← Back to issue list

ci: update permissions for zimzor

View original Github issue

Metadata

Project
craft-providers
Number
#999
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed.

Resolution: closed resolved

Reason: The PR itself was merged with an approving review, and its stated purpose — unblocking the zizmor security scan workflow — was achieved: the 'zizmor' and 'policy / GitHub Actions security audit' checks both passed. The remaining failures (Security scan / OSV-scanner, Minimum dependencies) are unrelated to this workflow-permissions change.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Fixes an issue preventing the security scan workflow from running. --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed.
stealth/space-bunny-alpha — closed resolved PR canonical/craft-providers#999 (maintainer bepri) merged a 3-line workflow `permissions:` update so the zimzor/security scan workflow could run. Zizmor and policy audit checks passed; OSV-scanner and minimum-dependency jobs failed.
stealth/space-bunny-alpha — closed resolved PR canonical/craft-providers#999 merged a three-line workflow permissions update to unblock the security scan. Zizmor passed, while OSV-scanner and minimum-dependency checks failed.
qwen/qwen3.6-35b-a3b — — Merged a maintainer-approved update to CI permissions for zimzor. The three-line change resolves a configuration block preventing the security scan workflow from running. Integration completed after reviewer approval.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 85
needs review Updates CI permissions to fix a failing security scan workflow. Approved by one reviewer, most CI checks pass, one security scan check fails, others pending.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 90
needs review Updates CI workflow permissions to fix a broken security scan workflow. Approved by one reviewer, with CI mostly passing and several checks pending.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 90
needs review Updates CI workflow permissions to fix a broken security scan. Approved by one reviewer, pending CI checks, minimal 3-line change.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 90
needs review Updates CI workflow permissions to fix a broken security scan workflow. Approved by one reviewer, with CI checks mostly passing and one failing security scan check.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 90
needs review Updates CI workflow permissions to fix a broken security scan. Approved by one reviewer, pending slow tests, with one unresolved comment and a failing OSV-scanner check.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 5
Confidence: 90
needs review Updates CI workflow permissions to fix a failing security scan job. Currently pending maintainer review with one unresolved comment and a failing OSV-scanner check.

Update history

Date Change
updated
updated
updated
updated
created

Related work

  • Related To: canonical/starbase#591 (confidence 85%)

    Sibling 'ci: add zizmor actions permission' PR in the upstream shared workflow repo that template-generated this change.

  • Related To: canonical/craft-store#416 (confidence 82%)

    Same bepri permissions-only change (4 lines) to unblock zizmor in craft-store; OSV-scanner/lint failures also unrelated.

  • Related To: canonical/craft-archives#245 (confidence 78%)

    Identically titled/titled-typo 'ci: update permissions for zimzor' PR applying the same fix across the Starbase fleet.

  • Related To: canonical/craft-grammar#208 (confidence 78%)

    Same fix merged as commit d280e77 in craft-grammar.

  • Related To: canonical/starflow#168 (confidence 75%)

    'ci: update required permissions for zizmor'; follows starflow#151 that first added the zizmor policy job.

Related issues

Issue Project State Summary Similarity
#245 ci: update permissions for zimzor craft-archives merged Merged PR #245 updated the GitHub Actions security workflow permissions, allowing the zizmor security check to run.
94%
#1324 ci: update permissions for zimzor rockcraft merged Merged as 36c7b7b4: PR #1324 by bepri added 4 lines of GitHub Actions permissions so the zizmor security workflow/job runs again; approved by 2 reviewers.
94%
#416 ci: update permissions for zizmor craft-store merged PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.
92%
#208 ci: update permissions for zimzor craft-grammar merged Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run.
92%
#168 ci: update required permissions for zizmor starflow merged Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories.
90%
#251 ci: update permissions for zizmor craft-archives merged Merged PR canonical/craft-archives#251 (commit 2845f6b) adding a one-line GitHub Actions permissions update required by the zizmor security-scan workflow; review approved and all CI checks passed.
88%
#471 ci: update permissions for zimzor craft-cli merged Merged PR #471 as commit 04d4625, adding permissions so the zizmor security workflow could run. All listed CI checks passed.
87%
#591 ci: add zizmor actions permission starbase merged Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.
84%
#1670 ci: add zizmor actions permission craft-parts merged Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
83%
#1163 ci: add zizmor actions permission craft-application merged Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed.
80%