CI: zizmor flags unpinned GitHub Actions in check-renovate.yaml / release-publish.yaml
Metadata
Current evaluation
Tracking issue for zizmor flags on unpinned GitHub Actions in starbase-owned workflow files; awaiting triage
Suggested action: needs triage
Reason: The issue has no labels, no maintainer comments, and no assignee after 24 days. It is a legitimate tracking issue for upstream work in canonical/starbase (pinning action versions), but requires maintainer acknowledgment and prioritization before any action can be taken.
Impact:
40
Quick Win:
32.0
Staleness:
45
Complexity:
20
Confidence:
60
Support Request:
0
Issue body
🤖 [BEEP BOOP, A BOT WROTE THIS COMMENT - Claude Sonnet 5, GitHub Copilot CLI]
The repository's `zizmor` code-scanning check flags several `unpinned-uses` findings (actions referenced by tag instead of commit hash) in two starbase-owned workflow files:
- `.github/workflows/check-renovate.yaml` (`actions/checkout`, `actions/setup-node`, `mxschmitt/action-tmate`)
- `.github/workflows/release-publish.yaml` (`softprops/action-gh-release`, plus a `superfluous-actions` note that `gh release` could replace it)
These findings are **pre-existing on `main`** (confirmed by running `zizmor` locally against `origin/main` before any starbase-merge changes — the same actions were already unpinned, just at older version tags). They surfaced as new PR annotations in [#402](https://github.com/canonical/imagecraft/pull/402) only because that PR bumped the action versions (e.g. `actions/checkout@v6` → `@v7`), which caused `zizmor`'s "new alerts in changed code" heuristic to flag the already-unpinned lines.
Since both files are owned by `starbase` (Canonical's shared craft-tool scaffolding) rather than `imagecraft` itself, the long-term fix (hash-pinning these actions, or excluding/allow-listing them) likely belongs upstream in `canonical/starbase` so all consuming repos benefit. Tracking here so it isn't lost, and so future `update-starbase` merge PRs aren't blocked/confused by it.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
40
Quick Win:
32.0
Staleness:
45
Complexity:
20
Confidence:
60
Support Request:
0
|
needs triage | Tracking issue for zizmor flags on unpinned GitHub Actions in starbase-owned workflow files; awaiting triage | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
10
Confidence:
90
Support Request:
0
|
needs triage | CI scan flags unpinned GitHub Actions in two workflow files. Findings are pre-existing and owned by an upstream repository. Currently unlabelled and awaiting maintainer triage to decide between upstream fix or local allow-list. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
canonical/imagecraft#402
(confidence 80%)
The issue body references PR #402 where zizmor alerts surfaced due to action version bumps; PR #402 was closed as a test artifact but the underlying zizmor findings remain relevant.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #585 fix(ci): resolve all zizmor findings in GitHub workflows | starbase | merged | Merged. Resolved all 44 zizmor findings in GitHub Actions by pinning actions to commit hashes, restricting permissions, removing secrets inheritance, replacing a release action with a script, and adding justified ignores. All CI checks passed. |