ci: adopt the template's zizmor policy comment - #782
Conversation
The go-app template reworded this comment in netresearch/.github@00f5783 to cover composite actions as well as reusable workflows. The consumer was not synced, so the template-drift check has failed on main since that landed. Only the comment differs; the policies are unchanged. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Aligns this repo’s Zizmor policy comment with the upstream go-app template to resolve template-drift CI failures.
Changes:
- Updates the explanatory comment under
unpinned-uses.policiesto match the template wording. - Clarifies that the first-party
uses:policy applies to both reusable workflows and composite actions.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #782 +/- ##
=======================================
Coverage 89.28% 89.28%
=======================================
Files 88 88
Lines 12147 12147
=======================================
Hits 10846 10846
Misses 1001 1001
Partials 300 300
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
mainhas been failing the template-drift check since 13:47Z today, and every open PR inherits it.The go-app template reworded one comment in netresearch/.github@00f5783 — from "reusable workflows" to "
uses:— reusable workflows AND composite actions" — and this consumer was never synced. Only the comment differs;"netresearch/*": ref-pinand"*": hash-pinare byte-identical either side.The file is now byte-identical to
templates/go-app/.github/zizmor.yml(sha256 bcf5a56f…), which is what the drift job compares against.Worth noting for the fleet: every other repo on the
go-apptemplate that has not adopted this comment is red for the same reason. This PR only fixes ofelia.