zizmor

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit (#2450)

Sponsorship is appreciated!

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#2386)

  Many thanks to @marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#2444)

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

• Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271) Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#2256)

• The forbidden-uses audit now supports pre-commit config inputs (#2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#2272)

• The ref-confusion audit now supports pre-commit config inputs (#2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)

• The archived-uses audit now detects several more archived repositories (#2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)

• Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)

• Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server regist