From 15a4f3b564908d55d3766213eb4be4b03b743388 Mon Sep 17 00:00:00 2001 From: Baptiste Grenier Date: Mon, 29 Jun 2026 16:58:55 +0200 Subject: [PATCH] ci(zizmor): pin the zizmor binary version (stop ruleset drift) Forward-port of EUDCH/.github#7 so both org reusable workflows match. The zizmor-action defaulted to version: latest, so zizmor's ruleset/online-audit set could drift and turn CI red across callers with no repo change. Pin to 1.26.1; new audits now arrive only on a deliberate bump. --- .github/workflows/zizmor.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index fc265d6..770f964 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -81,6 +81,11 @@ jobs: # still blocks on findings via zizmor's exit code. continue-on-error: ${{ env.IS_FORK_PR == 'true' && inputs.advanced-security && !inputs.enforce }} with: + # Pin the zizmor BINARY (the action default is version: latest). Left + # unpinned, zizmor's ruleset and online-audit set drift, so a new or + # strengthened audit can turn CI red across every caller with no repo + # change. Bump this deliberately. + version: "1.26.1" persona: ${{ inputs.persona }} advanced-security: ${{ inputs.advanced-security && env.IS_FORK_PR != 'true' }} annotations: ${{ env.IS_FORK_PR == 'true' }}