Skip to content

Fix zizmor lint #1584

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adamtheturtle merged 2 commits into from
Mar 10, 2026
Merged

Fix zizmor lint #1584

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
54bd468
Fix zizmor lint: upgrade to 1.23.1, disable superfluous-actions and s…
adamtheturtle Mar 10, 2026
1a744c7
Remove secrets-outside-env disable, add environment to jobs that use …
adamtheturtle Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,7 @@ rules:
disable: true
template-injection:
disable: true
superfluous-actions:
disable: true
Copy link

@cursor cursor bot Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing secrets-outside-env disable rule in zizmor config

Medium Severity

The PR description states both superfluous-actions and secrets-outside-env rules need to be disabled to fix lint failures, but only superfluous-actions was added to zizmor.yml. The workflow files (e.g., release.yml, dependabot-merge.yml) pass secrets directly in action with: parameters rather than through env: blocks, so the secrets-outside-env rule will still cause zizmor lint failures. This means the PR's stated goal of fixing lint is only partially achieved.

Fix in Cursor Fix in Web

artipacked:
disable: true