← Back to issue list

ci: add zizmor workflow

View original Github issue

Metadata

Project
craft-application
Number
#1156
Type
pull request
State
merged
Author
mr-cal
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #1156 (commit 517f97e0) added a Zizmor GitHub Actions security-scanning workflow, adapted from canonical/starflow#151.

Resolution: closed resolved

Reason: The PR was merged as commit 517f97e0, adding Zizmor to scan GitHub Actions definitions for security issues. Its body cites canonical/starflow#151 as the source change.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you followed the guidelines for contributing? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? --- Allows the zizmor workflow to run. source: https://github.com/canonical/starflow/pull/151

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #1156 (commit 517f97e0) added a Zizmor GitHub Actions security-scanning workflow, adapted from canonical/starflow#151.
stealth/space-bunny-alpha — closed resolved Merged PR #151 in commit ad3d041, adding a zizmor workflow to scan GitHub Actions for CI security issues.
qwen/qwen3.6-35b-a3b — — Merged the addition of the zizmor CI workflow for security scanning. Approved by two reviewers with passing checks. The change adds a single workflow file to enable automated analysis.
qwen/qwen3.6-35b-a3b
Staleness: 0
Complexity: 0
Confidence: 95
needs review Adds zizmor security workflow to CI pipeline. Currently awaiting maintainer review with several CI checks still running or pending.

Update history

Date Change
updated
created

Related work

Related issues

Issue Project State Summary Similarity
#151 ci: add zizmor workflow starflow merged Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169.
87%
#1670 ci: add zizmor actions permission craft-parts merged Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
83%
#1015 ci: add permissions for zizmor craft-providers closed Merged as commit 74137d6, adding the workflow permissions required for the zizmor action to run.
81%
#1163 ci: add zizmor actions permission craft-application merged Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed.
80%
#168 ci: update required permissions for zizmor starflow merged Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories.
80%
#591 ci: add zizmor actions permission starbase merged Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.
79%
#416 ci: update permissions for zizmor craft-store merged PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.
79%
#999 ci: update permissions for zimzor craft-providers merged Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed.
78%
#245 ci: update permissions for zimzor craft-archives merged Merged PR #245 updated the GitHub Actions security workflow permissions, allowing the zizmor security check to run.
78%
#208 ci: update permissions for zimzor craft-grammar merged Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run.
77%