From f77e60d3bbcb08632adb97a2ded114de2128bddd Mon Sep 17 00:00:00 2001 From: Steve Piercy Date: Sat, 7 Nov 2026 23:32:45 -0800 Subject: [PATCH 1/4] Switch to zizmor's GitHub Action from pip install in the CI check --- .github/workflows/zizmor.yml | 14 +++----------- news/+zizmor-github-action.internal | 1 + pyproject.toml | 2 +- 3 files changed, 5 insertions(+), 12 deletions(-) create mode 100644 news/+zizmor-github-action.internal diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 267cfb3d6..c292d5d7d 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -10,7 +10,7 @@ permissions: jobs: zizmor: - runs-on: ubuntu-latest + runs-on: ubuntu-slim permissions: contents: read security-events: write @@ -19,14 +19,6 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: Update pip - run: scripts/update-pip.sh - - name: Install zizmor - run: pip install zizmor==1.30.1 # also update pyproject.toml + - name: Run zizmor - run: zizmor --format sarif .github/workflows/ > zizmor-results.sarif - - name: Upload SARIF file - # https://github.com/github/codeql-action/releases - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - with: - sarif_file: zizmor-results.sarif + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 diff --git a/news/+zizmor-github-action.internal b/news/+zizmor-github-action.internal new file mode 100644 index 000000000..cf642a8cf --- /dev/null +++ b/news/+zizmor-github-action.internal @@ -0,0 +1 @@ +Switched to use the recommended GitHub Action :program:`zizmorcore/zizmor-action` from installing :program:`zizmor` via pip. @stevepiercy diff --git a/pyproject.toml b/pyproject.toml index 96e997d97..515c6874c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -103,7 +103,7 @@ dev = [ "towncrier>=25.8.0", "tox", "tox-uv", - "zizmor==1.30.1", # also update .github/workflows/zizmor.yml + "zizmor==1.30.1", ] test = [ From 3952384df93f35fe29ffbb9256d2296f0d72522d Mon Sep 17 00:00:00 2001 From: Steve Piercy Date: Thu, 12 Nov 2026 14:58:41 -0800 Subject: [PATCH 2/4] Restore comment --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index c292d5d7d..f9e8d7645 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -21,4 +21,4 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 Sync with pyproject.toml From 9671a13d91673f6e57e49f5453065b60f1f11da5 Mon Sep 17 00:00:00 2001 From: Steve Piercy Date: Thu, 12 Nov 2026 14:59:43 -0800 Subject: [PATCH 3/4] Restore comment --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 515c6874c..056918dd9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -103,7 +103,7 @@ dev = [ "towncrier>=25.8.0", "tox", "tox-uv", - "zizmor==1.30.1", + "zizmor==1.30.1", # Sync with .github/workflows/zizmor.yml ] test = [ From 5bea620e64b759cbea41e4795e0efeba8ef826b2 Mon Sep 17 00:00:00 2001 From: Steve Piercy Date: Thu, 12 Nov 2026 15:08:05 -0800 Subject: [PATCH 4/4] stupid github editor grr... --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index f9e8d7645..f468d6b83 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -21,4 +21,4 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 Sync with pyproject.toml + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 Sync with pyproject.toml