Repository navigation
Tool hub: route Dependabot config and action manifests to zizmor - #2167
Merged
Merged
Conversation
zizmor audits more than workflows. Given the paths, it also reports on
.github/dependabot.yml and on GitHub Actions action manifests (action.yml or
action.yaml). The tool hub routed it only .github/workflows/*.yml, so those
files were never scanned. The zizmor row now also matches
.github/dependabot.yml and .yaml, and action.yml and .yaml in any directory the
hub does not exclude (node_modules, vendor, dist, build, ...); actionlint keeps
its workflows-only row. A changed action.yml that is not an Actions manifest
and is the only file given makes zizmor exit 3, which the hub reports as
NOT RUN: zizmor (exit 3) with a not-checked row, never as clean.
The hub merges each scanner's stderr into the file it parses, and zizmor logs
each audited path before its JSON. The JSON reader (sjson) started at the first
"[" or "{" anywhere in that output, so a bracket in a changed path could hide
findings: x/[]/action.yml read as an empty list (zizmor counted as run and
clean), and x/[id]/action.yml made the batch unparseable. sjson now starts at
the first line that begins with "[" or "{". Output with no such line still
fails closed as not run. The callers that read a report file (gitleaks, gosec)
are unaffected.
references/tool-hub.md: the zizmor row names the Dependabot config, action
manifests, the excluded directories and the exit 3 case. The file grows from
15368 to 15637 bytes; the fragment carries the size-budget-raise marker.
New test scripts/test-review-checks-zizmor-routes.sh, registered as
scripts/ci-tests.d/review-checks-zizmor-routes.sh, runs the hub with a zizmor
shim on a hermetic PATH. The shim logs each path to stderr as zizmor does and
reports one finding per file. The test checks that each routed file yields a
zizmor row; that zizmor receives exactly the workflows and the routed files (a
nested workflow, a Dependabot config outside the root .github/, and other YAML
are not routed); and that manifests under x/[]/ and x/[id]/ keep their
findings.
Tests: scripts/test-review-checks-zizmor-routes.sh 7/7 (6 of its 7 cases fail
on the routing-only commit before the sjson fix); run-ci-tests.sh --affected
4d6c926 passed all 42 sections (privacy, the trigger lint and 40 test or
check scripts, 21 of them review-checks-* suites including review-checks-tool-
hub and review-checks-zizmor-routes); size ratchet, fragments gate, privacy
and identity gates clean.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 15 routes Dependabot config and action manifests to zizmor, and stops the hub's JSON reader from starting at a bracket inside a scanner log line.
What changes
.github/dependabot.ymlandaction.yml(.yamltoo) in any directory the hub does not exclude; actionlint stays workflows-only.action.ymlthat is not an Actions manifest makes zizmor exit 3; the hub reports NOT RUN with a not-checked row, never clean.sjsondecodes from the first line starting with[or{, so a bracket in an audited path (x/[]/action.yml) no longer hides findings. Output without such a line still fails closed.references/tool-hub.mdnames the new routes and the exit 3 case; the fragment carries the size-budget-raise marker.scripts/test-review-checks-zizmor-routes.shwith a zizmor shim.Verification
sjsonfix.review-checks-*.This PR is the third of three
perprkeep-bar checks for #2161.🤖 Generated with Claude Code