ci: add zizmor actions permission
Metadata
Current evaluation
Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
Resolution: closed resolved
Reason: PR #1670 was approved and merged, with commit ec9502c3 recording the one-line CI permission change. The zizmor security scan passed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `make lint && make test`?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
---
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1670 in canonical/craft-parts, adding the required actions permission for the zizmor security scan; landed as commit ec9502c3. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/craft-parts#1670 (commit ec9502c3), granting zizmor the GitHub Actions permission required by the CI security checks. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after approval by two reviewers. Adds required GitHub Actions permissions for the zizmor security scanner to enable CI checks. The change is minimal, modifying a single file with one line addition. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
5
Confidence:
95
|
needs review | Adds zizmor GitHub Actions permission to CI configuration. Approved by one reviewer, CI checks are passing or pending, and the change is minimal (+1/-0 lines). | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
5
Confidence:
95
|
needs review | Adds zizmor Actions permission to CI workflow. All checks passing, approved by one reviewer, ready to merge. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
5
Confidence:
90
|
needs review | Adds zizmor GitHub Actions permission to CI workflow. PR is fresh, all CI checks pass, awaiting maintainer review. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #591 ci: add zizmor actions permission | starbase | merged | Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green. | |
| #1163 ci: add zizmor actions permission | craft-application | merged | Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed. | |
| #168 ci: update required permissions for zizmor | starflow | merged | Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories. | |
| #1015 ci: add permissions for zizmor | craft-providers | closed | Merged as commit 74137d6, adding the workflow permissions required for the zizmor action to run. | |
| #208 ci: update permissions for zimzor | craft-grammar | merged | Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run. | |
| #245 ci: update permissions for zimzor | craft-archives | merged | Merged PR #245 updated the GitHub Actions security workflow permissions, allowing the zizmor security check to run. | |
| #416 ci: update permissions for zizmor | craft-store | merged | PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers. | |
| #1324 ci: update permissions for zimzor | rockcraft | merged | Merged as 36c7b7b4: PR #1324 by bepri added 4 lines of GitHub Actions permissions so the zizmor security workflow/job runs again; approved by 2 reviewers. | |
| #151 ci: add zizmor workflow | starflow | merged | Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169. | |
| #999 ci: update permissions for zimzor | craft-providers | merged | Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed. |