fix: remediate latest zizmor findings, fix supplying zizmor config #1101
+76
−31
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
iainlane
force-pushed
the
iainlane/zizmor-fix
branch
from
2a09e35 to
31b616f
Compare
The current version of Zizmor finds some potential template injection issues. We can fix these by indirecting via the `env`, or in a couple of cases by adding ignore comments where we can't really fix the issue. Something happened to break our config discovery. What we do is download a default config file from this repo, write it to a temporary file, set that file's path as `ZIZMOR_CONFIG`, and then pass this as `--config` if it's set. Possibly as the result of a version bump, Zizmor started handling `ZIZMOR_CONFIG` differently. An empty string here is treated as a file to search for, which doesn't work, and so we get errors. A fix for this last one is to use a different variable name that doesn't collide with the one Zizmor itself is using. Rename to `ZIZMOR_CONFIG_PATH` accordingly.
iainlane
force-pushed
the
iainlane/zizmor-fix
branch
from
31b616f to
0100804
Compare
iainlane
changed the title
zerok
approved these changes
Jul 4, 2025
This was referenced Jul 4, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The current version of Zizmor finds some potential template injection issues. We can fix these by indirecting via the
env, or in a couple of cases by adding ignore comments where we can't really fix the issue.Something happened to break our config discovery. What we do is download a default config file from this repo, write it to a temporary file, set that file's path as
ZIZMOR_CONFIG, and then pass this as--configif it's set. Possibly as the result of a version bump, Zizmor started handlingZIZMOR_CONFIGdifferently. An empty string here is treated as a file to search for, which doesn't work, and so we get errors.A fix for this last one is to use a different variable name that doesn't collide with the one Zizmor itself is using. Rename to
ZIZMOR_CONFIG_PATHaccordingly.I've sent a fix for the issue upstream too: zizmorcore/zizmor#1010