[BUG]: ref-version-mismatch FP, when the comment contains zizmor ignore directive

Pre-submission checks

I am not filing a feature request. These should be filed via the feature request form instead.
I have checked the Troubleshooting Guide for my problem.
I have looked through both the open and closed issues for a duplicate report.
I affirm that I have followed the AI policy and that this report constitutes my own words and understanding.

zizmor version

1.26.1

Expected behavior

I expected, that zizmor does not flag ref-version-mismatch, when the comment is exactly
# zizmor: ignore[cache-poisoning] # v8.2.0.

Actual behavior

zizmor has flagged ref-version-mismatch on the line
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # zizmor: ignore[cache-poisoning] # v8.2.0

Reproduction steps

Run GH_TOKEN=$(gh auth token) zizmor -p .

Logs

help[ref-version-mismatch]: action's hash pin has mismatched or missing version comment
  --> ./.github/workflows/build.yml:34:9
   |
34 |       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # zizmor: ignore[cache-poisoning] # v8.2.0
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ comment does not contain a version
   |
   = note: audit confidence → High
   = tip: rewrite comment to include '# v8.2.0'

Additional context

This bug is regression, introduced in 1.26.0, e.g. GH_TOKEN=$(gh auth token) uvx 'zizmor==1.25.2' -p . do not show such warnings.
It's interesting, that order of "version comment" and "zizmor ignore comment" is crucial to dependabot. When it checks, should it update the version in comments, it checks whether the line ends with the version.

@alex-700

Hi @alex-700, thanks for the report.

I suspect this is an unfortunate interaction between different layers of zizmor: we made the ref-version-mismatch audit more correct in 1.26, but a consequence of that is that it's now more strict about the comments it expects to see, which don't include zizmor's own ignore comments.

I think the current workaround is to put your ignore comment on a different line -- anywhere in the same step should work (if it doesn't, that's a separate unrelated bug).

Long term I'm not sure if we'll support stacking comments like this (since Dependabot doesn't make any guarantees and it's easy for them to regress on their current behavior). But either way this should be documented, so I'll leave this open.

#2177 "fixes" this by adding the appropriate hidden step-level spans, meaning that you can put the ignore comment anywhere else on the same step other than the uses: clause itself and it'll work.

Navigation Menu

Repository navigation

[BUG]: ref-version-mismatch FP, when the comment contains zizmor ignore directive #2165

Pre-submission checks

zizmor version

Expected behavior

Actual behavior

Reproduction steps

Logs

Additional context

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[BUG]: ref-version-mismatch FP, when the comment contains zizmor ignore directive #2165

Description

Pre-submission checks

zizmor version

Expected behavior

Actual behavior

Reproduction steps

Logs

Additional context

Activity

woodruffw commented on Jul 2, 2026

woodruffw commented on Jul 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions