chore(deps): update dependency zizmor to v1.28.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
zizmor (source)	1.24.1 → 1.28.0

---

Release Notes

zizmorcore/zizmor (zizmor)

v1.28.0

Compare Source

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#​2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#​2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#​2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps..outcome and steps..conclusion as injection risks in the default persona (#​2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#​2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#​2205)

v1.27.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#​2153)
  Enhancements 🌱🔗

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#​2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#​2180)

Bug Fixes 🐛🔗

• Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#​2157)

• Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#​2177)

• Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#​2185)

v1.26.1

Compare Source

This is a small corrective release for 1.26.0.

v1.26.0

Compare Source

New Features 🌈🔗

• New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#​1985)

  Many thanks to @​andrew for proposing and implementing this improvement!

• New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#​2085)

  Many thanks to @​terror for proposing and implementing this improvement!

• New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#​2061)

  Many thanks to @​connorshea for proposing and implementing this improvement!

Enhancements 🌱🔗

• The cache-poisoning audit now detects additional cache disablement heuristics (#​2053)

• The known-vulnerable-actions audit is now configurable. See the configuration documentation for details (#​2084)

• The excessive-permissions audit is now aware of the code-quality permission (#​2088)

• The unpinned-uses audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @​v6) (#​2127)

Performance Improvements 🚄🔗

• Most online audits are significantly faster, thanks to more precise retry handling (#​2036)
  Bug Fixes 🐛🔗

• Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#​2026)

  Many thanks to @​fionn for implementing this fix!

• Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#​2040)

• Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#​2055)

• Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#​2059, #​2069)

• Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#​2073)

• Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#​2102)

• Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#​2098)

• The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#​1748, #​2095)

Changes ⚠️🔗

• The impostor-commit audit no longer suggests auto-fixes, to avoid incorrectly minimizing the amount of manual remediation work needed (#​2054)

• The JSON and SARIF outputs no longer contain a misleading prefix key (#​2095)

v1.25.2

Compare Source

Bug Fixes 🐛🔗

• Fixed a bug where the unpinned-tools audit would incorrectly flag the aquasecurity/trivy-action action as installing an unpinned tool version, rather than aquasecurity/setup-trivy (#​2018)

v1.25.1

Compare Source

Bug Fixes 🐛🔗

• Fixed a bug where the cache-poisoning audit would fail to consider release events as exempt from cache usage findings when filtered by a tag condition (#​2004)

• Fixed a typo when suggesting --fix flags for findings (#​2010)

  Many thanks to @​0xdea for implementing this fix!

• Fixed a typo in unpinned-tools annotations (#​2008)

  Many thanks to @​martincostello for implementing this fix!

• Fixed a bug where the github-app audit would incorrectly flag some safe uses of actions/create-github-app-token as unsafe (#​2011)

v1.25.0

Compare Source

New Features 🌈🔗

• zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#​1913)

  Many thanks to @​Proximyst for proposing and implementing this improvement!

• New audit: github-app detects dangerous usages of GitHub App installation tokens (#​1926)

• New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#​1820)

• zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#​1935)

• zizmor's LSP now honors the --persona flag on the CLI (#​1943)

• zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#​1965)

Enhancements🔗

• Recommend gh issue edit --add-label / gh pr edit --add-label as a replacement for actions-ecosystem/action-add-labels in superfluous-actions

• Recommend gh issue edit --remove-label / gh pr edit --remove-label as a replacement for actions-ecosystem/action-remove-labels in superfluous-actions

• Recommend jq as a replacement for sergeysova/jq-action in superfluous-actions

• Recommend git add, git commit, and git push as a replacement for stefanzweifel/git-auto-commit-action in superfluous-actions

• Recommend git add, git commit, and git push as a replacement for EndBug/add-and-commit in superfluous-actions

• tibdex/github-app-token is now recognized as an archived action by archived-uses (#​1910)

• The [dangerous-triggers] audit now explicitly exempts workflows that only invoke actions/labeler (#​1956)

• The unpinned-images audit now detects unpinned image references in Docker-based action definitions (#​1965)

• zizmor's SARIF output now provides slightly more detailed finding messages (#​1972)

• The archived-uses audit now detects more archived actions (#​1978)

• deno is now recognized as a package-ecosystem in dependabot.yml (#​1991)

Performance Improvements 🚄🔗

• The impostor-commit audit is now significantly faster (in addition to being more correct) when the user has pinned their action to a tag SHA instead of a commit SHA (#​1998)
  Bug Fixes 🐛🔗

• Fixed a crash in the template-injection audit when a workflow uses a parenthesized compound expression in context position (#​1904)

• Fixed a bug where local directory input collection could miss workflows for relative-path invocations from within .github subdirectories (#​1909)

• Fixed a bug where the unpinned-images audit would miss images defined in container: clauses (#​1944)

• Fixed a bug where inline ignore comments could not be easily applied to superfluous-actions findings (#​1945)

• Fixed a bug where the cache-poisoning audit would fail to detect some release trigger patterns (#​1946)

• Fixed a bug where inline ignore comments could not be easily applied to cache-poisoning findings (#​1962)

• Fixed a class of imprecisions where the cache-poisoning audit would incorrectly flag cache usage that doesn't actually occur on release events (#​1940)

  Many thanks to @​reubenwong97 for implementing this fix!

• Fixed a bug where dependabot.yml files containing a private cargo repository couldn't be parsed (#​1976)

• Fixed a bug where zizmor's input validation warnings lacked a mention of which files failed to validate (#​1980)

• Fixed a bug where the impostor-commit audit would falsely indicate impostor commits if an action was pinned to a tag SHA instead of a commit SHA (#​1998)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.