v0.14.0

This release follows more of what CI really runs: pre-commit hooks, Azure pipelines kept outside the root, and the repository's real default branch. It also scans worktrees and submodules, cleans up a cancelled --repo scan, and smooths a set of CLI rough edges.

Sees what is really there

• pre-commit and prek hooks are followed like make, Task and tox (#308).

  • What starts it: a step running pre-commit run or prek run, or using pre-commit/action or j178/prek-action.
  • What it reads: the hooks of .pre-commit-config.yaml. A hook from a hook repository counts as the tool its id names; a local hook is followed through its entry.
  • Which hooks: hook ids on the command line run only those hooks, and stage selection is honoured.
  • Result: pydantic, ruff and home-assistant run zizmor as a hook, and now cover Workflow Security. Of 30 repositories found running pre-commit in CI, 15 gain an enforcing Linter from their ruff, flake8 or mypy hooks.

• Azure Pipelines outside the root are found in eng/pipelines, build/azure-pipelines, .pipelines, ci and similar directories (#309). A file there counts as a pipeline only if it has what only a pipeline may have. Two more things are now read:

  • stages handed to an extends: template in another repository, as 1ES and MicroBuild pipelines do;
  • items inserted by ${{ if }}/${{ else }}/${{ each }}, graded unknown since they depend on a condition.

  dotnet/runtime and microsoft/vscode are now detected as Azure users.

Grading

• The real default branch decides whether a pull_request branch filter gates (#310). It comes from the checkout's origin/HEAD, from GitHub with --repo, or from --required-checks. Where none of those has it, main, master, trunk and develop stand in, as before.
  • A repository whose default branch is develop, with branches: [master], is no longer called gating.
  • intel/llvm, whose default branch is sycl, grades enforcing where it was unknown.

Robustness

• Git worktrees and submodules are scanned (#311). They used to be refused as "not a git repository". --required-checks and the default branch work there too.
• A cancelled --repo scan (SIGINT or SIGTERM, as a cancelled CI job sends) abandons the download and removes its temporary copy, then exits 130 or 143 (#312).
• SARIF results always carry a location (#312). On a repository with no CI file zanadir could read, they point at the README, else the first file; code scanning rejects results without one.

CLI

From #313:

• -o JSON works: the output format is read in any case.
• --repo accepts HTTPS://, git@github.com:owner/name.git and ssh:// addresses, and refuses a/.. and a trailing @.
• --dir may be a symlink, such as /tmp on macOS.
• scan -d . --enforce false is refused (exit 2) instead of ignoring false and enforcing.
• Excluding every category says nothing was scored, instead of "All categories are covered". An excluded category is no longer also listed as not applicable.
• --fail-on X -e X warns that X can never fail.
• --write-baseline without --baseline writes into --dir.
• Markdown reports HTML-escape file names and reasons, so a file name can't put raw HTML in a PR comment.
• A workflow that is valid YAML of the wrong shape is reported as such, not as invalid YAML.
• rules: [null] in the config file is an error, not silently no rules.

Upgrading

• A positional argument to scan or fix is now an error (exit 2). A pipeline passing one by mistake, such as --enforce false, will start to fail. That's intended: it was not doing what it said.
• --write-baseline with no --baseline writes into the scanned directory rather than the current one.
• Verdicts: across 88 repositories, none changed from 0.13.0. The changes reach repositories that use pre-commit, keep Azure pipelines outside the root, or have an unusual default branch.

Full changelog: 0.13.0...0.14.0