feat(uses): add glob pattern support for repository matching by ryandelano · Pull Request #1559 · zizmorcore/zizmor

ryandelano · 2026-01-22T20:09:15Z

Pre-submission checks

Please check these boxes:

Mandatory: This PR corresponds to an issue (if not, please create
one first) - discussed with @woodruffw on discord
I hereby disclose the use of an LLM or other AI coding assistant in the
creation of this PR. PRs will not be rejected for using AI tools, but
will be rejected for undisclosed use. - code review, slight optimization regarding string allocation

Summary

Add support for glob wildcards (e.g., foo-*, *-bar, foo-*-bar) in repository and subpath pattern matching for uses: clauses. This allows more flexible policy configuration for any audit that uses repository patterns, such as unpinned-uses and forbidden-uses. Used intuition for each of the possible cases and how they should behave, so I'm happy to adjust based on other perspectives!

Changes:

Add Segment enum to represent exact or glob pattern matches
Add ParsedSegment enum for parsing patterns with * wildcards
Update RepositoryUsesPattern to use Segment for repo/subpath fields
Implement specificity ordering so exact patterns take precedence over globs
Optimize case-insensitive matching to avoid string allocations
Add comprehensive tests for glob pattern parsing and matching
Document glob patterns in configuration.md

New Patterns Supported

owner/prefix-* - match repos starting with prefix-
owner/*-suffix - match repos ending with -suffix
owner/prefix-*-suffix - match repos with both prefix and suffix
owner/prefix-*/* - match repos with prefix, any subpath
owner/repo/subpath-* - match subpaths with glob
Combined: owner/prefix-*/subpath-*

Example Configuration

unpinned-uses:

rules:
  unpinned-uses:
    config:
      policies:
        "github/codeql-*/*": "hash-pin"  # All codeql actions
        "myorg/action-*": "ref-pin"       # All myorg action-* repos

forbidden-uses:

rules:
  forbidden-uses:
    config:
      allow:
        - "actions/*"           # Allow all actions org repos
        - "myorg/trusted-*"     # Allow myorg repos starting with "trusted-"
      # OR
      deny:
        - "untrusted-org/*-exploit"  # Deny repos ending with "-exploit"

Implementation

New Segment enum handles exact vs glob matching
Glob patterns with single * are supported while multiple wildcards per segment are rejected
Specificity ordering ensures exact patterns take precedence over globs
Case-insensitive matching optimized to avoid heap allocations

Test Plan

Added unit tests for Segment and ParsedSegment parsing
Added pattern matching tests covering all glob variants
Added ordering tests to verify specificity
Added integration tests for unpinned-uses with invalid multi-wildcard patterns and forbidden-uses with glob patterns in allow/deny lists
All existing tests continue to pass

Copilot

Pull request overview

This PR adds support for glob pattern matching in repository uses: clauses, enabling more flexible policy configuration for audits like unpinned-uses and forbidden-uses. The implementation supports single-wildcard patterns (e.g., foo-*, *-bar, foo-*-bar) in both repository and subpath segments, with proper specificity ordering to ensure exact patterns take precedence over globs.

Changes:

Introduced Segment and ParsedSegment enums to handle exact matches and single-wildcard glob patterns
Updated RepositoryUsesPattern to support glob patterns in repo and subpath fields
Implemented case-insensitive glob matching optimized to avoid string allocations
Added comprehensive test coverage for glob pattern parsing, matching, and ordering
Updated documentation with detailed examples of supported glob patterns

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`docs/configuration.md`	Documents glob pattern syntax and provides examples for all supported pattern types
`crates/zizmor/src/models/uses.rs`	Core implementation of glob pattern matching with `Segment`/`ParsedSegment` enums, parsing logic, and matching algorithms
`crates/zizmor/tests/integration/test-data/unpinned-uses/configs/invalid-policy-syntax-4.yml`	Updated test case to verify multi-wildcard rejection (changed from `br` to `br*`)
`crates/zizmor/tests/integration/test-data/forbidden-uses/configs/allow-glob.yml`	New test config demonstrating glob patterns in allow lists
`crates/zizmor/tests/integration/test-data/forbidden-uses/configs/deny-glob.yml`	New test config demonstrating glob patterns in deny lists
`crates/zizmor/tests/integration/audit/unpinned_uses.rs`	Updated error message test for invalid multi-wildcard patterns
`crates/zizmor/tests/integration/audit/forbidden_uses.rs`	Added integration tests for glob patterns in allow/deny lists

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

woodruffw

Thanks @ryandelano! This looks pretty good to me overall, I've left mostly questions and nitpicks in this round of review 🙂

woodruffw · 2026-01-24T01:30:35Z

crates/zizmor/src/models/uses.rs

+/// A segment that can be either an exact match or a glob pattern.
+///
+/// This is used for repo and subpath matching in [`RepositoryUsesPattern`].
+#[derive(Clone, Debug, Eq, PartialEq, Hash)]
+pub(crate) enum Segment {
+    /// An exact literal match (e.g., "checkout", "foo/bar")
+    Exact(String),
+    /// A glob pattern with a single `*` (e.g., "foo-*", "*-bar")
+    Glob {
+        /// The literal text before the `*`
+        prefix: String,
+        /// The literal text after the `*`
+        suffix: String,
+    },
+}
+
+/// Result of parsing a segment string, including the special `*` case.
+///
+/// This is used during pattern parsing to distinguish between:
+/// - `Star`: the full wildcard `*` (used for `owner/*` or `owner/repo/*`)
+/// - `Segment`: an exact match or glob pattern
+/// - Parse failure (multiple wildcards)
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) enum ParsedSegment {
+    /// Just `*` - matches anything in this position
+    Star,
+    /// A concrete segment (exact or glob)
+    Segment(Segment),
+}


Q: can we unify these types? i.e. just one enum Segment with {Star, Glob, Exact}? I think that would be slightly easier to follow here.

We could, my reasoning was that Star acts purely a signal for which variant we're constructing given that it's never actually stored in a RepositoryUsesPattern. Unifying them would mean handling Star in the matching phase, which we could pretty easily do with an assertion that Segment::Star never appears after the construction phase. I didn't put it in the newest batch of changes, but does that approach sound better?

woodruffw · 2026-01-24T01:37:57Z

crates/zizmor/src/models/uses.rs

+        // Create a dummy segment for comparison purposes
+        let no_segment = Segment::Exact(String::new());


Making sure I understand: is the idea here that not all patterns have a relevant segment, so we're putting a dummy one in to make Ord and PartialOrd work below?

If so, I think we could maybe make this clearer by having this return (u8, Option<Segment>, Option<Segment>) and handling the optional segment twice.

Yes you're right. Added!

crates/zizmor/src/models/uses.rs

woodruffw · 2026-01-24T01:51:00Z

docs/configuration.md

        `*` matches `#!yaml uses: actions/checkout` and
        `#!yaml uses: pypa/gh-action-pypi-publish@release/v1`.
+
+#### Glob patterns


Two nits here:

I think we should probably call these something other than "glob patterns" -- that term implies (IMO) full compatibility with fnmatch(2) syntax, when really what we're offering here is a very constrained wildcard match. Maybe we don't call them anything specific at all, and just describe them inline with the rest of the patterns? I'm not sure.

I think it'd be nice to unify this section more fully with the "Repository patterns" section right above it -- right now a user who reads this is going to go through the "Repository patterns" section, and then have to correct/adjust their understanding of how patterns work when they reach this lower section.

Makes sense. They're inline with the rest of the patterns now, so you can see how you like the flow.

I also went ahead and renamed everything related to Glob in the code/comments to Wildcard to reduce confusion and make sure things match between docs and code.

woodruffw · 2026-01-24T01:54:01Z

crates/zizmor/src/models/uses.rs

+    /// Returns the "specificity" of this segment for ordering purposes.
+    /// Lower values are more specific.
+    /// Exact matches are more specific than globs.
+    /// For globs, longer prefix+suffix means more specific.
+    fn specificity(&self) -> (u8, usize) {


Q: can we put this inline in the Ord implementation? Unless I'm missing something, I don't think having it in its own function does a ton for us.

(Now that I think about it I guess there's a benefit to being able to declare the ordering "key" distinct from Ord/without referencing two instances, so if that's the rationale that seems fine to me 🙂)

That benefit is exactly what I was going for haha, just debugging/separation of concerns. Can inline as well if you'd prefer

woodruffw · 2026-01-24T01:55:02Z

crates/zizmor/src/models/uses.rs

+            // Exact is most specific (0), with no length consideration
+            Segment::Exact(_) => (0, 0),
+            // Glob is less specific (1), but longer literals are more specific (inverted)
+            Segment::Glob { prefix, suffix } => (1, usize::MAX - (prefix.len() + suffix.len())),


Can't this be prefix.len() + suffix.len()? Why do we have to begin at size:::MAX and subtract from there?

The goal was to make sure that longer prefix/suffix literals should be considered "more specific" (and therefore be sorted earlier), but looking back over this, using Reverse for that makes that goal much clearer, so I refactored it.

ryandelano · 2026-01-26T16:42:41Z

Responded to everything and resolved the comments changes, keep me posted on anything else :)

edit: thought I re-requested the review when I commented this and apparently didn't, sorry!!

woodruffw · 2026-01-30T01:47:46Z

Responded to everything and resolved the comments changes, keep me posted on anything else :)

edit: thought I re-requested the review when I commented this and apparently didn't, sorry!!

Thanks, and no worries! I'm going to try and set aside some time to review this over the weekend.

woodruffw · 2026-02-06T23:36:46Z

Sorry for the delay here, I'm doing another review tonight.

Add support for glob wildcards (e.g., `foo-*`, `*-bar`, `foo-*-bar`) in repository and subpath pattern matching for `uses:` clauses. This allows more flexible policy configuration for the `unpinned-uses` audit. Changes: - Add `Segment` enum to represent exact or glob pattern matches - Add `ParsedSegment` enum for parsing patterns with `*` wildcards - Update `RepositoryUsesPattern` to use `Segment` for repo/subpath fields - Implement specificity ordering so exact patterns take precedence over globs - Optimize case-insensitive matching to avoid string allocations - Add comprehensive tests for glob pattern parsing and matching - Document glob patterns in configuration.md

Signed-off-by: William Woodruff <william@yossarian.net>

Copilot AI review requested due to automatic review settings January 22, 2026 20:09

Copilot started reviewing on behalf of ryandelano January 22, 2026 20:09 View session

Copilot AI reviewed Jan 22, 2026

View reviewed changes

woodruffw reviewed Jan 24, 2026

View reviewed changes

ryandelano requested a review from woodruffw January 28, 2026 20:57

woodruffw added enhancement New feature or request config Configuration functionality labels Jan 30, 2026

ryandelano added 6 commits February 10, 2026 21:47

test(uses): add tests for forbidden-uses

dd47b2b

refactor(uses): remove dummy value, use Reverse for specificity

789587f

docs: change "glob" section to be inline

61afe15

refactor(uses): rename Glob to Wildcard for consistency

8d18636

docs(uses): remove remaining redundant comments

30dcc65

woodruffw force-pushed the feat/wildcard-repo-patterns branch from 27448c4 to 30dcc65 Compare February 11, 2026 02:47

Regenerate schema

0395d4f

Signed-off-by: William Woodruff <william@yossarian.net>

		// Create a dummy segment for comparison purposes
		let no_segment = Segment::Exact(String::new());

Uh oh!

Conversation

ryandelano commented Jan 22, 2026

Pre-submission checks

Summary

New Patterns Supported

Example Configuration

unpinned-uses:

forbidden-uses:

Implementation

Test Plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

woodruffw left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ryandelano commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

woodruffw commented Jan 30, 2026

Uh oh!

woodruffw commented Feb 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

ryandelano commented Jan 26, 2026 •

edited

Loading