New Features 🌈🔗
-
New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)
Enhancements 🌱🔗 -
The impostor-commit audit now supports pre-commit config inputs (#2256)
-
The forbidden-uses audit now supports pre-commit config inputs (#2263)
-
The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add
Many thanks to @connorshea for proposing and implementing this enhancement!
-
The archived-uses audit now supports pre-commit config inputs (#2272)
-
The ref-confusion audit now supports pre-commit config inputs (#2274)
-
The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)
-
The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)
-
zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)
Many thanks to @njgudman for proposing and implementing this enhancement!
-
The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)
-
The unpinned-tools audit now detects usages of extractions/setup-just (#2339)
-
The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)
-
The archived-uses audit now detects several more archived repositories (#2340)
-
The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)
-
The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)
Bug Fixes 🐛🔗
-
Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)
-
Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)
-
Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#2300)
-
Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#2308)
-
Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#2295)
Many thanks to @dmbuil for proposing and implementing this improvement!
-
Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#2330)
-
Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#2337)
-
Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#2339)
-
Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#2247)
Many thanks to @potiuk for proposing and implementing this improvement!
-
Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#2349)