ci(zizmor): Gate statt informativ + inline-Annotationen - #16
Conversation
…AS auf privat), tote Upload-Step weg
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4a9d1b496e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| persona: regular | ||
| # privates Repo ohne GHAS: kein Action-internes Code-Scanning-Upload (wirft sonst | ||
| # "Resource not accessible"). Stattdessen Findings als inline-Annotationen. | ||
| advanced-security: false |
There was a problem hiding this comment.
Setting advanced-security: false switches zizmor-action out of SARIF upload mode, so this workflow no longer needs security-events: write; leaving it enabled grants an unnecessary write-scoped token to a job that executes third-party action code. The action’s permissions guidance explicitly says this permission is only required when advanced-security: true, so this change should also tighten job permissions to avoid avoidable blast radius.
Useful? React with 👍 / 👎.
1 participant
zizmor war continue-on-error (informativ). Jetzt GATE (Findings -> CI rot -> blockt). advanced-security:false stoppt den GHAS-Upload-Fehler auf privaten Repos; annotations:true zeigt Findings inline. Tote Upload-SARIF-Step entfernt. Muster wie Q-Forge #27.