From aeaa1a1ee91d229375b1d1973a9bb393ce962a8e Mon Sep 17 00:00:00 2001 From: prombot Date: Thu, 22 Oct 2026 17:48:51 +0000 Subject: [PATCH 1/3] Update common Prometheus files Signed-off-by: prombot --- .github/workflows/approve-workflows.yml | 3 +- .github/workflows/zizmor.yml | 84 +++++++++++++++++++++++++ 2 files changed, 86 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/approve-workflows.yml b/.github/workflows/approve-workflows.yml index 697118dfc1..cfbb86eafa 100644 --- a/.github/workflows/approve-workflows.yml +++ b/.github/workflows/approve-workflows.yml @@ -5,7 +5,8 @@ name: Approve pending workflows on: - issue_comment: + # The pinned action requires triage access or higher and only calls GitHub APIs. + issue_comment: # zizmor: ignore[dangerous-triggers] types: [created] permissions: read-all diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000000..ac67240fbf --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,84 @@ +--- +# This workflow runs zizmor to find security issues in GitHub Actions workflows. +# It is synchronized from https://github.com/prometheus/prometheus. +# +# If the "GitHub Actions Security" check fails: +# +# 1. Open the "Run zizmor" step in the failed job. Each finding identifies +# a rule, the affected file and line, and the reason for the finding. +# The scan can report existing issues in files your PR did not change. +# +# 2. Find guidance for the reported rule at https://docs.zizmor.sh/audits/. +# Fix the affected workflow and push your changes to rerun the check. +# +# 3. To reproduce locally, install the zizmor version specified below using +# the instructions at https://docs.zizmor.sh/installation/. +# From the repository root, run `zizmor .`. +# Some findings can be fixed with `zizmor --fix=safe .`. +# Review the resulting diff and verify that the workflows still work. +# +# If a finding appears incorrect or a fix is unclear, ask the repository +# maintainers before adding an exception. Document the reason for any exception +# and keep it scoped to the specific finding. See the configuration reference +# at https://docs.zizmor.sh/configuration/. +# +# Propose changes to this shared workflow in prometheus/prometheus so they +# can be synchronized across repositories. +name: GitHub Actions Security + +on: + pull_request: + push: + branches: + - main + - master + +permissions: + contents: read + actions: read + +jobs: + zizmor: + name: Run zizmor + runs-on: ubuntu-latest + timeout-minutes: 5 + + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor + id: zizmor + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + with: + advanced-security: false + version: 1.31.1 + + - name: Explain how to resolve findings + if: failure() && steps.zizmor.outcome == 'failure' + run: | + cat >> "$GITHUB_STEP_SUMMARY" <<'EOF' + ### Troubleshooting GitHub Actions Security + + Open the **Run zizmor** step for the findings or execution error. + Each finding identifies the affected file, line, and rule. + The scan can report existing issues in files your PR did not change. + + 1. Follow the [guidance for the reported rule](https://docs.zizmor.sh/audits/). + 2. Fix the affected workflow and push your changes to rerun the check. + + To reproduce locally, [install zizmor](https://docs.zizmor.sh/installation/) + using the version specified in this workflow and run `zizmor .` from + the repository root. Some findings can be fixed with `zizmor --fix=safe .`. + Review the resulting diff and verify that the workflows still work. + + If a finding appears incorrect or a fix is unclear, ask the repository + maintainers before adding an exception. Document the reason and keep + the exception scoped to the specific finding. See the + [configuration reference](https://docs.zizmor.sh/configuration/). + + This workflow is synchronized from [prometheus/prometheus](https://github.com/prometheus/prometheus). + Propose shared workflow changes there so they can reach all repositories. + EOF From 960fef724d2c9363ae0c495242099ee6bc82f967 Mon Sep 17 00:00:00 2001 From: Gregor Zeitlinger Date: Mon, 2 Nov 2026 12:27:54 +0100 Subject: [PATCH 2/3] fix Signed-off-by: Gregor Zeitlinger --- .github/renovate-tracked-deps.json | 12 ++++++++++++ mise.lock | 2 +- mise.toml | 2 +- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json index af9b26ba66..f994507909 100644 --- a/.github/renovate-tracked-deps.json +++ b/.github/renovate-tracked-deps.json @@ -225,6 +225,14 @@ "ubuntu" ] }, + ".github/workflows/zizmor.yml": { + "github-actions": [ + "actions/checkout", + "ghcr.io/zizmorcore/zizmor", + "ubuntu", + "zizmorcore/zizmor-action" + ] + }, ".mise/locks/npm-renovate/44.82.0~026f02c4/package.json": { "npm": [ "renovate" @@ -388,6 +396,10 @@ "prometheus/promci/approve_workflows": { "packageName": "prometheus/promci", "refKind": "version-tag" + }, + "zizmorcore/zizmor-action": { + "packageName": "zizmorcore/zizmor-action", + "refKind": "version-tag" } } } diff --git a/mise.lock b/mise.lock index 8a833596b5..85ca92d329 100644 --- a/mise.lock +++ b/mise.lock @@ -52,7 +52,7 @@ provenance = "github-attestations" [[tools."aqua:grafana/flint"]] version = "0.22.15" backend = "aqua:grafana/flint" -specifiers = ["0.22.15"] +specifiers = ["latest"] [tools."aqua:grafana/flint"."platforms.linux-arm64"] checksum = "sha256:1a266d19a688bf4a67c75a8c8af9928459d8c6aace907a17afcdb39938a4254b" diff --git a/mise.toml b/mise.toml index deabf97224..6c6d5ca093 100644 --- a/mise.toml +++ b/mise.toml @@ -11,7 +11,7 @@ protoc = "latest" # Linters actionlint = "latest" -"aqua:grafana/flint" = "0.22.15" +"aqua:grafana/flint" = "latest" "aqua:jonwiggins/xmloxide" = "latest" "aqua:owenlamont/ryl" = "latest" biome = "latest" From e1af8955035f05fd601c46a4de95e4706543fe71 Mon Sep 17 00:00:00 2001 From: Gregor Zeitlinger Date: Mon, 2 Nov 2026 14:04:58 +0100 Subject: [PATCH 3/3] zizmor only via separate workflow (not flint anymore) Signed-off-by: Gregor Zeitlinger --- .github/renovate-tracked-deps.json | 3 +- mise.lock | 126 +++++++++++------------------ mise.toml | 1 - 3 files changed, 50 insertions(+), 80 deletions(-) diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json index f994507909..042999b64f 100644 --- a/.github/renovate-tracked-deps.json +++ b/.github/renovate-tracked-deps.json @@ -307,8 +307,7 @@ "shellcheck", "shfmt", "taplo", - "typos", - "zizmor" + "typos" ], "regex": [ "grafana/docker-otel-lgtm", diff --git a/mise.lock b/mise.lock index 85ca92d329..2689bde7e8 100644 --- a/mise.lock +++ b/mise.lock @@ -105,36 +105,43 @@ specifiers = ["latest"] checksum = "sha256:1d8284557e66dd5c6e4d5b37a651afca98bea42729df7b4aa8720464360b2f54" url = "https://github.com/grafana/gcx/releases/download/v1.7.1/gcx_1.7.1_linux_arm64.tar.gz" url_api = "https://api.github.com/repos/grafana/gcx/releases/assets/662320575" +provenance = "cosign" [tools."aqua:grafana/gcx"."platforms.linux-arm64-musl"] checksum = "sha256:1d8284557e66dd5c6e4d5b37a651afca98bea42729df7b4aa8720464360b2f54" url = "https://github.com/grafana/gcx/releases/download/v1.7.1/gcx_1.7.1_linux_arm64.tar.gz" url_api = "https://api.github.com/repos/grafana/gcx/releases/assets/662320575" +provenance = "cosign" [tools."aqua:grafana/gcx"."platforms.linux-x64"] checksum = "sha256:5f1601feac13d850017064a9b556f11983de6def2986ba0bee402a947659c3e9" url = "https://github.com/grafana/gcx/releases/download/v1.7.1/gcx_1.7.1_linux_amd64.tar.gz" url_api = "https://api.github.com/repos/grafana/gcx/releases/assets/662320576" +provenance = "cosign" [tools."aqua:grafana/gcx"."platforms.linux-x64-musl"] checksum = "sha256:5f1601feac13d850017064a9b556f11983de6def2986ba0bee402a947659c3e9" url = "https://github.com/grafana/gcx/releases/download/v1.7.1/gcx_1.7.1_linux_amd64.tar.gz" url_api = "https://api.github.com/repos/grafana/gcx/releases/assets/662320576" +provenance = "cosign" [tools."aqua:grafana/gcx"."platforms.macos-arm64"] checksum = "sha256:61b0f912d21abf7d8e22bdcc0199b56403dcf19f29bef73d74119d53782f479d" url = "https://github.com/grafana/gcx/releases/download/v1.7.1/gcx_1.7.1_darwin_arm64.tar.gz" url_api = "https://api.github.com/repos/grafana/gcx/releases/assets/662320581" +provenance = "cosign" [tools."aqua:grafana/gcx"."platforms.macos-x64"] checksum = "sha256:a4b220526381f632f8b2bd578c52f8a687717633fcff4e9dc4e2407b2d1b3c3e" url = "https://github.com/grafana/gcx/releases/download/v1.7.1/gcx_1.7.1_darwin_amd64.tar.gz" url_api = "https://api.github.com/repos/grafana/gcx/releases/assets/662320574" +provenance = "cosign" [tools."aqua:grafana/gcx"."platforms.windows-x64"] checksum = "sha256:a4c3e70261011b6d71fffcd0b44755d0642f91dde4da9f0970b87d9739d0e7ae" url = "https://github.com/grafana/gcx/releases/download/v1.7.1/gcx_1.7.1_windows_amd64.zip" url_api = "https://api.github.com/repos/grafana/gcx/releases/assets/662320674" +provenance = "cosign" [[tools."aqua:grafana/oats"]] version = "0.10.0" @@ -353,43 +360,50 @@ url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/59 [[tools.editorconfig-checker]] version = "4.0.2" -backend = "aqua:editorconfig-checker/editorconfig-checker" +backend = "github:editorconfig-checker/editorconfig-checker" specifiers = ["latest"] [tools.editorconfig-checker."platforms.linux-arm64"] checksum = "sha256:abad76da8c9950fdc2a314bcd66969172aa823e9c595fa7e3a389a91e34d025e" url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v4.0.2/editorconfig-checker-linux-arm64.tar.gz" url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/574675779" +provenance = "github-attestations" [tools.editorconfig-checker."platforms.linux-arm64-musl"] checksum = "sha256:abad76da8c9950fdc2a314bcd66969172aa823e9c595fa7e3a389a91e34d025e" url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v4.0.2/editorconfig-checker-linux-arm64.tar.gz" url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/574675779" +provenance = "github-attestations" [tools.editorconfig-checker."platforms.linux-x64"] checksum = "sha256:44efaef3ed14c6ab52eb87481d78e5e5c204796dccf26e2f4598a61ba17f8003" url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v4.0.2/editorconfig-checker-linux-amd64.tar.gz" url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/574675771" +provenance = "github-attestations" [tools.editorconfig-checker."platforms.linux-x64-musl"] checksum = "sha256:44efaef3ed14c6ab52eb87481d78e5e5c204796dccf26e2f4598a61ba17f8003" url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v4.0.2/editorconfig-checker-linux-amd64.tar.gz" url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/574675771" +provenance = "github-attestations" [tools.editorconfig-checker."platforms.macos-arm64"] checksum = "sha256:ff59f57717d95fc62b8e372c8051dbbb766f7d660942409a85d027b0feb2422c" url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v4.0.2/editorconfig-checker-darwin-all.tar.gz" url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/574675773" +provenance = "github-attestations" [tools.editorconfig-checker."platforms.macos-x64"] checksum = "sha256:ff59f57717d95fc62b8e372c8051dbbb766f7d660942409a85d027b0feb2422c" url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v4.0.2/editorconfig-checker-darwin-all.tar.gz" url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/574675773" +provenance = "github-attestations" [tools.editorconfig-checker."platforms.windows-x64"] checksum = "sha256:857f8f74dfc259d73dac93573e37cf3ce01150787d7b139bf839549cc6b5beb9" url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v4.0.2/editorconfig-checker-windows-amd64.zip" url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/574675794" +provenance = "github-attestations" [[tools.google-java-format]] version = "1.37.0" @@ -479,12 +493,12 @@ backend = "core:java" specifiers = ["temurin-25"] [tools.java."platforms.linux-arm64"] -checksum = "sha256:69df11a02cfa3ef7d7ca645e03edce6778ec090e100f6ae2b42097865730ac52" -url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.4.1%2B1/OpenJDK25U-jdk_aarch64_linux_hotspot_25.0.4.1_1.tar.gz" +checksum = "sha256:bb5b2ded252f21c6090cf780b0a408ad0d83bbb557e702955643557f13231880" +url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_aarch64_linux_hotspot_25.0.5_8.tar.gz" [tools.java."platforms.linux-arm64-musl"] -checksum = "sha256:8d19373d427017d86ac87cf6a47ba49746be864832f60b52b7e3b1531c6b2cb8" -url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.4.1%2B1/OpenJDK25U-jdk_aarch64_alpine-linux_hotspot_25.0.4.1_1.tar.gz" +checksum = "sha256:d02eadc0a0f93faba4be38c8657eb8eef842103a4c7c2400f5827dbd90fc21c9" +url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_aarch64_alpine-linux_hotspot_25.0.5_8.tar.gz" [tools.java."platforms.linux-x64"] checksum = "sha256:68982529869257d0ee6b824ec5aa270ff8b118bb438670da0b97ebdab178d7fb" @@ -499,66 +513,66 @@ checksum = "sha256:36dc14d797aaff6d89aab302cd053fdba6207dfdcf772052fa7b023a94b0e url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_aarch64_mac_hotspot_25.0.5_8.tar.gz" [tools.java."platforms.macos-x64"] -checksum = "sha256:e6229d9504f7922053ab31821b9e6bee8761daf7b026a3476d1a027563009880" -url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.4.1%2B1/OpenJDK25U-jdk_x64_mac_hotspot_25.0.4.1_1.tar.gz" +checksum = "sha256:32cd4d2151c91aa00d0fc911edfd05245ed40fa6b1aa894d5f35c928cd67a59d" +url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_x64_mac_hotspot_25.0.5_8.tar.gz" [tools.java."platforms.windows-x64"] -checksum = "sha256:00c847d804f4a78e9f04f2683faf14fed898535b177b7fc704486cb0284e9283" -url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.4.1%2B1/OpenJDK25U-jdk_x64_windows_hotspot_25.0.4.1_1.zip" +checksum = "sha256:636bdc13dc649ddc7d5921c5c7d23cca6e44fd19d662b45cc9c02135a6c96c42" +url = "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_x64_windows_hotspot_25.0.5_8.zip" [[tools.java]] -version = "temurin-21.0.12+101.0.LTS" +version = "temurin-21.0.13+9.0.LTS" backend = "core:java" specifiers = ["temurin-21"] [tools.java."platforms.linux-arm64"] -checksum = "sha256:23e37e026f12f3e706f18938ff611db3032d075b09d0879a25d06718c773e223" -url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.12.1_1.tar.gz" +checksum = "sha256:e3522e707fc7dbe2a72c30746b1e7068301a0213ecd213d4491f35a14eb55578" +url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.13%2B9/OpenJDK21U-jdk_aarch64_linux_hotspot_21.0.13_9.tar.gz" [tools.java."platforms.linux-arm64-musl"] -checksum = "sha256:8242627927adc90ac2561d0812dd39890ebc21ef09b550bc2e8b93640b8af4f8" -url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.12.1_1.tar.gz" +checksum = "sha256:a41f2d7b886ed318db51543cd045d94dd35179f66df302e6c3fd48a41a6dd9f5" +url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.13%2B9/OpenJDK21U-jdk_aarch64_alpine-linux_hotspot_21.0.13_9.tar.gz" [tools.java."platforms.linux-x64"] -checksum = "sha256:ce79869e1307ed8ee1e2baa86a412b1eb5b75d10a01006d788a6f968bcfaee94" -url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_x64_linux_hotspot_21.0.12.1_1.tar.gz" +checksum = "sha256:d7f5d5cf865a2902b70ff549b97586a7d3f234e016f041ab447ea740c7d66d1c" +url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.13%2B9/OpenJDK21U-jdk_x64_linux_hotspot_21.0.13_9.tar.gz" [tools.java."platforms.linux-x64-musl"] -checksum = "sha256:bd8824214e42b33333c7f55a039ea078ad6ea6be20d7c5b011c801fb2bdb44f0" -url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.12.1_1.tar.gz" +checksum = "sha256:dc453842ee3f24710258f42a95bdfe5c2bfc0ca9d70c12f950ead82aee0c8361" +url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.13%2B9/OpenJDK21U-jdk_x64_alpine-linux_hotspot_21.0.13_9.tar.gz" [tools.java."platforms.macos-arm64"] -checksum = "sha256:3623232f33a9c3baadf304480b2535f9a3cba8a58d42ecbb438ba267315d9998" -url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.12.1_1.tar.gz" +checksum = "sha256:bf036b35b071bfb2f54f2c0af8ee8d88afa95ee6eb3dce02c0f94cfc2524d04a" +url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.13%2B9/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.13_9.tar.gz" [tools.java."platforms.macos-x64"] -checksum = "sha256:44db0f08196daf19a47f90d13388b0c943b67663cb537f998fe29e836fa842ce" -url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_x64_mac_hotspot_21.0.12.1_1.tar.gz" +checksum = "sha256:9aa1d1c17ae5467a022679e7e0af5c00797d94ac462ed1a46f4db07a8a34a6dd" +url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.13%2B9/OpenJDK21U-jdk_x64_mac_hotspot_21.0.13_9.tar.gz" [tools.java."platforms.windows-x64"] -checksum = "sha256:f9d6e191ab098c0d416e7d588a24420a8621cd2f4720dab2459b8b7b2d2d8b4e" -url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_x64_windows_hotspot_21.0.12.1_1.zip" +checksum = "sha256:a4dbaa05fca4bd89d84584e58c459bd732efebb1722af80ab13c6516832004f9" +url = "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.13%2B9/OpenJDK21U-jdk_x64_windows_hotspot_21.0.13_9.zip" [[tools.java]] -version = "oracle-graalvm-25.0.5" +version = "oracle-graalvm-25.0.5.0.3" backend = "core:java" specifiers = ["oracle-graalvm-25"] [tools.java."platforms.linux-arm64"] -checksum = "sha256:53975795fb5d669e7cbbf89620e38c7430e69e2be199c2c8ea4e5b371a927674" -url = "https://gds.oracle.com/download/graal/25/archive/graalvm-jdk-25.0.5_linux-aarch64_bin.tar.gz" +checksum = "sha256:be4b87e503fa0adc3dd0ea522138f2cef5ec6fe6d1d40f07004566f13de0e7cf" +url = "https://gds.oracle.com/download/graal/25/archive/graalvm-jdk-25.0.5.0.3_linux-aarch64_bin.tar.gz" [tools.java."platforms.linux-x64"] -checksum = "sha256:2ae8b03dfcb0a5bbcb55ffd122e8ffee24e3afce04bccc82932789acd005d1e1" -url = "https://gds.oracle.com/download/graal/25/archive/graalvm-jdk-25.0.5_linux-x64_bin.tar.gz" +checksum = "sha256:b907d3bdf1eabff6d2b3fcb93ccd44004a0eee66730a28ace0a5b5f5cb2ac46a" +url = "https://gds.oracle.com/download/graal/25/archive/graalvm-jdk-25.0.5.0.3_linux-x64_bin.tar.gz" [tools.java."platforms.macos-arm64"] -checksum = "sha256:1ac6422ba93abef7d872490245c7186a6812e173965236bee80fc68a738e05ae" -url = "https://gds.oracle.com/download/graal/25/archive/graalvm-jdk-25.0.5_macos-aarch64_bin.tar.gz" +checksum = "sha256:ec4faf8fcfc45b7b7bbdc7b72a0df338424951389f149f0f2c281fde8d47c08d" +url = "https://gds.oracle.com/download/graal/25/archive/graalvm-jdk-25.0.5.0.3_macos-aarch64_bin.tar.gz" [tools.java."platforms.windows-x64"] -checksum = "sha256:192d0328f9ce9c19f1e73278d638c06635e2d5ff744f11ba1c37b23f5db402d2" -url = "https://gds.oracle.com/download/graal/25/archive/graalvm-jdk-25.0.5_windows-x64_bin.zip" +checksum = "sha256:1c8331a2f6ed14b4b3624f8a8c158beda8c8a7f22c90aa3aff8ecf571960bccf" +url = "https://gds.oracle.com/download/graal/25/archive/graalvm-jdk-25.0.5.0.3_windows-x64_bin.zip" [[tools.lychee]] version = "0.24.2" @@ -610,9 +624,8 @@ checksum = "sha256:95c264150aceb7f3437a29fd6984924f5f8d1511ea3cbd6c508b83f6c555d url = "https://nodejs.org/dist/v24.22.2/node-v24.22.2-linux-arm64.tar.gz" [tools.node."platforms.linux-arm64-musl"] -checksum = "sha256:b2f5443a34a38d863e87c0f5f80c03630fc16917dfe16f26c1cec44c0b542959" -url = "https://nodejs.org/dist/v24.22.2/node-v24.22.2.tar.gz" -install = "source" +checksum = "sha256:70afd250a927fbc32f3d95a58597efdf14aa8ad194e894268f9b8309a2dab84e" +url = "https://unofficial-builds.nodejs.org/download/release/v24.22.2/node-v24.22.2-linux-arm64-musl.tar.gz" [tools.node."platforms.linux-x64"] checksum = "sha256:361718c444e49af2ca5a110c83ba6a8901143f23ab285ebbef0341f391f482a9" @@ -930,44 +943,3 @@ url_api = "https://api.github.com/repos/crate-ci/typos/releases/assets/589006772 checksum = "sha256:b59f149d84e86aab535d52db029fa8d3ac5ecba9ae5c7f19cf07acb5aa0caaaf" url = "https://github.com/crate-ci/typos/releases/download/v1.50.3/typos-v1.50.3-x86_64-pc-windows-msvc.zip" url_api = "https://api.github.com/repos/crate-ci/typos/releases/assets/589001623" - -[[tools.zizmor]] -version = "1.30.1" -backend = "aqua:zizmorcore/zizmor" -specifiers = ["latest"] - -[tools.zizmor."platforms.linux-arm64"] -checksum = "sha256:7ff1dce33bdd18fd2a4affe63bdd47efcccca97b2cec1c1863ec26e9e2647540" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-aarch64-unknown-linux-gnu.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067643" -provenance = "github-attestations" - -[tools.zizmor."platforms.linux-arm64-musl"] -provenance = "github-attestations" - -[tools.zizmor."platforms.linux-x64"] -checksum = "sha256:e65324f4430c2717591937edcec90ccbefaf14c174f8ec9415e03ca875b46e1a" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-unknown-linux-gnu.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067642" -provenance = "github-attestations" - -[tools.zizmor."platforms.linux-x64-musl"] -provenance = "github-attestations" - -[tools.zizmor."platforms.macos-arm64"] -checksum = "sha256:e28d22b087f9ebb8d99da6e740d348c930f559961c7c3f12badda54f882195a2" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-aarch64-apple-darwin.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067640" -provenance = "github-attestations" - -[tools.zizmor."platforms.macos-x64"] -checksum = "sha256:10e6b18b11ea07e515a16f0f0518c7b07527bc9977c1fd5698181ce7f3554202" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-apple-darwin.tar.gz" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067641" -provenance = "github-attestations" - -[tools.zizmor."platforms.windows-x64"] -checksum = "sha256:b183b1e996eddfab9659f1e9b46e059f1ef1cf984a1f14e5da09f7876a4b3a1c" -url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-pc-windows-msvc.zip" -url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067645" -provenance = "github-attestations" diff --git a/mise.toml b/mise.toml index 6c6d5ca093..871f511da5 100644 --- a/mise.toml +++ b/mise.toml @@ -25,7 +25,6 @@ shellcheck = "latest" shfmt = "latest" taplo = "latest" typos = "latest" -zizmor = "latest" [tools."npm:renovate"] version = "latest"