Releases: zizmorcore/zizmor-pre-commit
Release list
v1.30.0
New Features 🌈🔗
-
New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)
Enhancements 🌱🔗 -
The impostor-commit audit now supports pre-commit config inputs (#2256)
-
The forbidden-uses audit now supports pre-commit config inputs (#2263)
-
The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add
Many thanks to @connorshea for proposing and implementing this enhancement!
-
The archived-uses audit now supports pre-commit config inputs (#2272)
-
The ref-confusion audit now supports pre-commit config inputs (#2274)
-
The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)
-
The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)
-
zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)
Many thanks to @njgudman for proposing and implementing this enhancement!
-
The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)
-
The unpinned-tools audit now detects usages of extractions/setup-just (#2339)
-
The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)
-
The archived-uses audit now detects several more archived repositories (#2340)
-
The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)
-
The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)
Bug Fixes 🐛🔗
-
Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)
-
Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)
-
Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#2300)
-
Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#2308)
-
Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#2295)
Many thanks to @dmbuil for proposing and implementing this improvement!
-
Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#2330)
-
Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#2337)
-
Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#2339)
-
Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#2247)
Many thanks to @potiuk for proposing and implementing this improvement!
-
Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#2349)
v1.29.0
New Features 🌈🔗
-
zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
-
New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
-
zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g.
uses: $/foo/barinstead of a manual checkout anduses: ./foo/bar(#2248)
Changes ⚠️ 🔗
- The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style
uses:clauses, whereas unpinned-images is now responsible fordocker://-styleuses:clauses (in addition to already checking other image references) (#2222)
Removals 🌅🔗
--collect=workflows-onlyand--collect=actions-onlyhave been fully removed. Use--collect=workflowsand--collect=actionsfor the replacement behavior (#2242)
Bug Fixes 🐛🔗
-
Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
-
Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
-
Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)