feat: zizmor severity breakdown in the suite summary (errors/warnings/notices) - #85
Merged
Merged
Conversation
Replace the min-severity:high boolean pass with a SARIF count pass (pipx-pinned zizmor 1.26.1, matching the action's pinned version + the same auto-discovered zizmor.yml), counting all three annotation levels. The report row now shows e.g. '6 error(s), 8 warning(s), 8 notice(s)'; errors still escalate the callout to CAUTION. Part of geolonia-operations#196/#200.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe reusable security suite workflow's zizmor actions audit was changed from a two-pass boolean has-errors approach to a SARIF-based counting approach. A new counting step pins zizmor to version 1.26.1, generates SARIF output, and computes error/warning/notice counts via jq, replacing the prior high-severity pass output. The report job's comment logic was rewritten to consume these three counts instead of the boolean. ChangesZizmor Severity Counting Rework
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ActionsAudit as actions-audit job
participant Zizmor as zizmor CLI
participant Report as report job
ActionsAudit->>Zizmor: run pinned v1.26.1 to generate SARIF
Zizmor-->>ActionsAudit: SARIF results
ActionsAudit->>ActionsAudit: jq counts errors/warnings/notices
ActionsAudit-->>Report: outputs errors, warnings, notices
Report->>Report: select glyph/severity/message from counts
Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
🛡️ Security suite
Caution zizmor found error-severity issues. They are warn-only (they do not block this PR), but please address them. Updated for |
dkastl
marked this pull request as ready for review
July 1, 2026 13:25
dkastl
added a commit
that referenced
this pull request
Jul 6, 2026
… [2/2] (#90) Part 2 of 2. reusable-security-suite@v1.30.0 (76db4b3) has SHA-pinned scanner refs (#89), so pointing security-suite.yml's REF2 at it makes the ENTIRE required-workflow reusable tree immutable. This is the topology the ruleset 'require workflows' injector needs; identical shape to the last-known-working v1.25.0 but with the #85 severity breakdown + #87 hardening. After release v1.31.0 and @v1 advancing, re-trigger a consumer PR to confirm the Security Suite check runs again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The summary row now shows the full zizmor breakdown, e.g.
6 error(s), 8 warning(s), 8 notice(s), instead of just the error/warning distinction. A SARIF count pass (pipx zizmor pinned to 1.26.1, matching the action's now-pinned version + the same auto-discovered zizmor.yml) counts all three annotation levels in-job; errors still escalate the callout to [!CAUTION]. Keeps the SHA-pinned action for the inline annotations. After release: chain-bump the callers. Part of geolonia-operations#196 / #200.Summary by CodeRabbit