chore(zizmor): drop the local policy copy, the reusable supplies it - #640
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Updates the documentation comment in .github/zizmor.yml to accurately describe what the enforced ref-pin policy checks (ref vs SHA) versus what is only a team convention (using @main).
Changes:
- Clarifies that zizmor enforces “ref-pinned vs SHA-pinned” rather than enforcing a specific ref like
@main. - Updates wording to avoid implying zizmor can validate whether
@mainis used.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #640 +/- ##
=======================================
Coverage 70.89% 70.89%
=======================================
Files 36 36
Lines 3567 3567
=======================================
Hits 2529 2529
Misses 876 876
Partials 162 162
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
netresearch/.github#339 makes the zizmor reusable fetch the organisation policy at run time when a repo has no .github/zizmor.yml of its own, and removes the file from the templates. Keeping a copy here would silently win over the shared policy the next time it really changes, which is how this file came to differ across the fleet in the first place. The scan itself is unchanged: the same policy is applied, from one place. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
9d81552 to
9092e5f
Compare
CybotTM
changed the title
|
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Removes
.github/zizmor.yml. netresearch/.github#339 makes the zizmor reusable fetch the organisation policy at run time when a repo has no file of its own, and drops it from all five templates, so this copy no longer has a job.It is not harmless to leave behind. A local file takes precedence over the fetched one, so this repository would keep running an old policy the next time the shared one actually changes — which is exactly how a two-line policy ended up needing a pull request in 54 repositories to reword a comment.
The scan result does not change: the same policy is applied, from one place instead of 54. A repository that genuinely needs a different policy opts out by keeping its own
.github/zizmor.yml; this one was byte-identical to the template, which was verified before deleting.This pull request previously carried the comment rewording from #336. That became pointless once the file itself moved, so the branch was rewritten to delete it instead.