build: bump zizmorcore/zizmor-action to 0.7.1 by kyle-sexton · Pull Request #505 · melodic-software/ci-runner

kyle-sexton · 2026-10-30T18:59:02Z

No related issue: replaces Dependabot #501, which cannot pass Product policy on its own.

Summary

Moves zizmorcore/zizmor-action in the release workflow from v0.6.4 to v0.7.1. Dependabot's #501 rewrote only the workflow line, so scripts/Test-ReleasePins.ps1:391 failed: the pin disagreed with release/dependencies.json. This PR carries both edits in one commit.

Fix

.github/workflows/release-publish-image.yml: zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
release/dependencies.json githubActions entry: version 0.7.1, same commit

Verification

gh api repos/zizmorcore/zizmor-action/git/ref/tags/v0.7.1 resolves to commit 85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e.
Locally: node --test .github/scripts/*.test.cjs passes 23/23, and ./scripts/Test-ReleasePins.ps1 reports the pins as consistent.
The step runs only in the tag-triggered release workflow, so PR CI does not exercise the new action. The v0.7.0 notes change how the action bootstraps zizmor (no Docker) and do not change the version or persona inputs. The workflow still pins version: 1.30.1.

Moves the release workflow's zizmor-action pin to v0.7.1 and records the same version and commit in release/dependencies.json, which Dependabot cannot edit (Test-ReleasePins.ps1 requires the two to agree). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VcupojEVPjg9zYgTTu3TNk

chatgpt-codex-connector · 2026-10-30T18:59:17Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T19:00:13.463291Z	`68be5e4`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-10-30T19:00:10Z

claude-review reviewed 68be5e4be728af608e0f8686ad793c3016367b7a: 0 finding(s), 0 as inline comments.

No findings.

The PR bumps zizmorcore/zizmor-action from v0.6.4 to v0.7.1 in two places, and they agree:

.github/workflows/release-publish-image.yml:107 pins 85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1.
release/dependencies.json:122 records version 0.7.1 with the same commit.

A repo-wide grep found no other references to zizmor-action or the old SHA, so no stale pin remains.

Not verified by me:

I could not run gh api here, so I did not check that 85b2b9fb… is what the v0.7.1 tag resolves to. The author states it does.
I did not run the author's claimed node --test run or Test-ReleasePins.ps1. Both are author-claimed.
The step runs only in the tag-triggered release workflow, so PR CI does not exercise the new action. The author's claim that v0.7.0 leaves the version and persona inputs unchanged is also unverified. The workflow still passes version: 1.30.1.

Other checks:

There is no closing issue (the body says "No related issue"), so there are no acceptance criteria to check.
The only path-scoped rule file, .claude/rules/pr-body-contract.md, covers PR title and body format. The body carries the "No related issue" line and the Summary, Fix, Verification and Related sections.
No plugin manifests changed.

github-actions · 2026-10-30T19:00:20Z

claude-security-review reviewed 68be5e4be728af608e0f8686ad793c3016367b7a: 0 finding(s), 0 as inline comments.

Security review: PR #505 (build: bump zizmorcore/zizmor-action to 0.7.1)

The review found no security issues. critical-findings: 0

Scope. The PR changes two files, with one line changed in each plus the matching version/commit pair:

.github/workflows/release-publish-image.yml:107 moves the zizmorcore/zizmor-action pin from cc914d7f… (v0.6.4) to 85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e (v0.7.1).
release/dependencies.json:121-124 records the same version and commit.

What I checked.

The new reference is still a full 40-character commit SHA with a version comment, so the pinning convention is kept.
The two files agree on the version and commit.
Nothing else in the diff changed: with: inputs (version: 1.30.1, persona: pedantic), permissions:, triggers and secrets are untouched. The action's own behaviour is Actions hardening that zizmor's lane covers, so I did not re-report it.
No trust-control files, trusted paths, plugin manifests or instruction files are touched.
The repo has no other references to zizmor-action.

Not verified. I could not confirm that 85b2b9fb… is the commit the upstream v0.7.1 tag points to. The gh api lookup needed approval that was not available in this session. The commit-to-tag match is the one thing a reviewer or the repo's pin-verification tooling should confirm. It is a provenance check, not a flaw I found in the diff.

manifest: not applicable (no plugin.json or marketplace.json changes).

@sha256

…ewrites (#517) Closes #510 ## Summary Every Dependabot bump of a workflow `uses:` SHA or the Dockerfile `FROM` digest failed `Product policy`, because the release checks required those pins to match `release/dependencies.json`, which Dependabot cannot edit ([#505](#505), [#506](#506) and [#514](#514) were the replacement PRs). The pins are now read from the lines Dependabot rewrites. ## Fix - `scripts/ReleasePinSources.ps1` reads the runner image, version and digest from the single `FROM ghcr.io/actions/actions-runner:<v>@sha256:<d>` line, and each external Action's commit and version from its `uses: ...@<sha> # vX.Y.Z` lines. It fails with `file:line` when an Action has no release comment or two uses name different releases. - `Test-ReleasePins.ps1`, `Test-DependencyFreshness.ps1` and `New-CompatibilityManifest.ps1` use those values. `verify-worker-image.sh` and `verify-existing-release.sh` read the `FROM` line. The `compatibility.json` shape is unchanged. - `release/dependencies.json` drops `runner` and `githubActions`, and `Test-ReleasePins.ps1` refuses them if they come back. Checksums, tooling digests, sources and the ci-workflows `repositoryPins` stay. - Runner archive checksum: the image is pulled by digest and never built from the archive, so the hand-copied `archiveSha256` only fed the freshness gate. The gate now compares the asset digest GitHub reports with the SHA-256 published in the runner release notes (``). Both values matched for v2.338.2, v2.338.1, v2.337.0, v2.336.0 and v2.334.0 (`gh api repos/actions/runner/releases/tags/<tag>`). A runner bump therefore needs no checksum edit. - Docs: Action bumps can now pass, so the existing `vendor-actions` lane (`pr-automerge-dependabot.yml`) will auto-merge minor and patch `actions/*`, `github/*` and `anthropics/*` bumps once `ci-status` passes. `docs/releases.md` and `README.md` said no update is ever auto-merged. They now describe that lane. The lane's config is unchanged. ## Verification - `pwsh scripts/Test-ReleasePins.ps1` passes. - `node --test .github/scripts/*.test.cjs` passes (27 tests). The new `release-pins.test.cjs` covers a grouped Action bump and a runner bump with no manifest edit, mismatched SHAs across files, and a missing release comment. - `go test ./...`, shellcheck and shfmt are clean. - Reversing #500's Dockerfile diff and moving zizmor-action to its v0.7.1 pin, with no manifest edit, passes `Test-ReleasePins.ps1`. - The derived Action set is identical to the removed `githubActions` entries. `New-CompatibilityManifest.ps1` emits the same `dependencies` object (runnerVersion 2.338.2). - Not run locally: the full `Test-DependencyFreshness.ps1`, which needs a release token. It runs at the next tag. ## Related - [#510](#510) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01VcupojEVPjg9zYgTTu3TNk --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

kyle-sexton enabled auto-merge (squash) October 30, 2026 18:59

kyle-sexton merged commit bcabc62 into main Oct 30, 2026
28 checks passed

kyle-sexton deleted the build/zizmor-action-0.7.1 branch October 30, 2026 19:04

Navigation Menu

Repository navigation

build: bump zizmorcore/zizmor-action to 0.7.1 - #505

build: bump zizmorcore/zizmor-action to 0.7.1#505
kyle-sexton merged 1 commit into
mainfrom
build/zizmor-action-0.7.1

kyle-sexton commented Oct 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

kyle-sexton commented Oct 30, 2026

Summary

Fix

Verification

Related

Uh oh!

chatgpt-codex-connector Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Oct 30, 2026

Uh oh!

github-actions Bot commented Oct 30, 2026

Security review: PR #505 (build: bump zizmorcore/zizmor-action to 0.7.1)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chatgpt-codex-connector Bot commented Oct 30, 2026 •

edited

Loading