← Back to issue list

ci: add zizmor actions permission

View original Github issue

Metadata

Project
starbase
Number
#591
Type
pull request
State
merged
Author
bepri
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.

Resolution: —

Evaluated by: mr-cal-bot

No scores available.

Issue body

Updates permissions for zizmor. --- - [ ] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md). - [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — — Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.
stealth/space-bunny-alpha — closed resolved Merged PR (canonical/starbase#591, +1/-0 in 1 file) by maintainer bepri added the missing GitHub Actions permission to the zizmor security-scan job; approved and merged to main with all CI checks green.
stealth/space-bunny-alpha — closed resolved PR #591 'ci: add zizmor actions permission' by maintainer bepri merged into starbase, granting the zizmor GitHub Actions the extra permissions it needs; +1/-0 line in one workflow file, all CI checks and review passed.
stealth/space-bunny-alpha — closed resolved Merged PR updated zizmor's GitHub Actions permissions; all CI checks and review passed.
qwen/qwen3.6-35b-a3b — — Merged to update GitHub Actions permissions for the zizmor security scanner. Approved by one reviewer with all CI checks passing.
qwen/qwen3.6-35b-a3b
Staleness: 0
Complexity: 5
Confidence: 95
needs review Updates zizmor GitHub Actions permissions. All CI checks pass. Awaiting maintainer review.
qwen/qwen3.6-35b-a3b
Staleness: 0
Complexity: 2
Confidence: 95
needs review Updates GitHub Actions permissions for the zizmor security scanner. CI tests pass, policy checks pending, awaiting maintainer review.

Update history

Date Change
updated
updated
created

Related issues

Issue Project State Summary Similarity
#1670 ci: add zizmor actions permission craft-parts merged Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
91%
#1163 ci: add zizmor actions permission craft-application merged Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed.
90%
#416 ci: update permissions for zizmor craft-store merged PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.
86%
#1015 ci: add permissions for zizmor craft-providers closed Merged as commit 74137d6, adding the workflow permissions required for the zizmor action to run.
85%
#168 ci: update required permissions for zizmor starflow merged Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories.
85%
#151 ci: add zizmor workflow starflow merged Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169.
84%
#999 ci: update permissions for zimzor craft-providers merged Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed.
84%
#1324 ci: update permissions for zimzor rockcraft merged Merged as 36c7b7b4: PR #1324 by bepri added 4 lines of GitHub Actions permissions so the zizmor security workflow/job runs again; approved by 2 reviewers.
83%
#245 ci: update permissions for zimzor craft-archives merged Merged PR #245 updated the GitHub Actions security workflow permissions, allowing the zizmor security check to run.
82%
#208 ci: update permissions for zimzor craft-grammar merged Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run.
82%