Skip to content

chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 in the github-actions group - #77

Merged
dkastl merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-25a436db3a
Jul 1, 2026
Merged

chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 in the github-actions group#77
dkastl merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-25a436db3a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 1 update: zizmorcore/zizmor-action.

Updates zizmorcore/zizmor-action from 0.5.6 to 0.5.7

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.7

1.26.1 is now available via the action 1.26.1 is now the default version of zizmor used by the action

Commits
  • 192e21d Sync zizmor versions (#127)
  • 2720f26 Update README.md with new actions/checkout version (#126)
  • 40b41b8 chore(deps): bump the github-actions group with 2 updates (#123)
  • a687b25 chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-ac...
  • 64a6900 add note to explain that the default value for online-checks is different t...
  • 14050ab chore(deps): bump the github-actions group with 2 updates (#118)
  • ee9b419 chore(deps): bump github/codeql-action in the github-actions group (#116)
  • fddf2b4 Bump pins in README (#115)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

  • Chores
    • Updated a pinned security scanning dependency in the release workflow to a newer version.

Bumps the github-actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.5.6 to 0.5.7
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@5f14fd0...192e21d)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 29, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Secret Leak Check

OK No secrets detected in this PR's diff.

@coderabbitai

coderabbitai Bot commented Jun 29, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9969eeff-367a-43f2-a496-2c9acb132d96

📥 Commits

Reviewing files that changed from the base of the PR and between d32aef4 and 0994fd5.

📒 Files selected for processing (1)
  • .github/workflows/reusable-security-suite.yml

Walkthrough

The pinned SHA for the Zizmor GitHub Action in the actions-audit job of reusable-security-suite.yml is updated from the v0.5.6 commit to the v0.5.7 commit. No other workflow logic is changed.

Changes

Zizmor Action Version Bump

Layer / File(s) Summary
Zizmor action SHA bump
.github/workflows/reusable-security-suite.yml
Pinned uses: SHA for the Zizmor action updated from v0.5.6 to v0.5.7 in the actions-audit job.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

  • geolonia/.github#71: Adds the Zizmor action to the same actions-audit job in reusable-security-suite.yml.
  • geolonia/.github#73: Configures the inline Zizmor job in reusable-security-suite.yml that this PR's bump targets.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately names the dependency bump and matches the only code change.
Description check ✅ Passed It includes a clear summary of the version bump and release notes, though it doesn't use the template's headings.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/github_actions/github-actions-25a436db3a

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor

🛡️ Security suite

Check Result
✅ Supply chain · bumblebee No exposure matches
✅ Secrets · betterleaks No secrets in diff
✅ Action pinning · pinact All actions pinned
⚠️ Actions audit · zizmor Findings (warn-only; see annotations)

Warning

Warnings only. These do not block the PR, but please review them.

Updated for 0994fd5 · workflow run

@dkastl
dkastl merged commit 86a251e into main Jul 1, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-25a436db3a branch July 1, 2026 05:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant