docs: sync the scanner wording from the template - #639
Conversation
Picks up netresearch/.github#334, which corrects three things a reviewer raised repeatedly during the rollout: the header named betterleaks while the job keeps the historical gitleaks name, it called the last job a composer audit although the reusable also runs an Opengrep SAST scan by default, and the zizmor comment said the exemption covers reusable workflows when the rule matches any first-party uses, composite actions included. Comments only — no job, permission or trigger changes. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
There was a problem hiding this comment.
Pull request overview
Updates zizmor configuration comments to match the upstream template wording, clarifying the scope of the first-party uses: exemption.
Changes:
- Clarified that the
netresearch/*: ref-pinpolicy applies to both reusable workflows and composite actions. - Expanded the rationale for tracking
@mainfor first-partyuses:to explain propagation benefits.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #639 +/- ##
=======================================
Coverage 70.89% 70.89%
=======================================
Files 36 36
Lines 3567 3567
=======================================
Hits 2529 2529
Misses 876 876
Partials 162 162
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Picks up the wording correction from netresearch/.github#334 so this repo stays byte-identical to its template.
Three things the previous comments got wrong:
gitleaksname — the name is deliberate (renaming breaks every caller that references the workflow path or pins the job in branch protection), and the header now says soskip-opengrepdefaults tofalse"netresearch/*": ref-pinmatches any first-partyuses:, composite actions includedComments only. No job, permission or trigger changes, and the file was byte-identical to the previous template revision before this sync — anything that had drifted was left alone and reported instead.