chore(zizmor): drop the local policy copy, the reusable supplies it - #261
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Updates the .github/zizmor.yml documentation comment to accurately describe what zizmor’s ref-pin rule enforces (ref vs SHA), and to clarify that selecting @main is a human convention rather than a linter-guaranteed behavior.
Changes:
- Reworded the first-party
uses:policy comment to distinguish “ref-pinned” vs “SHA-pinned”. - Clarified that zizmor does not validate which ref (e.g.,
@main) is chosen—only that a ref is used.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #261 +/- ##
=======================================
Coverage 74.70% 74.70%
=======================================
Files 10 10
Lines 427 427
=======================================
Hits 319 319
Misses 88 88
Partials 20 20
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
netresearch/.github#339 makes the zizmor reusable fetch the organisation policy at run time when a repo has no .github/zizmor.yml of its own, and removes the file from the templates. Keeping a copy here would silently win over the shared policy the next time it really changes, which is how this file came to differ across the fleet in the first place. The scan itself is unchanged: the same policy is applied, from one place. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
01b762d to
cd9d3e7
Compare
CybotTM
changed the title
|
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
Removes
.github/zizmor.yml. netresearch/.github#339 makes the zizmor reusable fetch the organisation policy at run time when a repo has no file of its own, and drops it from all five templates, so this copy no longer has a job.It is not harmless to leave behind. A local file takes precedence over the fetched one, so this repository would keep running an old policy the next time the shared one actually changes — which is exactly how a two-line policy ended up needing a pull request in 54 repositories to reword a comment.
The scan result does not change: the same policy is applied, from one place instead of 54. A repository that genuinely needs a different policy opts out by keeping its own
.github/zizmor.yml; this one was byte-identical to the template, which was verified before deleting.This pull request previously carried the comment rewording from #336. That became pointless once the file itself moved, so the branch was rewritten to delete it instead.