Skip to content

ci(zizmor): Online-Audits zurueck, nur impostor-commit deaktiviert #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marcohost33-maker merged 1 commit into from
Jun 6, 2026
Merged

ci(zizmor): Online-Audits zurueck, nur impostor-commit deaktiviert #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 5 additions & 8 deletions .github/workflows/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,14 +43,11 @@ jobs:
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
with:
persona: regular
# [2026-06-06] Offline-Modus: impostor-commit crasht hart ("no audit
# was performed") am privaten Cross-Repo-Pin coworkerz-ci, weil der
# repo-scoped GITHUB_TOKEN designbedingt keine fremden privaten Repos
# lesen kann (docs.zizmor.sh/troubleshooting). SHA-Echtheit des Pins
# wird stattdessen bei jedem Bump via gh api Pre/Post verifiziert.
# Trade-off (dokumentiert): known-vulnerable-actions/stale-refs offline
# deaktiviert — kompensiert durch SHA-Pins + Dependabot-Updates.
online-audits: false
# [2026-06-06] Online-Audits AKTIV; nur impostor-commit ist per
# .github/zizmor.yml deaktiviert (crasht am privaten Cross-Repo-Pin
# coworkerz-ci — repo-scoped GITHUB_TOKEN, docs.zizmor.sh). Das ist
# die praezisere Loesung gegenueber online-audits:false (Webrecherche
# 06-06): known-vulnerable-actions + stale-action-refs bleiben aktiv.
# privates Repo ohne GHAS: kein Action-internes Code-Scanning-Upload (wirft sonst
# "Resource not accessible"). Stattdessen Findings als inline-Annotationen.
advanced-security: false
Expand Down
10 changes: 10 additions & 0 deletions .github/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# zizmor-Konfiguration (docs.zizmor.sh/configuration)
# [2026-06-06] NUR impostor-commit deaktiviert (Praezisierung des Vormittags-
# Fixes "online-audits: false"): das Audit crasht hart am privaten Cross-Repo-
# Pin coworkerz-ci, weil der repo-scoped GITHUB_TOKEN designbedingt keine
# fremden privaten Repos lesen kann. SHA-Echtheit des Pins wird bei jedem Bump
# via gh api Pre/Post verifiziert. Alle uebrigen Online-Audits (known-
# vulnerable-actions, stale-action-refs) bleiben AKTIV.
rules:
impostor-commit:
disable: true
Comment on lines +8 to +10

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Audit changes to the new zizmor configuration

When a future PR changes only this configuration—for example, disabling another security rule—the zizmor workflow will not run because both path filters in .github/workflows/zizmor.yml include only .github/workflows/** and .github/dependabot.yml. Since this file now directly controls which audits execute, add .github/zizmor.yml to the push and pull-request path filters so configuration-only changes are validated.

Useful? React with 👍 / 👎.

Loading