/astral-sh/ruff/blob/main/.pre-commit-config.yaml
- 7: https://apache.googlesource.com/airflow/+/HEAD/.pre-commit-config.yaml
- 8: https://docs.sqlfluff.com/en/latest/production/pre_commit.html
- 9: https://github.com/pre-commit/pre-commit/releases
- 10: https://en.wikipedia.org/wiki/List_of_Star_Wars_characters
Action Required: Update Zizmor Pre-commit Version
- The current configuration in
.pre-commit-config.yamlusesrev: v1.3.1, but research indicates that the recommended stable version isv1.1.1. - Confirm that no additional configuration options are required for your integration. While Zizmor doesn't need extra arguments, you might consider complementary security hooks (e.g., check-yaml, detect-private-key) if needed.
- The hook's placement between Prettier and Mypy appears logical and should not conflict with other checks.
|
Oh, I see, there a bunch of issues in workflows needed to be fixed first |
This comment was marked as resolved.
This comment was marked as resolved.
github-actions
bot
added
stale
MaxymVlasov
added
the
on-hold
That PR integrate one more static analysis tool, as CodeQL is good, but it not cover all cases
Here is an article about zizmor value - https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection
zizmor repo - https://github.com/woodruffw/zizmor