← Back to issue list

ci: add permissions for zizmor

View original Github issue

Metadata

Project
craft-providers
Number
#1015
Type
pull request
State
closed
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged as commit 74137d6, adding the workflow permissions required for the zizmor action to run.

Resolution: closed resolved

Reason: The approved one-line CI change landed in squash commit 74137d6, whose subject explicitly references #1015. The change restored permissions needed by zizmor.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Lets the action run again. --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged as commit 74137d6, adding the workflow permissions required for the zizmor action to run.
stealth/space-bunny-alpha — closed stale PR #1015 added permissions needed for zizmor to run; it was approved and reported checks passed, but the PR was closed unmerged.
stealth/space-bunny-alpha — closed stale Closed unmerged: #1015 added the zizmor permissions needed to run the action; it was approved with all reported CI checks passing, but never merged.
qwen/qwen3.6-35b-a3b
Impact: 35
Quick Win: 27
Complexity: 10
Confidence: 85
Actionability: 85
needs review Adds permissions for zizmor GitHub Action to allow it to run. Approved by reviewer, CI passing, minimal 1-line change.

Update history

Date Change
closed
updated
created

Related issues

Issue Project State Summary Similarity
#1163 ci: add zizmor actions permission craft-application merged Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed.
89%
#1670 ci: add zizmor actions permission craft-parts merged Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
88%
#591 ci: add zizmor actions permission starbase merged Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.
85%
#416 ci: update permissions for zizmor craft-store merged PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.
84%
#471 ci: update permissions for zimzor craft-cli merged Merged PR #471 as commit 04d4625, adding permissions so the zizmor security workflow could run. All listed CI checks passed.
83%
#1324 ci: update permissions for zimzor rockcraft merged Merged as 36c7b7b4: PR #1324 by bepri added 4 lines of GitHub Actions permissions so the zizmor security workflow/job runs again; approved by 2 reviewers.
82%
#168 ci: update required permissions for zizmor starflow merged Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories.
82%
#208 ci: update permissions for zimzor craft-grammar merged Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run.
82%
#1156 ci: add zizmor workflow craft-application merged Merged PR #1156 (commit 517f97e0) added a Zizmor GitHub Actions security-scanning workflow, adapted from canonical/starflow#151.
81%
#245 ci: update permissions for zimzor craft-archives merged Merged PR #245 updated the GitHub Actions security workflow permissions, allowing the zizmor security check to run.
81%