← Back to issue list

ci: add zizmor actions permission

View original Github issue

Metadata

Project
craft-application
Number
#1163
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed.

Resolution: closed resolved

Reason: PR #1163 was merged as commit d4f1124c. Its one-line change granted the zizmor security scan the required GitHub Actions read permission.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [ ] Have you followed the guidelines for contributing? - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [ ] Have you successfully run `make lint && make test`? - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)? ---

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed.
stealth/space-bunny-alpha — closed resolved Merged canonical/starbase#591, adding the required GitHub Actions permission for zizmor; review and all reported CI checks passed.
qwen/qwen3.6-35b-a3b — — Merged a single-line update to grant zizmor actions permissions in the CI configuration. Approved by one reviewer and passed all security scans and tests.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 95
needs review Adds zizmor GitHub Actions permission to workflow configuration. Currently approved by one reviewer, with most CI checks passing and a few tests pending completion.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 95
needs review Adds zizmor GitHub Actions permission to the CI workflow. Currently approved by one reviewer, all CI checks passing, and ready for merge pending final maintainer approval.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 95
needs review Adds GitHub Actions permissions for the zizmor security scanning workflow. Approved by one reviewer, CI checks are passing or pending, and ready for maintainer merge.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 95
needs review Adds zizmor GitHub Actions permission to CI configuration. Approved by one reviewer, CI passing, awaiting final merge.
qwen/qwen3.6-35b-a3b
Staleness: 0
Complexity: 5
Confidence: 85
needs review Adds permissions for the zizmor GitHub Action in the CI workflow. PR is fresh, CI is passing, and awaits maintainer review.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 85
needs review Adds GitHub Actions permissions for the zizmor security audit tool. Currently pending maintainer review with CI checks passing.

Update history

Date Change
updated
updated
updated
updated
created

Related work

Related issues

Issue Project State Summary Similarity
#591 ci: add zizmor actions permission starbase merged Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.
90%
#1670 ci: add zizmor actions permission craft-parts merged Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
89%
#1015 ci: add permissions for zizmor craft-providers closed Merged as commit 74137d6, adding the workflow permissions required for the zizmor action to run.
89%
#1324 ci: update permissions for zimzor rockcraft merged Merged as 36c7b7b4: PR #1324 by bepri added 4 lines of GitHub Actions permissions so the zizmor security workflow/job runs again; approved by 2 reviewers.
83%
#416 ci: update permissions for zizmor craft-store merged PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.
83%
#168 ci: update required permissions for zizmor starflow merged Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories.
81%
#1156 ci: add zizmor workflow craft-application merged Merged PR #1156 (commit 517f97e0) added a Zizmor GitHub Actions security-scanning workflow, adapted from canonical/starflow#151.
80%
#471 ci: update permissions for zimzor craft-cli merged Merged PR #471 as commit 04d4625, adding permissions so the zizmor security workflow could run. All listed CI checks passed.
80%
#151 ci: add zizmor workflow starflow merged Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169.
80%
#999 ci: update permissions for zimzor craft-providers merged Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed.
80%