Hi, I'm an Argo CD maintainer.
This is an example of a PR that upgrades gh aw cli and commits the additional workflows created:
argoproj/argo-cd#28940
See the attached Zizmor findings.
I've opened an issue previously with other Zizmor findings, that may have been addressed by now:
#48565
but looks like Zizmor was only run once for that particular issue.
I believe that for a project like gh-aw, which is heavily based on auto-generating GitHub workflows, Zizmor should be run as part of it's CI.
Otherwise gh aw cli upgrades become blocked for projects that use Zizmor on their CI. I wouldn't wanna have Zizmor fully ignore the gh-aw auto-generated workflows.
Hi, I'm an Argo CD maintainer.
This is an example of a PR that upgrades gh aw cli and commits the additional workflows created:
argoproj/argo-cd#28940
See the attached Zizmor findings.
I've opened an issue previously with other Zizmor findings, that may have been addressed by now:
#48565
but looks like Zizmor was only run once for that particular issue.
I believe that for a project like gh-aw, which is heavily based on auto-generating GitHub workflows, Zizmor should be run as part of it's CI.
Otherwise gh aw cli upgrades become blocked for projects that use Zizmor on their CI. I wouldn't wanna have Zizmor fully ignore the gh-aw auto-generated workflows.