Run zizmor in CI. #6968
Run zizmor in CI. #6968
Conversation
|
GNU testsuite comparison: |
|
Thanks! |
|
I'll try to fix what I can, but I don't think I'll be able to fix everything. |
|
Well I attempted to fix everything, but the pedantic. If you want pedantic, which currently is just pinning the actions to a hash ref, let me know. I'll add it. |
sylvestre
force-pushed
the
add-zizmor-to-ci
branch
from
88f3c01 to
1f84ad7
Compare
|
GNU testsuite comparison: |
|
You don't want to add zizmor to the CI? |
|
you are the one who closed it ?! |
|
oops... |
dcampbell24
force-pushed
the
add-zizmor-to-ci
branch
from
1f84ad7 to
38b7f16
Compare
sylvestre
force-pushed
the
add-zizmor-to-ci
branch
from
38b7f16 to
c2a0ed2
Compare
|
GNU testsuite comparison: |
|
GNU testsuite comparison: |
| @@ -14,13 +15,13 @@ jobs: | |||
| with: | |||
| persist-credentials: false | |||
|
|
|||
| - name: Download zizmor | |||
| run: cargo install zizmor | |||
| - name: Install the latest version of uv | |||
There was a problem hiding this comment.
why pin
and what was wrong with cargo install ?
There was a problem hiding this comment.
I don't have to pin if you don't want to. It just makes it so it stays on the same version no matter what (I think). It is suggested by zizmor --pedantic.
cargo install takes longer than uv does because it compiles the binary. It is using exactly the same binary. Again I could cargo install, but it seems pointless. This is the suggested way to do this on the zizmor site https://woodruffw.github.io/zizmor/usage/#use-in-github-actions. It actually suggests using the SARIF format and uploading the results of a run to GitHub, but I don't see what the point of that is.
There was a problem hiding this comment.
It actually suggests using the SARIF format and uploading the results of a run to GitHub, but I don't see what the point of that is.
This is for integration with GitHub Advanced Security. Uploading the SARIF file will make the results available in the "Security" tab of this repository, under code scanning alerts. It should also post comments on PRs that introduce regressions. See, for example: Homebrew/brew#18986
You could run it with
--pedantic, but I guessed you wouldn't want to. It is failing right now, but that is the status of things.