feat(ci): add zizmor reusable workflow by pleb · Pull Request #178 · MakerXStudio/shared-config

pleb · 2026-08-24T09:19:32Z

Adds a reusable zizmor workflow with an advisory self-scan for this repository.

Supports workflow_call inputs for runner, scan scope, collection mode, persona, severity, confidence, online audits, version, config, and enforcement.
Runs when workflows or composite actions change and maintains a sticky pull-request report.
Defaults reusable callers to enforcement while keeping this repository self-scan advisory.
Pins all third-party actions to full commit SHAs.

Review changes made while splitting this out:

Tightened inline comments and removed absolute claims about concurrency and output delimiters.
Documented the pinned action output-path implementation detail that must be checked on upgrades.
Paginated PR comment lookup and restricted marker matching to github-actions[bot].
Made comment posting non-blocking for fork PRs with read-only tokens.

Validated YAML, embedded Bash, github-script syntax, and action SHA pins locally.

github-actions · 2026-08-24T09:19:43Z

🛡️ SHA Pinned Actions Report

✅ All 30 file(s) passed — actions are allowed and pinned as required.

github-actions · 2026-08-24T09:19:49Z

🌈 zizmor workflow scan

❌ zizmor reported findings.

Advisory mode: the job is not failing on these findings.

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:58:35
   |
58 |       run: docker build --tag ${{ inputs.image-label }}:${{ inputs.image-tag }} --disable-content-trust=${{ inputs.disable-content-t...
   |       --- this run block          ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:58:61
   |
58 |       run: docker build --tag ${{ inputs.image-label }}:${{ inputs.image-tag }} --disable-content-trust=${{ inputs.disable-content-t...
   |       --- this run block                                    ^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:58:109
   |
58 |       run: docker build --tag ${{ inputs.image-label }}:${{ inputs.image-tag }} --disable-content-trust=${{ inputs.disable-content-trust }}...
   |       --- this run block                                                                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:67:49
   |
67 |       run: docker buildx build --load --tag ${{ inputs.image-label }}:${{ inputs.image-tag }} . --build-arg NPM_TOKEN=$NPM_TOKEN
   |       --- this run block                        ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:67:75
   |
67 |       run: docker buildx build --load --tag ${{ inputs.image-label }}:${{ inputs.image-tag }} . --build-arg NPM_TOKEN=$NPM_TOKEN
   |       --- this run block                                                  ^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:72:37
   |
72 |       run: docker save --output ${{ inputs.image-label }}.tar ${{ inputs.image-label }}:${{ inputs.image-tag }}
   |       --- this run block            ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:72:67
   |
72 |       run: docker save --output ${{ inputs.image-label }}.tar ${{ inputs.image-label }}:${{ inputs.image-tag }}
   |       --- this run block                                          ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:72:93
   |
72 |       run: docker save --output ${{ inputs.image-label }}.tar ${{ inputs.image-label }}:${{ inputs.image-tag }}
   |       --- this run block                                                                    ^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:75:20
   |
75 |       run: zip ${{ inputs.image-label }}-docker-image.zip ${{ inputs.image-label }}.tar
   |       ---          ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |       |
   |       this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-docker/action.yml:75:63
   |
75 |       run: zip ${{ inputs.image-label }}-docker-image.zip ${{ inputs.image-label }}.tar
   |       --- this run block                                      ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/actions/build-node/action.yml:29:7
   |
29 |       - name: Checkout
   |  _______^
30 | |       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31 | |       with:
32 | |         fetch-depth: 0
33 | |
34 | |     # setup node + private repo access
   | |______________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/actions/build-node-zip/action.yml:35:7
   |
35 |       - name: Checkout
   |  _______^
36 | |       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
37 | |       with:
38 | |         fetch-depth: 0
39 | |
40 | |     # setup node + private repo access
   | |______________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-node-zip/action.yml:52:28
   |
52 |       run: sed -n 's/\(${{ inputs.static-site-env-prefix }}_[A-Z0-9_]\+\)=\(.*\)/\1={{\1}}/p' .env.sample > .env && cat .env
   |       --- this run block   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-node-zip/action.yml:82:22
   |
82 |       run: pushd ${{ inputs.build-path }}; zip -q -r ../${{ inputs.artifact-name }}.zip *
   |       ---            ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |       |
   |       this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/build-node-zip/action.yml:82:61
   |
82 |       run: pushd ${{ inputs.build-path }}; zip -q -r ../${{ inputs.artifact-name }}.zip *
   |       --- this run block                                    ^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/deploy-bicep/action.yml:84:53
   |
83 |       run: |
   |       --- this run block
84 |         PORTAL_LINK="https://portal.azure.com/#@${{ inputs.tenant-id }}/view/HubsExtension/DeploymentDetailsBlade/~/overview/id/%2Fs...
   |                                                     ^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/deploy-bicep/action.yml:84:152
   |
83 |       run: |
   |       --- this run block
84 |         PORTAL_LINK="https://portal.azure.com/#@${{ inputs.tenant-id }}/view/HubsExtension/DeploymentDetailsBlade/~/overview/id/%2Fsubscriptions%2F${{ inputs.subscription-id }}...
   |                                                                                                                                                        ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/deploy-bicep/action.yml:84:201
   |
83 |       run: |
   |       --- this run block
84 |         PORTAL_LINK="https://portal.azure.com/#@${{ inputs.tenant-id }}/view/HubsExtension/DeploymentDetailsBlade/~/overview/id/%2Fsubscriptions%2F${{ inputs.subscription-id }}%2FresourceGroups%2F${{ inputs.resource-group-name }}...
   |                                                                                                                                                                                                         ^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/deploy-bicep/action.yml:84:285
   |
83 |       run: |
   |       --- this run block
84 |         PORTAL_LINK="https://portal.azure.com/#@${{ inputs.tenant-id }}/view/HubsExtension/DeploymentDetailsBlade/~/overview/id/%2Fsubscriptions%2F${{ inputs.subscription-id }}%2FresourceGroups%2F${{ inputs.resource-group-name }}%2Fproviders%2FMicrosoft.Resources%2Fdeployments%2F${{ inputs.deployment-name }}"
   |                                                                                                                                                                                                                                                                                             ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

info[template-injection]: code injection via template expansion
   --> ./.github/actions/deploy-bicep/action.yml:109:26
    |
107 |       run: |
    |       --- this run block
108 |         echo "All outputs from deploy-template step:"
109 |         echo '${{ toJSON(steps.deploy-template.outputs) }}'
    |                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/env-to-placeholders/action.yaml:23:25
   |
22 |       run: |
   |       --- this run block
23 |         sed -n 's/\(${{ inputs.env-variable-prefix }}[A-Z0-9_]\+\)=\(.*\)/\1="{{\1}}"/p' ${{ inputs.env-template-path }} > ${{ input...
   |                         ^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/env-to-placeholders/action.yaml:23:94
   |
22 |       run: |
   |       --- this run block
23 |         sed -n 's/\(${{ inputs.env-variable-prefix }}[A-Z0-9_]\+\)=\(.*\)/\1="{{\1}}"/p' ${{ inputs.env-template-path }} > ${{ input...
   |                                                                                              ^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/env-to-placeholders/action.yaml:23:128
   |
22 |       run: |
   |       --- this run block
23 |         sed -n 's/\(${{ inputs.env-variable-prefix }}[A-Z0-9_]\+\)=\(.*\)/\1="{{\1}}"/p' ${{ inputs.env-template-path }} > ${{ inputs.env-output-path }}
   |                                                                                                                                ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/env-to-placeholders/action.yaml:24:17
   |
22 |       run: |
   |       --- this run block
23 |         sed -n 's/\(${{ inputs.env-var...
24 |         cat ${{ inputs.env-output-path }}
   |                 ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/node-deploy-cdk/action.yml:68:35
   |
68 |       run: unzip -q artifacts/${{ inputs.infrastructure-artifact-name }}/${{ inputs.infrastructure-artifact-name }}.zip -d ${{ input...
   |       --- this run block          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/node-deploy-cdk/action.yml:68:78
   |
68 |       run: unzip -q artifacts/${{ inputs.infrastructure-artifact-name }}/${{ inputs.infrastructure-artifact-name }}.zip -d ${{ input...
   |       --- this run block                                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/node-deploy-cdk/action.yml:68:128
   |
68 |       run: unzip -q artifacts/${{ inputs.infrastructure-artifact-name }}/${{ inputs.infrastructure-artifact-name }}.zip -d ${{ inputs.infrastructure-artifact-name }}
   |       --- this run block                                                                                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/node-deploy-cdk/action.yml:79:24
   |
77 |       run: |
   |       --- this run block
78 |         # Configure static site transforms if provided
79 |         if [ ! -z "${{ inputs.static-site-transforms }}" ]
   |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/node-deploy-cdk/action.yml:81:43
   |
77 |       run: |
   |       --- this run block
...
81 |           readarray -t transforms <<<"${{ inputs.static-site-transforms }}"
   |                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/node-deploy-cdk/action.yml:93:24
   |
77 |       run: |
   |       --- this run block
...
93 |         if [ ! -z "${{ inputs.app-artifact-unzips }}" ]
   |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/node-deploy-cdk/action.yml:93:24
   |
77 |       run: |
   |       --- this run block
...
93 |         if [ ! -z "${{ inputs.app-artifact-unzips }}" ]
   |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/placeholder-transforms/action.yaml:23:24
   |
21 |       run: |
   |       --- this run block
22 |         # Configure static site transforms if provided
23 |         if [ ! -z "${{ inputs.static-site-transforms }}" ]
   |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/placeholder-transforms/action.yaml:25:43
   |
21 |       run: |
   |       --- this run block
...
25 |           readarray -t transforms <<<"${{ inputs.static-site-transforms }}"
   |                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/placeholder-transforms/action.yaml:39:23
   |
21 |       run: |
   |       --- this run block
...
39 |             find "${{ inputs.app-artifact-path }}" -type f \( -name '*.js' -o -name '*.html' \) -exec sed -i "$replacements" {} \;
   |                       ^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/prepare-artifact/action.yml:48:24
   |
44 |       run: |
   |       --- this run block
...
48 |         for zip in ${{ inputs.artifacts-path }}/*.zip; do
   |                        ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/prepare-artifact/action.yml:51:25
   |
44 |       run: |
   |       --- this run block
...
51 |           mkdir -p "${{ inputs.artifacts-path }}/$name"
   |                         ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/prepare-artifact/action.yml:51:25
   |
44 |       run: |
   |       --- this run block
...
51 |           mkdir -p "${{ inputs.artifacts-path }}/$name"
   |                         ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/prepare-artifact/action.yml:52:26
   |
44 |       run: |
   |       --- this run block
...
52 |           mv "$zip" "${{ inputs.artifacts-path }}/$name/$name.zip"
   |                          ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/prepare-artifact/action.yml:70:24
   |
67 |       run: |
   |       --- this run block
...
70 |         if [ ! -z "${{ inputs.static-site-transforms }}" ]
   |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/prepare-artifact/action.yml:73:43
   |
67 |       run: |
   |       --- this run block
...
73 |           readarray -t transforms <<<"${{ inputs.static-site-transforms }}"
   |                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/prepare-artifact/action.yml:93:24
   |
67 |       run: |
   |       --- this run block
...
93 |         if [ ! -z "${{ inputs.app-artifact-unzips }}" ]
   |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/actions/prepare-artifact/action.yml:93:24
   |
67 |       run: |
   |       --- this run block
...
93 |         if [ ! -z "${{ inputs.app-artifact-unzips }}" ]
   |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/actions/prepare-artifact/action.yml:114:30
    |
 67 |       run: |
    |       --- this run block
...
114 |                 if [ -f "${{ inputs.artifacts-path }}/$artifact_name/$artifact_name.zip" ]
    |                              ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/actions/prepare-artifact/action.yml:114:30
    |
 67 |       run: |
    |       --- this run block
...
114 |                 if [ -f "${{ inputs.artifacts-path }}/$artifact_name/$artifact_name.zip" ]
    |                              ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/actions/prepare-artifact/action.yml:114:30
    |
 67 |       run: |
    |       --- this run block
...
114 |                 if [ -f "${{ inputs.artifacts-path }}/$artifact_name/$artifact_name.zip" ]
    |                              ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/actions/prepare-artifact/action.yml:114:30
    |
 67 |       run: |
    |       --- this run block
...
114 |                 if [ -f "${{ inputs.artifacts-path }}/$artifact_name/$artifact_name.zip" ]
    |                              ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/actions/prepare-artifact/action.yml:116:40
    |
 67 |       run: |
    |       --- this run block
...
116 |                   echo "Unzipping: ${{ inputs.artifacts-path }}/$artifact_name/$artifact_name.zip to $destination"
    |                                        ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/actions/prepare-artifact/action.yml:116:40
    |
 67 |       run: |
    |       --- this run block
...
116 |                   echo "Unzipping: ${{ inputs.artifacts-path }}/$artifact_name/$artifact_name.zip to $destination"
    |                                        ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/actions/prepare-artifact/action.yml:118:32
    |
 67 |       run: |
    |       --- this run block
...
118 |                 elif [ -d "${{ inputs.artifacts-path }}/$artifact_name" ]
    |                                ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/actions/prepare-artifact/action.yml:132:35
    |
 67 |       run: |
    |       --- this run block
...
132 |                   extensions="${{ inputs.file-extensions }}"
    |                                   ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
 --> ./.github/dependabot.yml:4:5
  |
4 |   - package-ecosystem: github-actions
  |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ insufficient implicit default-days (less than 7)
  |
  = note: audit confidence → High
  = note: this finding has an auto-fix
  = help: audit documentation → https://docs.zizmor.sh/audits/#dependabot-cooldown

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/workflows/ensure-sha-pinned-actions.yml:54:9
   |
54 |         - name: Checkout
   |  _________^
55 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
   | |________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/workflows/node-build-zip.yml:58:9
   |
58 |         - name: Checkout
   |  _________^
59 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
60 | |         with:
61 | |           fetch-depth: 0
62 | |
63 | |       # setup node + private repo access
   | |________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-build-zip.yml:75:18
   |
75 |         run: ${{ inputs.pre-run-script }}
   |         ---      ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |         |
   |         this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-build-zip.yml:79:30
   |
79 | ...   run: sed -n 's/\(${{ inputs.static-site-env-prefix }}_[A-Z0-9_]\+\)=\(.*\)/\1={{\1}}/p' ${{ inputs.sample-env-path }} > .env &...
   |       --- this run block   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-build-zip.yml:79:101
   |
79 |         run: sed -n 's/\(${{ inputs.static-site-env-prefix }}_[A-Z0-9_]\+\)=\(.*\)/\1={{\1}}/p' ${{ inputs.sample-env-path }} > .env...
   |         --- this run block                                                                          ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-build-zip.yml:98:24
   |
98 |         run: pushd ${{ inputs.build-path }}; zip -q -r ../${{ inputs.artifact-name }}.zip *
   |         ---            ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |         |
   |         this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-build-zip.yml:98:63
   |
98 |         run: pushd ${{ inputs.build-path }}; zip -q -r ../${{ inputs.artifact-name }}.zip *
   |         --- this run block                                    ^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/workflows/node-build.yml:42:9
   |
42 |         - name: Checkout
   |  _________^
43 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44 | |         with:
45 | |           fetch-depth: 0
46 | |
47 | |       # setup node + private repo access
   | |________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-build.yml:59:18
   |
59 |         run: ${{ inputs.pre-run-script }}
   |         ---      ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |         |
   |         this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

help[artipacked]: credential persistence through GitHub Actions artifacts
   --> ./.github/workflows/node-ci.yml:96:9
    |
 96 |         - name: Checkout
    |  _________^
 97 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 98 | |         with:
 99 | |           fetch-depth: 0
100 | |
101 | |       # setup node + private repo access
    | |________________________________________^ does not set persist-credentials: false
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-ci.yml:113:18
    |
113 |         run: ${{ inputs.pre-run-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-ci.yml:123:18
    |
123 |         run: ${{ inputs.audit-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-ci.yml:128:18
    |
128 |         run: ${{ inputs.commit-lint-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-ci.yml:131:18
    |
131 |         run: ${{ inputs.lint-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-ci.yml:134:18
    |
134 |         run: ${{ inputs.compile-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-ci.yml:138:18
    |
138 |         run: ${{ inputs.pre-test-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-ci.yml:141:18
    |
141 |         run: ${{ inputs.test-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-ci.yml:157:18
    |
157 |         run: ${{ inputs.build-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-deploy-azure-web-app.yml:56:42
   |
55 |         run: |
   |         --- this run block
56 |           unzip -q artifact-download/${{ inputs.artifact-name }}.zip -d .
   |                                          ^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-pnpm-build-zip.yml:86:18
   |
86 |         run: ${{ inputs.pre-run-script }}
   |         ---      ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |         |
   |         this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-pnpm-build-zip.yml:90:30
   |
90 | ...   run: sed -n 's/\(${{ inputs.static-site-env-prefix }}_[A-Z0-9_]\+\)=\(.*\)/\1={{\1}}/p' ${{ inputs.sample-env-path }} > .env &...
   |       --- this run block   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-pnpm-build-zip.yml:90:101
   |
90 |         run: sed -n 's/\(${{ inputs.static-site-env-prefix }}_[A-Z0-9_]\+\)=\(.*\)/\1={{\1}}/p' ${{ inputs.sample-env-path }} > .env...
   |         --- this run block                                                                          ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-pnpm-build-zip.yml:107:24
    |
107 |         run: pushd ${{ inputs.build-path }}; zip -q -r ../${{ inputs.artifact-name }}.zip *
    |         ---            ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/node-pnpm-build-zip.yml:107:63
    |
107 |         run: pushd ${{ inputs.build-path }}; zip -q -r ../${{ inputs.artifact-name }}.zip *
    |         --- this run block                                    ^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/workflows/node-publish-internal.yml:31:9
   |
31 |         - name: Checkout
   |  _________^
32 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
33 | |         with:
34 | |           fetch-depth: 0
35 | |
36 | |       # setup node + private repo access
   | |________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/workflows/node-publish-public.yml:25:9
   |
25 |         - name: Checkout
   |  _________^
26 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27 | |         with:
28 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/workflows/node-trusted-publish.yml:50:9
   |
50 |         - name: Checkout
   |  _________^
51 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
52 | |         with:
53 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/node-trusted-publish.yml:78:31
   |
78 |         run: npm version "${{ inputs.version }}" --no-git-tag-version --allow-same-version
   |         --- this run block    ^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> ./.github/workflows/python-uv-build-zip.yml:64:9
   |
64 |         - name: Checkout
   |  _________^
65 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
66 | |         with:
67 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:75:36
   |
75 |         run: uv python install ${{ inputs.python-version }}
   |         --- this run block         ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:79:18
   |
79 |         run: ${{ inputs.pre-run-script }}
   |         ---      ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |         |
   |         this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:82:35
   |
82 |         run: uv sync --locked ${{ inputs.uv-sync-extras }}
   |         --- this run block        ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:86:18
   |
86 |         run: ${{ inputs.pre-build-script }}
   |         ---      ^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |         |
   |         this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:89:18
   |
89 |         run: ${{ inputs.build-script }}
   |         ---      ^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |         |
   |         this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:93:18
   |
93 |         run: ${{ inputs.post-build-script }}
   |         ---      ^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |         |
   |         this run block
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:97:21
   |
96 |         run: |
   |         --- this run block
97 |           pushd ${{ inputs.build-path }}
   |                     ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:98:44
   |
96 |         run: |
   |         --- this run block
97 |           pushd ${{ inputs.build-path }}
98 |           zip -q -r ${{ runner.temp }}/${{ inputs.artifact-name }}.zip ${{ inputs.build-globs }}
   |                                            ^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/python-uv-build-zip.yml:98:76
   |
96 |         run: |
   |         --- this run block
97 |           pushd ${{ inputs.build-path }}
98 |           zip -q -r ${{ runner.temp }}/${{ inputs.artifact-name }}.zip ${{ inputs.build-globs }}
   |                                                                            ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-build-zip.yml:109:18
    |
109 |         run: ${{ inputs.post-run-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

help[artipacked]: credential persistence through GitHub Actions artifacts
   --> ./.github/workflows/python-uv-ci.yml:132:9
    |
132 |         - name: Checkout
    |  _________^
133 | |         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
134 | |         with:
135 | |           fetch-depth: 0
    | |________________________^ does not set persist-credentials: false
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:143:36
    |
143 |         run: uv python install ${{ inputs.python-version }}
    |         --- this run block         ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:147:18
    |
147 |         run: ${{ inputs.pre-run-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:150:35
    |
150 |         run: uv sync --locked ${{ inputs.uv-sync-extras }}
    |         --- this run block        ^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:156:18
    |
156 |         run: ${{ inputs.commit-lint-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:160:18
    |
160 |         run: ${{ inputs.lint-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:164:18
    |
164 |         run: ${{ inputs.check-types-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:168:18
    |
168 |         run: ${{ inputs.pre-test-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:215:15
    |
172 |         run: |
    |         --- this run block
...
215 |           ${{ inputs.test-script }}
    |               ^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:229:18
    |
229 |         run: ${{ inputs.post-test-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:240:18
    |
240 |         run: ${{ inputs.audit-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         this run block
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[template-injection]: code injection via template expansion
   --> ./.github/workflows/python-uv-ci.yml:244:18
    |
244 |         run: ${{ inputs.pre-build-script }}
    |         ---      ^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |         |
    |         th
... output truncated, see the job log for the rest.

feat(ci): add zizmor reusable workflow

7c1d705

pleb marked this pull request as draft August 25, 2026 03:31

Navigation Menu

Uh oh!

feat(ci): add zizmor reusable workflow - #178

feat(ci): add zizmor reusable workflow#178
pleb wants to merge 1 commit into
mainfrom
feat/zizmor-reusable-workflow

pleb commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

pleb commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

🛡️ SHA Pinned Actions Report

Uh oh!

github-actions Bot commented Aug 24, 2026

🌈 zizmor workflow scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant