Update github-actions

[gardener-ci-robot]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/zizmorcore/zizmor	uses-with	minor	v1.24.1 → 1.25.2
zizmorcore/zizmor-action	action	patch	v0.5.3 → v0.5.6

---

Release Notes

zizmorcore/zizmor (ghcr.io/zizmorcore/zizmor)

v1.25.2

Compare Source

Bug Fixes 🐛🔗

• Fixed a bug where the unpinned-tools audit would incorrectly flag the aquasecurity/trivy-action action as installing an unpinned tool version, rather than aquasecurity/setup-trivy (#​2018)

v1.25.0

Compare Source

New Features 🌈🔗

• zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#​1913)

  Many thanks to @​Proximyst for proposing and implementing this improvement!

• New audit: github-app detects dangerous usages of GitHub App installation tokens (#​1926)

• New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#​1820)

• zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#​1935)

• zizmor's LSP now honors the --persona flag on the CLI (#​1943)

• zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#​1965)

Enhancements🔗

• Recommend gh issue edit --add-label / gh pr edit --add-label as a replacement for actions-ecosystem/action-add-labels in superfluous-actions

• Recommend gh issue edit --remove-label / gh pr edit --remove-label as a replacement for actions-ecosystem/action-remove-labels in superfluous-actions

• Recommend jq as a replacement for sergeysova/jq-action in superfluous-actions

• Recommend git add, git commit, and git push as a replacement for stefanzweifel/git-auto-commit-action in superfluous-actions

• Recommend git add, git commit, and git push as a replacement for EndBug/add-and-commit in superfluous-actions

• tibdex/github-app-token is now recognized as an archived action by archived-uses (#​1910)

• The [dangerous-triggers] audit now explicitly exempts workflows that only invoke actions/labeler (#​1956)

• The unpinned-images audit now detects unpinned image references in Docker-based action definitions (#​1965)

• zizmor's SARIF output now provides slightly more detailed finding messages (#​1972)

• The archived-uses audit now detects more archived actions (#​1978)

• deno is now recognized as a package-ecosystem in dependabot.yml (#​1991)

Performance Improvements 🚄🔗

• The impostor-commit audit is now significantly faster (in addition to being more correct) when the user has pinned their action to a tag SHA instead of a commit SHA (#​1998)
  Bug Fixes 🐛🔗

• Fixed a crash in the template-injection audit when a workflow uses a parenthesized compound expression in context position (#​1904)

• Fixed a bug where local directory input collection could miss workflows for relative-path invocations from within .github subdirectories (#​1909)

• Fixed a bug where the unpinned-images audit would miss images defined in container: clauses (#​1944)

• Fixed a bug where inline ignore comments could not be easily applied to superfluous-actions findings (#​1945)

• Fixed a bug where the cache-poisoning audit would fail to detect some release trigger patterns (#​1946)

• Fixed a bug where inline ignore comments could not be easily applied to cache-poisoning findings (#​1962)

• Fixed a class of imprecisions where the cache-poisoning audit would incorrectly flag cache usage that doesn't actually occur on release events (#​1940)

  Many thanks to @​reubenwong97 for implementing this fix!

• Fixed a bug where dependabot.yml files containing a private cargo repository couldn't be parsed (#​1976)

• Fixed a bug where zizmor's input validation warnings lacked a mention of which files failed to validate (#​1980)

• Fixed a bug where the impostor-commit audit would falsely indicate impostor commits if an action was pinned to a tag SHA instead of a commit SHA (#​1998)

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.5.6

Compare Source

• 1.25.2 is now available via the action
• 1.25.2 is now the default version of zizmor used by the action

v0.5.5

Compare Source

This is a no-op release.

v0.5.4

Compare Source

• 1.25.0 is now available via the action
• 1.25.0 is now the default version of zizmor used by the action

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[coderabbitai]

Warning

Rate limit exceeded

@gardener-ci-robot has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 18 minutes and 5 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64960583-6a36-4d77-b093-bfd10ebf2aab

📥 Commits

Reviewing files that changed from the base of the PR and between a2d202f and 1074d98.

📒 Files selected for processing (1)

• .github/workflows/zizmor.yaml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/github-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[petersutter]

/lgtm
/approve

[gardener-prow]

LGTM label has been added.

Details

Git tree hash: e97efe8914983b8bc332dfc17b8f9872c3a4128f

[gardener-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: petersutter

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [petersutter]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment