ci: update permissions for zimzor
Metadata
Current evaluation
Merged as 36c7b7b4: PR #1324 by bepri added 4 lines of GitHub Actions permissions so the zizmor security workflow/job runs again; approved by 2 reviewers.
Resolution: closed resolved
Reason: The PR itself was merged into main as commit 36c7b7b4, adding the permissions block zizmor needs to the security workflow in .github/workflows, unblocking the security scan. The zizmor and GitHub Actions security audit checks passed; the only failures (source-spread-tests, OSV-scanner) are unrelated.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Fixes an issue preventing the security workflow from running.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/rockcraft/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
---
<sub>Stack created with <a href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as 36c7b7b4: PR #1324 by bepri added 4 lines of GitHub Actions permissions so the zizmor security workflow/job runs again; approved by 2 reviewers. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as 36c7b7b4: PR #1324 updated zimzor permissions to restore the security workflow, with two approvals and no unresolved review comments. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged to fix a broken security workflow by updating zimzor permissions. Approved by two reviewers, passed CI checks, and applied a four-line permission adjustment. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
5
Confidence:
95
|
needs review | Updates CI permissions for the zimzor workflow to fix a broken security check. Approved by two reviewers, zero unresolved comments, and ready to land. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
5
Confidence:
95
|
needs review | Updates CI workflow permissions to fix a broken security workflow. Authored by a maintainer, approved by one reviewer, and ready for merge. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related work
-
Related To:
canonical/craft-store#416
(confidence 72%)
Identical 'ci: update permissions for zimzor' PR in a sibling Canonical repo, same 4-line workflow permissions change
-
Related To:
canonical/craft-cli#471
(confidence 70%)
Same permissions fix for zizmor merged as 04d4625 in another Canonical project
-
Related To:
canonical/craft-archives#245
(confidence 68%)
Companion change enabling the zizmor security workflow in craft-archives
-
Related To:
canonical/craft-providers#999
(confidence 66%)
Same 3-line permissions addition for zizmor in craft-providers
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #245 ci: update permissions for zimzor | craft-archives | merged | Merged PR #245 updated the GitHub Actions security workflow permissions, allowing the zizmor security check to run. | |
| #208 ci: update permissions for zimzor | craft-grammar | merged | Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run. | |
| #999 ci: update permissions for zimzor | craft-providers | merged | Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed. | |
| #416 ci: update permissions for zizmor | craft-store | merged | PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers. | |
| #471 ci: update permissions for zimzor | craft-cli | merged | Merged PR #471 as commit 04d4625, adding permissions so the zizmor security workflow could run. All listed CI checks passed. | |
| #168 ci: update required permissions for zizmor | starflow | merged | Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories. | |
| #251 ci: update permissions for zizmor | craft-archives | merged | Merged PR canonical/craft-archives#251 (commit 2845f6b) adding a one-line GitHub Actions permissions update required by the zizmor security-scan workflow; review approved and all CI checks passed. | |
| #1670 ci: add zizmor actions permission | craft-parts | merged | Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding. | |
| #591 ci: add zizmor actions permission | starbase | merged | Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green. | |
| #1163 ci: add zizmor actions permission | craft-application | merged | Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed. |