TT-17286: replace slack notification with sariff report and pr comments

[olamilekan000]

Jira Ticket

TT-17286

Description

change replaces slack notification with sariff report on public repository and 
PR comments for private repos

Type of Change

• Bug fix
• New feature / action
• Refactor / improvement
• Documentation update
• CI/CD / workflow change
• Other (please describe):

Changes Made

Testing

• Manually triggered the affected workflow(s) and verified expected behaviour
• Checked that existing workflows are not broken

Checklist

• My changes follow the existing conventions in this repo
• I have updated relevant documentation (e.g. README.md, action description fields)
• For changed shell scripts (if applicable): I ran shellcheck, used an appropriate shebang and error handling, and preserved required executable permissions
• For changed actions/scripts (if applicable): I added or updated validation, tests, or clear manual verification steps
• For changed JavaScript files (if applicable): I ran the relevant tests and linting/formatting checks
• For changed Python files (if applicable): I ran the relevant tests and linting/formatting checks
• For Dockerfile changes (if applicable): I reviewed the base image, build context, image size, and runtime security
• For changed actions (if applicable): I updated the action.yml interface, defaults, outputs, and examples as needed
• I reviewed security implications, including least-privilege permissions and safe handling of inputs, secrets, and tokens (if applicable)
• For workflow changes (if applicable): I reviewed triggers, permissions, concurrency, and fork safety
• I have assigned a reviewer

[github-actions]

zizmor findings

Severity	Count
High	89
Medium	81
Low	2
Info	11

Full details are in the workflow run.

[probelabs]

This PR refactors the zizmor reusable GitHub Actions workflow to replace Slack notifications with integrated GitHub pull request comments.

Files Changed Analysis

• .github/workflows/zizmor.yml: The core reusable workflow. The majority of changes are here, removing the Slack notification logic and adding a new step to post or update a PR comment using the gh CLI.
• .github/workflows/zizmor-self.yml: The workflow that calls the reusable workflow for self-testing. It's updated to remove the Slack secret and add the pull-requests: write permission required by the new commenting feature.

The changes primarily consist of removing the SLACK_WEBHOOK_URL secret and the associated notification step, and adding a new script that uses gh api to create or update a sticky comment on pull requests.

Architecture & Impact Assessment

This PR changes the notification mechanism for the zizmor security scanner from an external system (Slack) to a native GitHub feature (PR comments). This centralizes feedback directly within the developer's workflow.

Key Technical Changes:

• Slack Integration Removal: All code, configuration (SLACK_WEBHOOK_URL secret), and outputs related to Slack have been deleted.
• PR Comment Integration: A new step is introduced that uses the gh CLI to post a summary of findings as a comment on the pull request.
• Sticky Comments: The comment is made "sticky" by using an HTML marker (<!-- zizmor-report -->). The script first checks for a comment with this marker and updates it if found, preventing multiple comments on subsequent pushes. A new comment is only created if one doesn't exist and findings are present.
• Permissions Update: The workflows now require pull-requests: write permission to allow the gh CLI to create comments.

Affected Components:

• The zizmor.yml reusable workflow.
• All repositories and CI pipelines that utilize this reusable workflow will be affected. They will stop receiving Slack notifications and will start seeing comments on their PRs instead.

Workflow Change Visualization:

Before:

graph TD
    A[Zizmor Scan in PR] --> B{Findings?};
    B -- Yes --> C[Format Slack Message];
    C --> D[Send to Slack Channel];
    B -- No --> E[End];

Loading

After:

graph TD
    A[Zizmor Scan in PR] --> B{Findings?};
    B -- Yes --> C[Format PR Comment];
    C --> D{Existing Comment?};
    D -- Yes --> E[Update PR Comment];
    D -- No --> F[Create New PR Comment];
    B -- No --> G{Existing Comment?};
    G -- Yes --> H[Update PR Comment with "No Findings"];
    G -- No --> I[End - No Comment Posted];

Loading

Scope Discovery & Context Expansion

The scope of this change extends beyond this repository to all consumers of the zizmor.yml reusable workflow. The primary impact is on the developer experience, as security feedback will now appear directly in the PR instead of a separate Slack channel. This is a positive change for centralizing information, but teams accustomed to Slack alerts will need to adapt to the new notification method. No other notification systems appear to be affected by this PR.

Metadata

• Review Effort: 3 / 5
• Primary Label: enhancement

---

Powered by Visor from Probelabs

Last updated: 2026-08-17T02:46:15.877Z | Triggered by: pr_opened | Commit: 864be90

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/zizmor.yml:115-160	The shell script to find and update a pull request comment re-implements a common pattern that could be handled by a dedicated GitHub Action. While the current implementation using `gh api` is correct and avoids an external dependency, a declarative approach might be simpler to maintain. 💡 Suggestion Consider using a pre-existing GitHub Action like `peter-evans/create-or-update-comment` to manage the PR comment. This would replace the multi-line shell script with a more declarative action, which can improve workflow readability and abstract away the implementation details of finding and updating comments. This is an alternative to consider, as the current approach is also valid.

✅ Security Check Passed

No security issues found – changes LGTM.

\n\n

Architecture Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/zizmor.yml:115-160	The shell script to find and update a pull request comment re-implements a common pattern that could be handled by a dedicated GitHub Action. While the current implementation using `gh api` is correct and avoids an external dependency, a declarative approach might be simpler to maintain. 💡 Suggestion Consider using a pre-existing GitHub Action like `peter-evans/create-or-update-comment` to manage the PR comment. This would replace the multi-line shell script with a more declarative action, which can improve workflow readability and abstract away the implementation details of finding and updating comments. This is an alternative to consider, as the current approach is also valid.

\n\n ### Performance Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/zizmor.yml:149	The script fetches all comments on a pull request to find a specific one to update. On pull requests with a large number of comments, this can be slow and consume a high number of GitHub API calls due to pagination. The `jq` query `[.[] | ...]` is not streamable and forces `gh api --paginate` to fetch all pages of comments before filtering. 💡 Suggestion Modify the `jq` query to use a streaming approach with `first(...)`. This allows `gh api` and `head -1` to stop processing as soon as the first matching comment is found, which will be significantly more performant on PRs with many comments. Replace `'[.[] | select(.body | startswith("<!-- zizmor-report -->"))][0].id // empty'` with `'first(.[] | select(.body | startswith("<!-- zizmor-report -->"))).id // empty'`.

---

Powered by Visor from Probelabs

Last updated: 2026-08-17T02:45:48.801Z | Triggered by: pr_opened | Commit: 864be90

💡 TIP: You can chat with Visor using /visor ask <your question>