chore(deps): update zizmor to v1.29.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
zizmorcore/zizmor		minor	1.25.2 → 1.29.0
zizmorcore/zizmor-pre-commit	repository	minor	v1.26.1 → v1.29.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

zizmorcore/zizmor (zizmorcore/zizmor)

v1.29.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#​2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#​2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#​2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#​2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#​2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#​2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#​2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#​2234)

v1.28.0

Compare Source

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#​2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#​2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#​2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#​2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#​2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#​2205)

v1.27.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#​2153)
  Enhancements 🌱🔗

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#​2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#​2180)

Bug Fixes 🐛🔗

• Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#​2157)

• Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#​2177)

• Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#​2185)

v1.26.1

Compare Source

This is a small corrective release for 1.26.0.

v1.26.0

Compare Source

New Features 🌈🔗

• New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#​1985)

  Many thanks to @​andrew for proposing and implementing this improvement!

• New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#​2085)

  Many thanks to @​terror for proposing and implementing this improvement!

• New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#​2061)

  Many thanks to @​connorshea for proposing and implementing this improvement!

Enhancements 🌱🔗

• The cache-poisoning audit now detects additional cache disablement heuristics (#​2053)

• The known-vulnerable-actions audit is now configurable. See the configuration documentation for details (#​2084)

• The excessive-permissions audit is now aware of the code-quality permission (#​2088)

• The unpinned-uses audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @​v6) (#​2127)

Performance Improvements 🚄🔗

• Most online audits are significantly faster, thanks to more precise retry handling (#​2036)
  Bug Fixes 🐛🔗

• Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#​2026)

  Many thanks to @​fionn for implementing this fix!

• Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#​2040)

• Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#​2055)

• Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#​2059, #​2069)

• Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#​2073)

• Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#​2102)

• Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#​2098)

• The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#​1748, #​2095)

Changes ⚠️🔗

• The impostor-commit audit no longer suggests auto-fixes, to avoid incorrectly minimizing the amount of manual remediation work needed (#​2054)

• The JSON and SARIF outputs no longer contain a misleading prefix key (#​2095)

zizmorcore/zizmor-pre-commit (zizmorcore/zizmor-pre-commit)

v1.29.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#​2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#​2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#​2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#​2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#​2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#​2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#​2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#​2234)

v1.28.0

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0

v1.27.0

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.27.0

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "before 7am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.