← Back to issue list

ci: update permissions for zizmor

View original Github issue

Metadata

Project
craft-store
Number
#416
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.

Resolution: closed resolved

Reason: The pull request was approved by 2 reviewers with no unresolved comments and merged as commit 7ca1f48 ('ci: update permissions for zizmor'), adding the 4 lines to the CI workflow. The zizmor check passed on the PR; the OSV-scanner and lint/files failures are unrelated to this workflow change.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Describe your changes. --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/craft-store/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.
stealth/space-bunny-alpha — closed resolved Merged into main: PR #416 by bepri added the GitHub Actions permissions zizmor needs, so the zizmor CI job now runs. 4-line change to the workflow file, approved by 2 reviewers; the zizmor check passed (OSV-scanner/lint failures are unrelated).
qwen/qwen3.6-35b-a3b — — Merged following two reviewer approvals. Updated CI workflow permissions for the zizmor security tool. All required checks passed, and the four-line configuration change was integrated into the main branch.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 10
Confidence: 85
needs review Updates GitHub Actions permissions for the zizmor security linter. Approved by one reviewer, currently shows minor CI failures unrelated to the workflow change.
qwen/qwen3.6-35b-a3b
Staleness: 0
Complexity: 0
Confidence: 85
needs review Updates CI permissions for zimzor. Currently pending maintainer review with minor CI failures on security audits and linting.

Update history

Date Change
updated
updated
created

Related issues

Issue Project State Summary Similarity
#1324 ci: update permissions for zimzor rockcraft merged Merged as 36c7b7b4: PR #1324 by bepri added 4 lines of GitHub Actions permissions so the zizmor security workflow/job runs again; approved by 2 reviewers.
92%
#999 ci: update permissions for zimzor craft-providers merged Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed.
92%
#251 ci: update permissions for zizmor craft-archives merged Merged PR canonical/craft-archives#251 (commit 2845f6b) adding a one-line GitHub Actions permissions update required by the zizmor security-scan workflow; review approved and all CI checks passed.
91%
#245 ci: update permissions for zimzor craft-archives merged Merged PR #245 updated the GitHub Actions security workflow permissions, allowing the zizmor security check to run.
90%
#168 ci: update required permissions for zizmor starflow merged Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories.
90%
#208 ci: update permissions for zimzor craft-grammar merged Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run.
90%
#591 ci: add zizmor actions permission starbase merged Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.
86%
#471 ci: update permissions for zimzor craft-cli merged Merged PR #471 as commit 04d4625, adding permissions so the zizmor security workflow could run. All listed CI checks passed.
86%
#1670 ci: add zizmor actions permission craft-parts merged Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
85%
#1015 ci: add permissions for zizmor craft-providers closed Merged as commit 74137d6, adding the workflow permissions required for the zizmor action to run.
84%