From a09cfbb469ad18c3cbad94240c16141b5089c9a7 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Mon, 19 Oct 2026 23:46:03 +0100 Subject: [PATCH 1/7] sec(ci): pass ci.yml run-block values through env (#155) Moves the five remaining ${{ }} interpolations out of ci.yml run: blocks: github.sha in the image scan step goes through a step-level IMAGE env (same name #1139 uses for that image ref), and matrix.cloud in terraform-validate goes through a job-level CLOUD env, now quoted at each use. No other change to the steps. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b885e287e..ae8b29f15 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -563,7 +563,9 @@ jobs: run: bash scripts/test-govulncheck-retry.sh - name: Scan the shipped image for Go advisories - run: bash scripts/scan-shipped-image.sh cudly:${{ github.sha }} + env: + IMAGE: cudly:${{ github.sha }} + run: bash scripts/scan-shipped-image.sh "$IMAGE" # Terraform validation for all environments terraform-validate: @@ -571,6 +573,8 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + env: + CLOUD: ${{ matrix.cloud }} strategy: matrix: cloud: [aws, gcp, azure] @@ -628,7 +632,7 @@ jobs: # Skips a cloud until it has a tests dir. The lock file is gitignored, # so no -lockfile=readonly. run: | - d=terraform/environments/${{ matrix.cloud }}/ci-cd-permissions + d="terraform/environments/$CLOUD/ci-cd-permissions" if [ -d "$d/tests" ]; then terraform -chdir="$d" init -backend=false -input=false terraform -chdir="$d" test @@ -636,17 +640,17 @@ jobs: - name: Terraform Init run: | - cd terraform/environments/${{ matrix.cloud }} + cd "terraform/environments/$CLOUD" terraform init -backend=false - name: Terraform Validate run: | - cd terraform/environments/${{ matrix.cloud }} + cd "terraform/environments/$CLOUD" terraform validate - name: Validate environment tfvars files run: | - cd terraform/environments/${{ matrix.cloud }} + cd "terraform/environments/$CLOUD" for env in dev staging prod; do # Check local tfvars if present if [ -f "${env}.tfvars" ]; then From 6868363fba1b025160508248cf362cb565042ae0 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Mon, 19 Oct 2026 23:46:03 +0100 Subject: [PATCH 2/7] sec(ci): pass deploy-all.yml run-block values through env (#155) Moves the 25 remaining ${{ }} interpolations (inputs.deploy_to, step outputs, needs.*.outputs and needs.*.result) out of deploy-all.yml run: blocks into step-level env for determine-deployment and a job-level env for notify, referenced quoted. Each env entry keeps the original expression verbatim, including the `|| 'all'` fallback. No logic change. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy-all.yml | 72 +++++++++++++++++++++----------- 1 file changed, 47 insertions(+), 25 deletions(-) diff --git a/.github/workflows/deploy-all.yml b/.github/workflows/deploy-all.yml index c89d51d69..f617cebd3 100644 --- a/.github/workflows/deploy-all.yml +++ b/.github/workflows/deploy-all.yml @@ -110,8 +110,10 @@ jobs: - name: Set cloud providers id: set-clouds + env: + DEPLOY_TO_INPUT: ${{ inputs.deploy_to || 'all' }} run: | - DEPLOY_TO="${{ inputs.deploy_to || 'all' }}" + DEPLOY_TO="$DEPLOY_TO_INPUT" # AWS Lambda if [[ "$DEPLOY_TO" == "all" ]] || \ @@ -147,18 +149,25 @@ jobs: fi - name: Display deployment plan + env: + ENVIRONMENT: ${{ steps.set-env.outputs.environment }} + DEPLOY_TO: ${{ inputs.deploy_to || 'all' }} + DEPLOY_AWS_LAMBDA: ${{ steps.set-clouds.outputs.deploy-aws-lambda }} + DEPLOY_AWS_FARGATE: ${{ steps.set-clouds.outputs.deploy-aws-fargate }} + DEPLOY_GCP: ${{ steps.set-clouds.outputs.deploy-gcp }} + DEPLOY_AZURE: ${{ steps.set-clouds.outputs.deploy-azure }} run: | { echo "## Deployment Plan" echo "" - echo "**Environment:** ${{ steps.set-env.outputs.environment }}" - echo "**Deploy Strategy:** ${{ inputs.deploy_to || 'all' }}" + echo "**Environment:** $ENVIRONMENT" + echo "**Deploy Strategy:** $DEPLOY_TO" echo "" echo "### Clouds" - echo "- AWS Lambda: ${{ steps.set-clouds.outputs.deploy-aws-lambda }}" - echo "- AWS Fargate: ${{ steps.set-clouds.outputs.deploy-aws-fargate }}" - echo "- GCP Cloud Run: ${{ steps.set-clouds.outputs.deploy-gcp }}" - echo "- Azure Container Apps: ${{ steps.set-clouds.outputs.deploy-azure }}" + echo "- AWS Lambda: $DEPLOY_AWS_LAMBDA" + echo "- AWS Fargate: $DEPLOY_AWS_FARGATE" + echo "- GCP Cloud Run: $DEPLOY_GCP" + echo "- Azure Container Apps: $DEPLOY_AZURE" } >> "$GITHUB_STEP_SUMMARY" # Deploy to AWS Lambda @@ -252,6 +261,19 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + # DEPLOY_ is determine-deployment's true/false selection output; + # DEPLOY__RESULT is the deploy- job's result. + env: + ENVIRONMENT: ${{ needs.determine-deployment.outputs.environment }} + DETERMINE_DEPLOYMENT_RESULT: ${{ needs.determine-deployment.result }} + DEPLOY_AWS_LAMBDA: ${{ needs.determine-deployment.outputs.deploy-aws-lambda }} + DEPLOY_AWS_LAMBDA_RESULT: ${{ needs.deploy-aws-lambda.result }} + DEPLOY_AWS_FARGATE: ${{ needs.determine-deployment.outputs.deploy-aws-fargate }} + DEPLOY_AWS_FARGATE_RESULT: ${{ needs.deploy-aws-fargate.result }} + DEPLOY_GCP: ${{ needs.determine-deployment.outputs.deploy-gcp }} + DEPLOY_GCP_RESULT: ${{ needs.deploy-gcp.result }} + DEPLOY_AZURE: ${{ needs.determine-deployment.outputs.deploy-azure }} + DEPLOY_AZURE_RESULT: ${{ needs.deploy-azure.result }} steps: - name: Aggregate results @@ -259,7 +281,7 @@ jobs: { echo "## Multi-Cloud Deployment Results" echo "" - echo "**Environment:** ${{ needs.determine-deployment.outputs.environment }}" + echo "**Environment:** $ENVIRONMENT" echo "**Timestamp:** $(date -u +%Y-%m-%dT%H:%M:%SZ)" echo "" @@ -267,44 +289,44 @@ jobs: echo "" # AWS Lambda - if [[ "${{ needs.determine-deployment.outputs.deploy-aws-lambda }}" == "true" ]]; then - if [[ "${{ needs.deploy-aws-lambda.result }}" == "success" ]]; then + if [[ "$DEPLOY_AWS_LAMBDA" == "true" ]]; then + if [[ "$DEPLOY_AWS_LAMBDA_RESULT" == "success" ]]; then echo "- ✅ AWS Lambda: Success" else - echo "- ❌ AWS Lambda: ${{ needs.deploy-aws-lambda.result }}" + echo "- ❌ AWS Lambda: $DEPLOY_AWS_LAMBDA_RESULT" fi else echo "- ⏭️ AWS Lambda: Skipped" fi # AWS Fargate - if [[ "${{ needs.determine-deployment.outputs.deploy-aws-fargate }}" == "true" ]]; then - if [[ "${{ needs.deploy-aws-fargate.result }}" == "success" ]]; then + if [[ "$DEPLOY_AWS_FARGATE" == "true" ]]; then + if [[ "$DEPLOY_AWS_FARGATE_RESULT" == "success" ]]; then echo "- ✅ AWS Fargate: Success" else - echo "- ❌ AWS Fargate: ${{ needs.deploy-aws-fargate.result }}" + echo "- ❌ AWS Fargate: $DEPLOY_AWS_FARGATE_RESULT" fi else echo "- ⏭️ AWS Fargate: Skipped" fi # GCP - if [[ "${{ needs.determine-deployment.outputs.deploy-gcp }}" == "true" ]]; then - if [[ "${{ needs.deploy-gcp.result }}" == "success" ]]; then + if [[ "$DEPLOY_GCP" == "true" ]]; then + if [[ "$DEPLOY_GCP_RESULT" == "success" ]]; then echo "- ✅ GCP Cloud Run: Success" else - echo "- ❌ GCP Cloud Run: ${{ needs.deploy-gcp.result }}" + echo "- ❌ GCP Cloud Run: $DEPLOY_GCP_RESULT" fi else echo "- ⏭️ GCP Cloud Run: Skipped" fi # Azure - if [[ "${{ needs.determine-deployment.outputs.deploy-azure }}" == "true" ]]; then - if [[ "${{ needs.deploy-azure.result }}" == "success" ]]; then + if [[ "$DEPLOY_AZURE" == "true" ]]; then + if [[ "$DEPLOY_AZURE_RESULT" == "success" ]]; then echo "- ✅ Azure Container Apps: Success" else - echo "- ❌ Azure Container Apps: ${{ needs.deploy-azure.result }}" + echo "- ❌ Azure Container Apps: $DEPLOY_AZURE_RESULT" fi else echo "- ⏭️ Azure Container Apps: Skipped" @@ -329,11 +351,11 @@ jobs: # four per-cloud `summary` jobs allowlist on `== "success"` instead, # so an unenumerated result falls to their failure branch and errs # safe. This denylist is the outlier, not the pattern. - if [[ "${{ needs.determine-deployment.result }}" != "success" ]] || \ - [[ "${{ needs.deploy-aws-lambda.result }}" == "failure" ]] || \ - [[ "${{ needs.deploy-aws-fargate.result }}" == "failure" ]] || \ - [[ "${{ needs.deploy-gcp.result }}" == "failure" ]] || \ - [[ "${{ needs.deploy-azure.result }}" == "failure" ]]; then + if [[ "$DETERMINE_DEPLOYMENT_RESULT" != "success" ]] || \ + [[ "$DEPLOY_AWS_LAMBDA_RESULT" == "failure" ]] || \ + [[ "$DEPLOY_AWS_FARGATE_RESULT" == "failure" ]] || \ + [[ "$DEPLOY_GCP_RESULT" == "failure" ]] || \ + [[ "$DEPLOY_AZURE_RESULT" == "failure" ]]; then FAILED=true fi From d72a9e09bbbfc1a926ad515007f95473db800f93 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Mon, 19 Oct 2026 23:46:03 +0100 Subject: [PATCH 3/7] sec(ci): pass deploy-aws-fargate.yml run-block values through env (#155) Moves the six remaining ${{ }} interpolations (github.sha in Set image tag, and the prepare output and needs.*.result values in Post summary) into step-level env, referenced quoted. No logic change. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy-aws-fargate.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/deploy-aws-fargate.yml b/.github/workflows/deploy-aws-fargate.yml index 86a2c6b65..9584784a5 100644 --- a/.github/workflows/deploy-aws-fargate.yml +++ b/.github/workflows/deploy-aws-fargate.yml @@ -112,8 +112,10 @@ jobs: - name: Set image tag id: set-tag + env: + IMAGE_TAG: ${{ github.sha }} run: | - echo "tag=${{ github.sha }}" >> "$GITHUB_OUTPUT" + echo "tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT" # Deploy with Terraform deploy: @@ -349,12 +351,16 @@ jobs: continue-on-error: true - name: Post summary + env: + TARGET_ENVIRONMENT: ${{ needs.prepare.outputs.target_environment }} + DEPLOY_RESULT: ${{ needs.deploy.result }} + TEST_RESULT: ${{ needs.test-deployment.result }} run: | { echo "## AWS Fargate Deployment Summary" echo "" - echo "**Environment:** ${{ needs.prepare.outputs.target_environment }}" - echo "**Deploy Status:** ${{ needs.deploy.result }}" + echo "**Environment:** $TARGET_ENVIRONMENT" + echo "**Deploy Status:** $DEPLOY_RESULT" echo "" if [ -f deployment-info.json ]; then @@ -366,10 +372,10 @@ jobs: echo "" echo "### Job Results" - echo "- Deploy: ${{ needs.deploy.result }}" - echo "- Test: ${{ needs.test-deployment.result }}" + echo "- Deploy: $DEPLOY_RESULT" + echo "- Test: $TEST_RESULT" - if [ "${{ needs.deploy.result }}" == "success" ] && [ "${{ needs.test-deployment.result }}" == "success" ]; then + if [ "$DEPLOY_RESULT" == "success" ] && [ "$TEST_RESULT" == "success" ]; then echo "" echo "**Deployment successful!**" else From 837adee691f25fbaa90ba6c4415b5e37782e345d Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Mon, 19 Oct 2026 23:46:03 +0100 Subject: [PATCH 4/7] sec(ci): pass deploy-azure.yml run-block values through env (#155) Moves the eleven remaining ${{ }} interpolation lines out of deploy-azure.yml run: blocks. needs.* values go through step-level env; ${{ env.AZURE_LOCATION }} becomes ${AZURE_LOCATION}, the workflow-level env var the runner already exports to every step. The existing `ENVIRONMENT=` and `APP_URL=` shell assignments are kept, reading from the new env vars, so the rest of each script is untouched. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy-azure.yml | 33 ++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/.github/workflows/deploy-azure.yml b/.github/workflows/deploy-azure.yml index f3d480f5a..e3f4bea0c 100644 --- a/.github/workflows/deploy-azure.yml +++ b/.github/workflows/deploy-azure.yml @@ -213,6 +213,7 @@ jobs: env: TF_VAR_admin_email: ${{ secrets.ADMIN_EMAIL }} TF_VAR_subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + TARGET_ENVIRONMENT: ${{ needs.prepare.outputs.target_environment }} run: | # pipefail for the same reason as the apply step below: the default # shell is `bash -e`, where a pipeline takes tee's exit status and a @@ -220,14 +221,16 @@ jobs: set -o pipefail cd terraform/environments/azure terraform plan \ - -var-file="github-${{ needs.prepare.outputs.target_environment }}.tfvars" \ - -var="location=${{ env.AZURE_LOCATION }}" \ + -var-file="github-${TARGET_ENVIRONMENT}.tfvars" \ + -var="location=${AZURE_LOCATION}" \ -out=tfplan 2>&1 | tee "${RUNNER_TEMP}/tf-plan.log" - name: Wait for resource group deletion to complete + env: + TARGET_ENVIRONMENT: ${{ needs.prepare.outputs.target_environment }} run: | - ENVIRONMENT="${{ needs.prepare.outputs.target_environment }}" + ENVIRONMENT="$TARGET_ENVIRONMENT" RG_NAME="cudly-${ENVIRONMENT}-rg" echo "Checking resource group ${RG_NAME} state..." for i in $(seq 1 30); do @@ -246,8 +249,10 @@ jobs: done - name: Remove orphaned or soft-deleted Key Vault + env: + TARGET_ENVIRONMENT: ${{ needs.prepare.outputs.target_environment }} run: | - ENVIRONMENT="${{ needs.prepare.outputs.target_environment }}" + ENVIRONMENT="$TARGET_ENVIRONMENT" KV_NAME="cudly-${ENVIRONMENT}-kv" # If the KV exists in Azure but not in Terraform state (orphaned from a failed run), # delete it so Terraform can re-create it cleanly @@ -261,7 +266,7 @@ jobs: DELETED=$(az keyvault list-deleted --query "[?name=='${KV_NAME}'].name" -o tsv 2>/dev/null || echo "") if [ -n "$DELETED" ]; then echo "Purging soft-deleted Key Vault ${KV_NAME}..." - az keyvault purge --name "${KV_NAME}" --location "${{ env.AZURE_LOCATION }}" 2>/dev/null \ + az keyvault purge --name "${KV_NAME}" --location "${AZURE_LOCATION}" 2>/dev/null \ && echo "Purged" || echo "Purge failed (continuing)" fi @@ -416,8 +421,10 @@ jobs: - name: Get Container App URL id: get-url + env: + DEPLOY_APP_URL: ${{ needs.build-and-deploy.outputs.app_url }} run: | - APP_URL="${{ needs.build-and-deploy.outputs.app_url }}" + APP_URL="$DEPLOY_APP_URL" if [ -z "$APP_URL" ]; then echo "Failed to get app URL from deploy outputs" exit 1 @@ -499,12 +506,16 @@ jobs: continue-on-error: true - name: Post summary + env: + TARGET_ENVIRONMENT: ${{ needs.prepare.outputs.target_environment }} + DEPLOY_RESULT: ${{ needs.build-and-deploy.result }} + TEST_RESULT: ${{ needs.test-deployment.result }} run: | { echo "## Azure Container Apps Deployment Summary" echo "" - echo "**Environment:** ${{ needs.prepare.outputs.target_environment }}" - echo "**Location:** ${{ env.AZURE_LOCATION }}" + echo "**Environment:** $TARGET_ENVIRONMENT" + echo "**Location:** $AZURE_LOCATION" echo "" if [ -f deployment-info.json ]; then @@ -516,10 +527,10 @@ jobs: echo "" echo "### Job Results" - echo "- Deploy: ${{ needs.build-and-deploy.result }}" - echo "- Test: ${{ needs.test-deployment.result }}" + echo "- Deploy: $DEPLOY_RESULT" + echo "- Test: $TEST_RESULT" - if [ "${{ needs.build-and-deploy.result }}" == "success" ] && [ "${{ needs.test-deployment.result }}" == "success" ]; then + if [ "$DEPLOY_RESULT" == "success" ] && [ "$TEST_RESULT" == "success" ]; then echo "" echo "✅ **Deployment successful!**" else From 4683e26f6b5341ce1824e969904172225dacf2a1 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Mon, 19 Oct 2026 23:46:03 +0100 Subject: [PATCH 5/7] sec(ci): pass deploy-gcp.yml run-block values through env (#155) Moves the eight remaining ${{ }} interpolation lines out of deploy-gcp.yml run: blocks. needs.* and vars.GCP_PROJECT_ID go through step-level env; ${{ env.GCP_REGION }} becomes $GCP_REGION, the workflow-level env var the runner already exports. The SERVICE_URL= assignment is kept, reading from the new env var. Closes #155 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy-gcp.yml | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/.github/workflows/deploy-gcp.yml b/.github/workflows/deploy-gcp.yml index 8a29f9d90..6e8bb26d3 100644 --- a/.github/workflows/deploy-gcp.yml +++ b/.github/workflows/deploy-gcp.yml @@ -190,12 +190,14 @@ jobs: - name: Terraform Plan env: + TARGET_ENVIRONMENT: ${{ needs.prepare.outputs.target_environment }} + GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }} TF_VAR_admin_email: ${{ secrets.ADMIN_EMAIL }} run: | cd terraform/environments/gcp terraform plan \ - -var-file="github-${{ needs.prepare.outputs.target_environment }}.tfvars" \ - -var="project_id=${{ vars.GCP_PROJECT_ID }}" \ + -var-file="github-${TARGET_ENVIRONMENT}.tfvars" \ + -var="project_id=${GCP_PROJECT_ID}" \ -out=tfplan - name: Terraform Apply @@ -258,8 +260,10 @@ jobs: steps: - name: Get Service URL id: get-url + env: + DEPLOY_SERVICE_URL: ${{ needs.build-and-deploy.outputs.service_url }} run: | - SERVICE_URL="${{ needs.build-and-deploy.outputs.service_url }}" + SERVICE_URL="$DEPLOY_SERVICE_URL" if [ -z "$SERVICE_URL" ]; then echo "Failed to get service URL from deploy outputs" exit 1 @@ -323,12 +327,16 @@ jobs: continue-on-error: true - name: Post summary + env: + TARGET_ENVIRONMENT: ${{ needs.prepare.outputs.target_environment }} + DEPLOY_RESULT: ${{ needs.build-and-deploy.result }} + TEST_RESULT: ${{ needs.test-deployment.result }} run: | { echo "## GCP Cloud Run Deployment Summary" echo "" - echo "**Environment:** ${{ needs.prepare.outputs.target_environment }}" - echo "**Region:** ${{ env.GCP_REGION }}" + echo "**Environment:** $TARGET_ENVIRONMENT" + echo "**Region:** $GCP_REGION" echo "" if [ -f deployment-info.json ]; then @@ -340,10 +348,10 @@ jobs: echo "" echo "### Job Results" - echo "- Deploy: ${{ needs.build-and-deploy.result }}" - echo "- Test: ${{ needs.test-deployment.result }}" + echo "- Deploy: $DEPLOY_RESULT" + echo "- Test: $TEST_RESULT" - if [ "${{ needs.build-and-deploy.result }}" == "success" ] && [ "${{ needs.test-deployment.result }}" == "success" ]; then + if [ "$DEPLOY_RESULT" == "success" ] && [ "$TEST_RESULT" == "success" ]; then echo "" echo "✅ **Deployment successful!**" else From 0d7c77f67cb48b6a27793f6f1bfdd568dbeaca9e Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Mon, 19 Oct 2026 23:47:33 +0100 Subject: [PATCH 6/7] docs(ci): update the zizmor below-threshold count in ci.yml (#155) The workflow-lint comment cited 106 findings including 66 template-injection. With the run-block sweep done, pedantic zizmor reports 35 low findings and no template-injection. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ae8b29f15..ad77c3e71 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -237,11 +237,10 @@ jobs: # file, no per-finding ignore, no only-new-issues. Every medium and # high finding the pedantic persona surfaces fails this job, and the # injection class this job exists to catch scores high. Below the line - # sit 106 findings, none above low: 66 template-injection on values - # #1649 already assessed as non-injectable (github.actor, github.sha - # and similar), plus undocumented-permissions, concurrency-limits and - # anonymous-definition. Clearing those means rewriting the deploy - # workflows, so they are left to a follow-up rather than silenced here. + # sit 35 findings, none above low: undocumented-permissions and + # concurrency-limits. template-injection is at zero since #155 moved + # every expression out of run: blocks into env:. The rest are left to + # a follow-up rather than silenced here. run: | set -euo pipefail # `pipx run --spec` rather than `pipx install`: it pins the version in From 76ba95fe8d98a242311aa836e6d08707eb23be13 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Wed, 21 Oct 2026 08:56:34 +0100 Subject: [PATCH 7/7] docs(ci): name the zizmor version behind the below-threshold count (#155) The pinned zizmor 1.29.0 reports 35 low findings. zizmor 1.31 adds a self-repository audit with 4 more on deploy-all.yml's local reusable-workflow calls, which the comment did not mention. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fa0dc1776..abbb137b9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -237,10 +237,12 @@ jobs: # file, no per-finding ignore, no only-new-issues. Every medium and # high finding the pedantic persona surfaces fails this job, and the # injection class this job exists to catch scores high. Below the line - # sit 35 findings, none above low: undocumented-permissions and - # concurrency-limits. template-injection is at zero since #155 moved - # every expression out of run: blocks into env:. The rest are left to - # a follow-up rather than silenced here. + # sit 35 findings with the pinned zizmor, none above low: 24 + # undocumented-permissions and 11 concurrency-limits. zizmor 1.31 adds + # a self-repository audit, which reports 4 more low findings on the + # local reusable-workflow calls in deploy-all.yml. template-injection + # is at zero since #155 moved every expression out of run: blocks into + # env:. The rest are left to a follow-up rather than silenced here. run: | set -euo pipefail # `pipx run --spec` rather than `pipx install`: it pins the version in