chore(deps): update zizmorcore/zizmor-action action to v0.7.1 #108

Open

renovate Bot wants to merge 1 commits from renovate/zizmorcore-zizmor-action-0.x into master

pull from: renovate/zizmorcore-zizmor-action-0.x

merge into: Lochnair-Labs:master

Lochnair-Labs:master

Lochnair-Labs:renovate/github-codeql-action-digest

Lochnair-Labs:feature/trace-characterization

Lochnair-Labs:feature/trace-v1

Conversation 0 Commits 1 Files Changed 1

+1 -1

renovate Bot commented 2026-10-15 05:07:59 +00:00

Copy link

Copy source

This PR contains the following updates:

Package	Type	Update	Change
zizmorcore/zizmor-action	action	minor	v0.6.4 → v0.7.1

---

Release Notes

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.7.1

Compare Source

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in #​178

Full Changelog: https://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#​2437)

• The self-hosted-runner audit is now significantly more precise (#​2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

• zizmor is now aware of the image_version workflow trigger (#​2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

• The cache-poisoning audit is now aware of pnpm/setup (#​2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes

What's Changed

• Bootstrap zizmor without Docker by @​potiuk in #​169
• Bump sync-zizmor-versions.py to Python 3.11 for locking by @​woodruffw in #​174
• Sync zizmor versions by @​github-actions[bot] in #​175

New Contributors

• @​potiuk made their first contribution in #​169

Full Changelog: https://github.com/zizmorcore/zizmor-action/compare/v0.6.4...v0.7.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | action | minor | `v0.6.4` → `v0.7.1` | --- ### Release Notes <details> <summary>zizmorcore/zizmor-action (zizmorcore/zizmor-action)</summary> ### [`v0.7.1`](https://github.com/zizmorcore/zizmor-action/releases/tag/v0.7.1) [Compare Source](https://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1) ### zizmor changes #### Bug Fixes 🐛🔗 - Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit ### action changes The default version of zizmor is now 1.31.1. #### What's Changed - Sync zizmor versions by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;178](https://github.com/zizmorcore/zizmor-action/pull/178) **Full Changelog**: <https://github.com/zizmorcore/zizmor-action/compare/v0.7.0...v0.7.1> ### [`v0.7.0`](https://github.com/zizmorcore/zizmor-action/releases/tag/v0.7.0) [Compare Source](https://github.com/zizmorcore/zizmor-action/compare/v0.6.4...v0.7.0) [Sponsorship is appreciated!](https://github.com/sponsors/woodruffw/) ### zizmor notes #### Enhancements 🌱[🔗](https://docs.zizmor.sh/release-notes/#enhancements) - The [typosquat-uses](https://docs.zizmor.sh/audits/#typosquat-uses) audit now supports pre-commit config inputs ([#&#8203;2437](https://github.com/zizmorcore/zizmor/issues/2437)) - The [self-hosted-runner](https://docs.zizmor.sh/audits/#self-hosted-runner) audit is now significantly more precise ([#&#8203;2350](https://github.com/zizmorcore/zizmor/issues/2350)) Many thanks to [@&#8203;ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now considers the issue\_comment trigger fundamentally dangerous ([#&#8203;2396](https://github.com/zizmorcore/zizmor/issues/2396)) - zizmor is now aware of the image\_version workflow trigger ([#&#8203;2397](https://github.com/zizmorcore/zizmor/issues/2397)) - The [dangerous-triggers](https://docs.zizmor.sh/audits/#dangerous-triggers) audit now produces more precise finding/diagnostic spans ([#&#8203;2402](https://github.com/zizmorcore/zizmor/issues/2402)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of [pnpm/setup](https://github.com/pnpm/setup) ([#&#8203;2409](https://github.com/zizmorcore/zizmor/issues/2409)) - The [unpinned-images](https://docs.zizmor.sh/audits/#unpinned-images) audit now produces more precise findings when the user's workflow contains an indirect matrix ([#&#8203;2395](https://github.com/zizmorcore/zizmor/issues/2395)) Many thanks to [@&#8203;ubiratansoares](https://github.com/ubiratansoares) for proposing and implementing this enhancement! - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none ([#&#8203;2418](https://github.com/zizmorcore/zizmor/issues/2418)) - The [cache-poisoning](https://docs.zizmor.sh/audits/#cache-poisoning) audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution ([#&#8203;2426](https://github.com/zizmorcore/zizmor/issues/2426)) - zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions ([#&#8203;2444](https://github.com/zizmorcore/zizmor/issues/2444)) #### Bug Fixes 🐛[🔗](https://docs.zizmor.sh/release-notes/#bug-fixes) - Fixed a class of false positives/imprecisions in [adhoc-packages](https://docs.zizmor.sh/audits/#adhoc-packages) that caused some pnpm and yarn invocations to be misclassified as package installations ([#&#8203;2386](https://github.com/zizmorcore/zizmor/issues/2386)) Many thanks to [@&#8203;marcalexiei](https://github.com/marcalexiei) for implementing this improvement! - Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root ([#&#8203;2390](https://github.com/zizmorcore/zizmor/issues/2390)) - Fixed a bug where the [ref-version-mismatch](https://docs.zizmor.sh/audits/#ref-version-mismatch) audit would crash on unusually placed version comments ([#&#8203;2394](https://github.com/zizmorcore/zizmor/issues/2394)) - Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language\_version and default\_language\_version keys ([#&#8203;2413](https://github.com/zizmorcore/zizmor/issues/2413)) - Fixed a bug where the [use-trusted-publishing](https://docs.zizmor.sh/audits/#use-trusted-publishing) audit would fail to detect certain true-positive patterns inside of PowerShell blocks ([#&#8203;2444](https://github.com/zizmorcore/zizmor/issues/2444)) ### action notes #### What's Changed - Bootstrap zizmor without Docker by [@&#8203;potiuk](https://github.com/potiuk) in [#&#8203;169](https://github.com/zizmorcore/zizmor-action/pull/169) - Bump sync-zizmor-versions.py to Python 3.11 for locking by [@&#8203;woodruffw](https://github.com/woodruffw) in [#&#8203;174](https://github.com/zizmorcore/zizmor-action/pull/174) - Sync zizmor versions by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;175](https://github.com/zizmorcore/zizmor-action/pull/175) #### New Contributors - [@&#8203;potiuk](https://github.com/potiuk) made their first contribution in [#&#8203;169](https://github.com/zizmorcore/zizmor-action/pull/169) **Full Changelog**: <https://github.com/zizmorcore/zizmor-action/compare/v0.6.4...v0.7.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OC4xIiwidXBkYXRlZEluVmVyIjoiNDQuNDguMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->

renovate Bot added 1 commit 2026-10-16 00:07:55 +00:00

chore(deps): update zizmorcore/zizmor-action action to v0.7.1 f851972062

renovate Bot force-pushed renovate/zizmorcore-zizmor-action-0.x from 40a78ba1e9 to f851972062 2026-10-16 00:07:55 +00:00 Compare

renovate Bot changed title from chore(deps): update zizmorcore/zizmor-action action to v0.7.0 to chore(deps): update zizmorcore/zizmor-action action to v0.7.1 2026-10-16 00:07:55 +00:00

Some checks are pending

Hide all checks

Build binaries / Build (aarch64-musl) (push) Waiting to run

Details

Build binaries / Build (arm-musleabi) (push) Waiting to run

Details

Build binaries / Build (arm-musleabihf) (push) Blocked by required conditions

Details

Build binaries / Build (armv7-musleabi) (push) Blocked by required conditions

Details

Build binaries / Build (armv7-musleabihf) (push) Blocked by required conditions

Details

Build binaries / Build (i686-musl) (push) Blocked by required conditions

Details

Build binaries / Build (mips-musl) (push) Blocked by required conditions

Details

Build binaries / Build (mips64-muslabi64) (push) Blocked by required conditions

Details

Build binaries / Build (mips64el-muslabi64) (push) Blocked by required conditions

Details

Build binaries / Build (aarch64-musl) (pull_request) Waiting to run

Details

Build binaries / Build (mipsel-musl) (push) Blocked by required conditions

Details

Build binaries / Build (arm-musleabi) (pull_request) Waiting to run

Details

Build binaries / Build (riscv64gc-musl) (push) Blocked by required conditions

Details

Build binaries / Build (arm-musleabihf) (pull_request) Blocked by required conditions

Details

Build binaries / Build (x86_64-musl) (push) Blocked by required conditions

Details

Build binaries / Build (armv7-musleabi) (pull_request) Blocked by required conditions

Details

Build binaries / Build (armv7-musleabihf) (pull_request) Blocked by required conditions

Details

Build binaries / Build (i686-musl) (pull_request) Blocked by required conditions

Details

Build binaries / Build (mips-musl) (pull_request) Blocked by required conditions

Details

Build binaries / Build (mips64-muslabi64) (pull_request) Blocked by required conditions

Details

Build binaries / Build (mips64el-muslabi64) (pull_request) Blocked by required conditions

Details

Build binaries / Build (mipsel-musl) (pull_request) Blocked by required conditions

Details

Build binaries / Build (riscv64gc-musl) (pull_request) Blocked by required conditions

Details

Build binaries / Build (x86_64-musl) (pull_request) Blocked by required conditions

Details

Rust CI / cargo fmt (pull_request) Waiting to run

Details

Rust CI / cargo clippy (pull_request) Waiting to run

Details

Rust CI / cargo check (x86_64-unknown-linux-gnu) (pull_request) Waiting to run

Details

Rust CI / cargo test (x86_64-unknown-linux-gnu) (pull_request) Waiting to run

Details

Rust CI / cargo check (x86_64-unknown-linux-musl) (pull_request) Waiting to run

Details

Rust CI / cargo test (x86_64-unknown-linux-musl) (pull_request) Waiting to run

Details

Rust CI / cargo doc (pull_request) Waiting to run

Details

Supply chain / cargo-deny advisories (pull_request) Waiting to run

Details

Supply chain / cargo-deny bans licenses sources (pull_request) Waiting to run

Details

Supply chain / actionlint (pull_request) Waiting to run

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/zizmorcore-zizmor-action-0.x:renovate/zizmorcore-zizmor-action-0.x

git checkout renovate/zizmorcore-zizmor-action-0.x

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

codex

dependencies

Pull requests that update a dependency file

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

question

Further information is requested

rust

Pull requests that update rust code

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Lochnair renovate (Renovate Bot) Bot

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Lochnair-Labs/sqm-autorate-rust#108