chore(deps): update pre-commit hook zizmorcore/zizmor-pre-commit to v1.30.0 - #72

v1.30.0

Compare Source

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#​2271)
  Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#​2256)

• The forbidden-uses audit now supports pre-commit config inputs (#​2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#​2272)

• The ref-confusion audit now supports pre-commit config inputs (#​2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#​2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#​2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#​2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#​2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#​2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#​2340)

• The archived-uses audit now detects several more archived repositories (#​2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#​2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#​2345)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#​2259)

• Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#​2289)

• Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#​2300)

• Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#​2308)

• Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#​2295)

  Many thanks to @​dmbuil for proposing and implementing this improvement!

• Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#​2330)

• Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#​2337)

• Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#​2339)

• Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#​2247)

  Many thanks to @​potiuk for proposing and implementing this improvement!

• Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#​2349)

v1.29.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#​2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#​2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#​2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#​2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#​2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#​2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#​2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#​2234)

v1.28.0

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0

v1.27.0

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.27.0

v1.26.1

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.26.1

v1.26.0

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.26.0

v1.25.2

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.25.2

v1.25.1

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.25.1

v1.25.0

Compare Source

See: https://github.com/zizmorcore/zizmor/releases/tag/v1.25.0