ci: fix zizmor warnings
Metadata
Current evaluation
Merged PR #6393 as commit c41c04835, correcting Zizmor warnings originating from the Starbase merge in #6391.
Resolution: closed resolved
Reason: PR #6393 merged as commit c41c04835 to fix the Zizmor warnings originating from #6391. The Zizmor CI check passed after the changes.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Fixes zizmor warnings from https://github.com/canonical/snapcraft/pull/6391.
---
- [x] I've followed the [contribution guidelines](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md).
- [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [x] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #6393 as commit c41c04835, correcting Zizmor warnings originating from the Starbase merge in #6391. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #6393 (commit c41c04835), correcting the zizmor warnings originating from #6391 in Snapcraft CI. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after approval by two reviewers. Resolved zizmor CI warnings across two files with minimal changes. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
85
|
needs review | Fixes zizmor CI warnings by updating GitHub Actions workflows. Currently approved by one reviewer with two unresolved comments, and several integration tests are failing. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Updates GitHub Actions workflows to resolve zizmor security lint warnings. All CI checks pass except pending integration tests. Awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
5
Confidence:
90
|
needs review | Updates GitHub Actions workflows to resolve zizmor security warnings. Small CI-only change with passing checks and pending integration tests. Currently awaiting maintainer review. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| updated | |
| created |
Related work
-
Caused By:
canonical/snapcraft#6391
(confidence 100%)
PR #6391 merged Starbase into main, and #6393 explicitly fixes its resulting Zizmor warnings.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1675 ci: make zizmor accept unpinned references to Starflow | craft-parts | merged | Merged PR #1675 as commit d6836427, updating Starbase via canonical/starbase#595 so zizmor accepts unpinned Starflow references. | |
| #585 fix(ci): resolve all zizmor findings in GitHub workflows | starbase | merged | Merged in canonical/starbase#585 as commit f86068e, hardening GitHub workflows and reducing zizmor findings from 44 to 0; all CI checks passed. | |
| #2897 ci: fix actionlint findings ahead of Starbase merge | charmcraft | closed | PR #2897 (4 workflow files, +10/-32) fixing actionlint/zizmor findings — dropped paths-ignore from merge_group triggers, quoted shell expansions and $CHARMCRAFT_JSON/$proj_file, bound matrix.system via env. Approved by 2 reviewers, merged; OSV-scanner failure ruled unrelated. | |
| #471 ci: update permissions for zimzor | craft-cli | merged | Merged PR #471 as commit 04d4625, adding permissions so the zizmor security workflow could run. All listed CI checks passed. | |
| #167 ci: remove deprecated flag for zimzor | starflow | merged | Merged PR canonical/starflow#167 by maintainer bepri drops zizmor's deprecated `--upload-sarif` flag from the CI workflow (1 file, -2 lines) since SARIF upload is now the default, clearing recurring warnings. | |
| #1156 ci: add zizmor workflow | craft-application | merged | Merged PR #1156 (commit 517f97e0) added a Zizmor GitHub Actions security-scanning workflow, adapted from canonical/starflow#151. |