← Back to issue list

ci: add zizmor workflow

View original Github issue

Metadata

Project
starflow
Number
#151
Type
pull request
State
merged
Author
jahn-junior
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169.

Resolution: closed resolved

Reason: PR was approved by 2 reviewers and merged into main as commit ad3d041 ('ci: add zizmor workflow'), adding a 'GitHub Actions security audit' zizmor job to .github/workflows/policy.yaml. Follow-up commits d8bdeaf (#168), 9a2cfd1 (#167) and d94e7e7 (#169) refined its permissions/flags, confirming the change landed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Add a Zizmor workflow to check the security of our CI.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169.
stealth/space-bunny-alpha — closed resolved Merged PR #151 in commit ad3d041, adding a 15-line Zizmor workflow to scan CI security. Two reviewers approved it and all checks passed.
stealth/space-bunny-alpha — closed resolved Merged a Zizmor workflow to automate GitHub Actions security checks. All CI checks passed, including the new scanner.
qwen/qwen3.6-35b-a3b — — Merged a Zizmor workflow to automate CI security checks. Approved by two reviewers with all CI checks passing. The single 15-line change integrates automated security scanning into the repository pipeline.
qwen/qwen3.6-35b-a3b
Staleness: 10
Complexity: 5
Confidence: 95
needs review Adds a Zizmor security workflow for CI checks. Approved by two reviewers, all CI checks pass, and no unresolved comments remain. Ready to merge.
qwen/qwen3.6-35b-a3b
Staleness: 15
Complexity: 5
Confidence: 90
needs review Adds a Zizmor security workflow for CI checks. Approved by two reviewers with passing CI. Two unresolved review comments remain. Ready for maintainer review and merge.
qwen/qwen3.6-35b-a3b
Staleness: 15
Complexity: 10
Confidence: 85
needs review Adds a Zizmor workflow to enhance CI security checks. Approved by two reviewers but has four unresolved comments and one failing CI check.
qwen3.6-35b-a3b-mtp-q6
Staleness: 25
Complexity: 15
Confidence: 85
needs review Adds a Zizmor security workflow to the CI pipeline. Currently awaiting maintainer review and CI checks.

Update history

Date Change
updated
updated
updated

Related work

  • Related To: canonical/starflow#168 (confidence 85%)

    Follow-up 'ci: update required permissions for zizmor' (d8bdeaf) adjusting the job added here

  • Related To: canonical/starflow#169 (confidence 80%)

    Follow-up 'feat(zizmor): don't require code security on private repositories' (d94e7e7) modifying the same job

  • Related To: canonical/starflow#167 (confidence 70%)

    Follow-up removing a deprecated zizmor flag (9a2cfd1) in the same workflow

Related issues

Issue Project State Summary Similarity
#1156 ci: add zizmor workflow craft-application merged Merged PR #1156 (commit 517f97e0) added a Zizmor GitHub Actions security-scanning workflow, adapted from canonical/starflow#151.
87%
#591 ci: add zizmor actions permission starbase merged Merged PR #591 (maintainer bepri) added the missing `actions` permission to the zizmor security-audit job in .github/workflows/policy.yaml (+1/-0), unblocking the zizmor check; approved with all CI checks green.
84%
#1670 ci: add zizmor actions permission craft-parts merged Merged PR #1670, adding the actions permission required by the zizmor workflow and resolving its GitHub Actions security finding.
83%
#416 ci: update permissions for zizmor craft-store merged PR #416 by bepri merged into main (commit 7ca1f48), granting the zizmor GitHub Actions security-audit job the permissions it needed so the check runs. 4-line workflow change, approved by 2 reviewers.
82%
#1163 ci: add zizmor actions permission craft-application merged Merged #1163, adding actions: read to the zizmor job's workflow permissions; merged as d4f1124c after review and all CI checks passed.
80%
#168 ci: update required permissions for zizmor starflow merged Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories.
80%
#245 ci: update permissions for zimzor craft-archives merged Merged PR #245 updated the GitHub Actions security workflow permissions, allowing the zizmor security check to run.
80%
#1015 ci: add permissions for zizmor craft-providers closed Merged as commit 74137d6, adding the workflow permissions required for the zizmor action to run.
80%
#999 ci: update permissions for zimzor craft-providers merged Merged PR #999 by bepri added 3 lines of GitHub Actions permissions for zizmor, unblocking the security scan workflow. Zizmor and GitHub Actions security audit checks passed; only unrelated OSV-scanner/min-deps checks failed.
79%
#208 ci: update permissions for zimzor craft-grammar merged Merged PR #208 as commit d280e77, updating GitHub Actions permissions so the zizmor security workflow could run.
78%