Sourced from dmartinochoa/pipeline-check's releases.

v1.4.0

Added

• Zizmor parity sweep: small-widening batch (closes #157, #158, #159). Three companion changes that complete the existing- rule-widening portion of the Zizmor parity sweep:
  • GHA-003 widened to services.*.options and services.*.env (closes #157). Mirrors zizmor proposal #1128. Both YAML paths reach docker create argv (the service container's options + env); direct ${{ untrusted_context }} interpolation on either is a shell-injection sink. Indirect taint via workflow env doesn't apply (the runner doesn't expand $NAME in those positions). 3 new tests under TestGHA003ScriptInjection.
  • GHA-050 widened to "attestation explicitly disabled" (closes #158). Mirrors zizmor proposal #938. Fires when pypa/gh-action-pypi-publish sets attestations: false, OR docker/build-push-action with push: true sets any of provenance: false / sbom: false / attestations: false while staying under the long-lived- secret check's radar. Environment carve-out still applies. 7 new tests under TestGHA050AttestationExplicitlyDisabled.
  • CLI flag --only-known-attacked (closes #159). Mirrors zizmor proposal #1135. New flag filters the rule set to rules whose Rule.incident_refs is non-empty (77 rules today). Composes with --checks: if both are set, the intersection runs. Empty-intersection case emits a stderr warning rather than silently producing no findings. Caches the rule-discovery walk so repeated invocations don't re-iterate the package tree. 3 new tests under tests/test_cli.py.
• GHA-004 widened: overprovisioned permissions detection (zizmor parity, closes #150). GHA-004 already flagged "missing permissions block", write-all, contents: write on PR triggers, and id-token: write without an OIDC step. The rule now also flags any other write scope granted on a job where no step justifies it.
  • Per-scope consumer catalogs for contents, pull-requests, packages, issues, security-events, pages, checks, deployments, statuses, actions.
  • Wildcard consumer: actions/github-script matches every scope (it can mutate any scope through octokit).
  • Special case: docker/build-push-action with push: true counts as a packages: write consumer.
  • Reusable-workflow callers (jobs.<id>.uses:) stay silent; grants forward to the callee.
  • Unknown scopes (attestations, discussions, models, repository-projects) stay silent rather than guess at

... (truncated)

Sourced from dmartinochoa/pipeline-check's changelog.

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

PRs landing on dev between releases append entries below. The release commit collapses this section into ## [X.Y.Z] - <date>.

Added

• Autofix safety tiers (closes #177). --fix (bare flag) now runs only safe fixers; --fix=unsafe runs all; --fix=unsafe-only runs only inference-dependent fixers. 109 fixers labeled safe, 2 unsafe. Enforced by tests/test_autofix_safety.py.
• NuGet provider (--pipeline nuget). Fifth dependency-supply-chain provider. Parses *.csproj, Directory.Packages.props, packages.config, NuGet.config, and packages.lock.json. Nine rules (NUGET-001..009) covering floating ranges, wildcard prereleases, missing versions, HTTP sources, compromised versions, missing lockfile, dependency-confusion source mapping, cooldown gate, and live OSV advisory lookup. Provider count 23 -> 24.
• Live OSV advisory lookup (NPM-010, PYPI-009, MVN-009, NUGET-009). Shared _primitives/osv_fetcher.py queries the OSV batch API for every exact name+version pair behind --resolve-remote. Fires CRITICAL on advisory hit. Closes the freshness gap the curated offline registries have against newly filed advisories.
• Inline source-line ignore comments (closes #174). Three directives: # pipeline-check: ignore[RULE-ID] (same line), ignore-next-line[RULE-ID] (following line), and ignore-file[RULE-ID] (entire file). Comma-separated IDs and optional reason=<text> supported. Both # and // prefixes recognized. Flows through the same core/gate.py plumbing as --ignore-file. Disabled via --no-inline-ignore. 23 tests.
• Direct-HCL Terraform parsing (--tf-source). --tf-source <dir> parses *.tf files via python-hcl2 (behind [hcl] extra) and synthesizes the same TerraformResource objects the plan-JSON path produces, so all 58 TF-NNN rules run unchanged. Variable/local substitution is best-effort; unresolvable references stay opaque and findings get confidence-demoted. Auto-detects main.tf presence. Unskips the terragoat benchmark. 23 new tests.

Changed

• GHA-004 widened with top-level write-scope aggregation. When a workflow-level permissions: block grants a write scope that no inheriting job consumes, the rule now flags the excess grant.

... (truncated)

• fe737ad Merge pull request #145 from dmartinochoa/dev
• 37fa032 chore(release): 1.4.0
• eafb21a refactor(github): rule-pack polish across recent additions
• 7809d9d docs: surface --only-known-attacked in README + ci_gate
• 17d4cf9 docs(changelog): backfill entry for the GHA-003/050 + --only-known-attacked b...
• cf3afdb feat(github): zizmor parity widenings (GHA-003/050) + --only-known-attacked
• 3a84cca feat(github): widen GHA-004 with overprovisioned-permissions detection
• 015b19c feat(github): zizmor parity sweep fourth batch (GHA-072/073 + GHA-053 widening)
• 4585f46 feat(github): zizmor parity sweep third batch (GHA-069/070/071)
• f967c01 feat(github): zizmor parity sweep second batch (GHA-066/067/068)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)