ci: use official zizmor action with PR annotations#395
Conversation
Switch from manual uvx zizmor + SARIF upload to the official zizmorcore/zizmor-action. Annotations mode emits inline GitHub annotations on PR diffs, and zizmor's non-zero exit on findings fails the build automatically. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The strict zizmor mode flagged real issues that the previous SARIF-
only setup was silently uploading:
- Pin all third-party actions by SHA (ci, coverage, publish).
- Add workflow-level permissions: {} and minimal job-level
permissions blocks.
- Set persist-credentials: false on all checkouts. For publish.yml,
which needs to push, configure auth via a tokenized remote URL
using env vars instead of relying on the persisted credential.
- Refactor template expansions in publish.yml run blocks to use
env vars, avoiding template-injection notices.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The previous SHA was the annotated tag object's SHA, not the commit it points to — zizmor's hash-pin verifier flagged this. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 participant
Summary
uvx zizmor+ SARIF upload to the officialzizmorcore/zizmor-actionpinned to v0.5.6.annotations: trueso findings appear as inline GitHub annotations on PR diffs.security-events: writeandactions: readpermissions (no longer needed without SARIF/Advanced Security upload); job now runs withcontents: readonly, and the workflow-levelpermissions: {}removes the default token scope for any future jobs.Test plan
zizmorcheck runs green on this PR (no current findings).🤖 Generated with Claude Code