chore: make zizmor configuration less verbose
Metadata
Current evaluation
Merged to simplify zizmor configuration, allowing starflow workflows without hash pinning to reduce verbosity. Approved by two reviewers, passed all CI checks, and updated four files.
Suggested action: —
No scores available.
Issue body
This configures zizmor just once to allow any starflow workflows without hash pinning.
---
- [ ] I've followed the [contribution guidelines](https://github.com/canonical/starbase/blob/main/CONTRIBUTING.md).
- [ ] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/).
- [ ] I've successfully run `make lint && make test`.
- [ ] I've added or updated any relevant documentation.
- [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.
- [ ] I've updated the relevant release notes.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged to simplify zizmor configuration, allowing starflow workflows without hash pinning to reduce verbosity. Approved by two reviewers, passed all CI checks, and updated four files. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged following two approvals and successful CI checks. The change simplifies zizmor configuration to permit starflow workflows without hash pinning, updating four files with a +10/-5 line diff. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
10
Confidence:
95
|
needs review | Configures zizmor to reduce verbosity for starflow workflows without hash pinning. All CI checks pass, and the PR has one maintainer approval with no unresolved comments. Ready to merge. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
10
Confidence:
85
|
needs review | Configures zizmor to allow starflow workflows without hash pinning, reducing configuration verbosity. Currently pending maintainer review with all CI checks passing and one unresolved comment. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1675 ci: make zizmor accept unpinned references to Starflow | craft-parts | merged | Updates CI configuration to allow zizmor to accept unpinned references to Starflow. Approved by two reviewers with zero unresolved comments. Minimal change focused on security scanning configuration. | |
| #1668 chore: add zizmor permissions to policy workflow job | craft-parts | merged | Merged. Added explicit contents: read and security-events: write permissions to the policy job in .github/workflows/policy.yaml to satisfy Zizmor reusable workflow requirements. Approved by three reviewers and passed CI checks. | |
| #6393 ci: fix zizmor warnings | snapcraft | merged | Merged after approval by two reviewers. Resolved zizmor CI warnings across two files with minimal changes. | |
| #143 chore: migrate to starflow and Makefile | craft-archives | merged | Migrated to starflow and a new Makefile. Linting and uv.lock modification issues were fixed during review, alongside switching formatting from yamllint to prettier. Approved by two reviewers and merged after CI passed. | |
| #416 ci: update permissions for zizmor | craft-store | merged | Merged following two reviewer approvals. Updated CI workflow permissions for the zizmor security tool. All required checks passed, and the four-line configuration change was integrated into the main branch. | |
| #345 chore: hush some of the linter output | starbase | merged | Merged to reduce noisy linter output that flooded terminal logs. Approved by three reviewers, passed CI, and applied a two-line change to silence specific warnings. | |
| #5333 chore(merge): starbase into main | snapcraft | merged | Merged starbase into main to incorporate a new Jira configuration. Approved by two reviewers, passed CI checks, and updated four files. |