feat(zizmor): don't require code security on private repositories
Metadata
Current evaluation
Merged PR #169 (commit d94e7e7) made the zizmor job in .github/workflows/policy.yaml work on private forks: advanced-security and online-audits are disabled and annotations enabled when the repo is private.
Resolution: closed resolved
Reason: The PR was approved and merged into main as commit d94e7e7, adding three zizmor-action inputs in .github/workflows/policy.yaml: advanced-security and online-audits set to !github.event.repository.private, and annotations set to github.event.repository.private. This avoids the Code Security subscription requirement while still reporting findings.
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #169 (commit d94e7e7) made the zizmor job in .github/workflows/policy.yaml work on private forks: advanced-security and online-audits are disabled and annotations enabled when the repo is private. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/starflow#169: private repositories now report zizmor findings without requiring the paid Code Security feature. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a fix that updates the zizmor workflow to report security issues as warnings on private repositories, bypassing the paid Code Security feature requirement. Approved by two reviewers with all CI checks passing. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
10
Confidence:
95
|
needs review | Modifies zizmor workflow to bypass the paid Code Security feature on private repositories by reporting issues as standard workflow warnings. Approved by one reviewer, all CI checks passing, and ready to merge. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
10
Confidence:
90
|
needs review | Modifies zizmor workflow to bypass the paid Code Security requirement on private repositories by reporting issues as plain comments instead. Currently passing CI, awaiting maintainer review. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| created |
Related work
-
Related To:
canonical/starflow#151
(confidence 90%)
PR that originally added the zizmor job to policy.yaml; this change adjusts its behaviour on private repos.
-
Related To:
canonical/starflow#168
(confidence 80%)
Earlier follow-up PR (commit d8bdeaf) adding zizmor's required permissions, the same private/internal repo problem space.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #151 ci: add zizmor workflow | starflow | merged | Merged PR #151 (commit ad3d041) added a 15-line Zizmor job to .github/workflows/policy.yaml, auditing GitHub Actions security. All checks passed; the job remains on main and was later refined in #167, #168, #169. | |
| #168 ci: update required permissions for zizmor | starflow | merged | Merged PR #168 (commit d8bdeaf) added Zizmor's required GitHub Actions permission so the security scanner can run on internal repositories. |