fix(ci): grant zizmor-sarif the actions: read it declares - #39
Merged
Conversation
The 0.12.0 -> 0.13.3 repin surfaced this: zizmor-sarif reads workflow run metadata from the Actions API and declares actions: read, and a caller cannot grant a reusable more than it declares itself. The caller listed only contents: read and security-events: write, so the run failed at startup before any job began. Signed-off-by: Danil Silantyev <danilsilantyevwork@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fallout from the 0.12.0 → 0.13.3 repin, caught on
mainimmediately after it landed:zizmornow reportsstartup_failurewith no jobs.zizmor-sarif.ymlreads workflow run metadata from the Actions API and declaresactions: read— the catalog lists it underrequired_permissionsalongsidecontents: readandsecurity-events: write. A caller cannot grant a reusable more than the caller itself declares, so the missing scope fails the run at startup, before any job begins, which is why it shows as a startup failure rather than a job failure.github-device-sync's equivalent caller already declared all three; this one did not.This is the same defect class as the
pr-titlepull-requests: readfix in ci-workflows 0.13.3 — a reusable's declared scope has to be mirrored by every caller.