From 37782bf77c5d2a9c39f6bcf8b5fb2191a32bc632 Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Wed, 2 Sep 2026 08:35:16 +0200
Subject: [PATCH 1/2] Take the two pins the index has published past [#224]

`go run . pins` refused on the default branch because the workflow audit and
the static analysis engine were both behind what PyPI publishes, and the
comparison runs weekly on a schedule, so the refusal stood for two days with
nothing that would clear it but a change to this file.

    go run . pins
      zizmor: BEHIND, pinned 1.29.0, pypi says 1.30.0
      semgrep: BEHIND, pinned 1.174.0, pypi says 1.176.0
      4 pin(s) declared, 4 compared, 2 behind, 0 unresolved.

Run 2026-09-02 at 6541274, elided for length.

What this prevents is the drift each `why` field names: a workflow audit that
has stopped understanding the syntax it audits, and a rule engine release that
turns a pattern which refuses something into one that refuses nothing, both of
which leave every run green. Neither pin carries a checksum, because the
resolver compares against what the index publishes rather than against the
wheel, which is what those two entries already say.

The bump is written by hand rather than by a run of the comparison, which
reports and never writes: a machine that rewrote a version and its checksum in
one commit has proved nothing about the bytes it just trusted.

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
---
 pins.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pins.json b/pins.json
index 17cd3a9..c567c4b 100644
--- a/pins.json
+++ b/pins.json
@@ -13,7 +13,7 @@
     "id": "zizmor",
     "registry": "pypi",
     "name": "zizmor",
-    "version": "1.29.0",
+    "version": "1.30.0",
     "checksum": "",
     "reads": [".github/workflows/zizmor.yml"],
     "repeats": [],
@@ -23,7 +23,7 @@
     "id": "semgrep",
     "registry": "pypi",
     "name": "semgrep",
-    "version": "1.174.0",
+    "version": "1.176.0",
     "checksum": "",
     "reads": [".github/workflows/semgrep.yml"],
     "repeats": [],

From 38e2f71492667da78993cedd0865775b379f1bde Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Wed, 2 Sep 2026 08:39:46 +0200
Subject: [PATCH 2/2] Call the packing workflow by the syntax that cannot be
 redirected [#224]

The audit release the pin above moves to carries a new rule, and it refuses
two lines of this tree at the severity the gate is run at:

    uvx --no-build "zizmor@1.30.0" --strict-collection --min-severity=low --format=plain .
    help[self-repository]: use GitHub's dedicated self-repository syntax
      --> ./.github/workflows/package-caller.yml:32:11
      --> ./.github/workflows/release.yml:76:11
    12 findings (10 suppressed, 2 safe fixes): 0 informational, 2 low, 0 medium, 0 high

Read 2026-09-02 from the run of that version on this branch, elided for length.
Both sites call the packing workflow, both are the only two calls to it in the
tree, and neither carries a reference, which is what the newer form requires:

    grep -rn 'uses: ./.github/workflows/package.yml' .github/workflows/
    .github/workflows/package-caller.yml:32:    uses: ./.github/workflows/package.yml
    .github/workflows/release.yml:76:    uses: ./.github/workflows/package.yml

Run 2026-09-02 before this change.

What the newer form prevents is the older one resolving to a file a previous
step wrote into the workspace rather than to the file at this commit. The
workspace-relative spelling is a path on a runner, so a step that clones or
writes ahead of the call decides what runs; `$/` names the calling repository at
the commit that called, and cannot be pointed anywhere else.

This lands beside the pin rather than after it because the pin is what makes the
rule apply: at 1.29.0 the audit does not exist, and at 1.30.0 the gate refuses
these two lines, so a branch carrying only the pin cannot go green.

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
---
 .github/workflows/package-caller.yml | 2 +-
 .github/workflows/release.yml        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/package-caller.yml b/.github/workflows/package-caller.yml
index d533464..639e1d2 100644
--- a/.github/workflows/package-caller.yml
+++ b/.github/workflows/package-caller.yml
@@ -29,4 +29,4 @@ jobs:
     # A caller grants every permission the callable file declares, and no more.
     permissions:
       contents: read
-    uses: ./.github/workflows/package.yml
+    uses: $/.github/workflows/package.yml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7511af0..4d21b96 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,7 +73,7 @@ jobs:
     # A caller grants every permission the callable file declares, and no more.
     permissions:
       contents: read
-    uses: ./.github/workflows/package.yml
+    uses: $/.github/workflows/package.yml
 
   publish:
     name: Publish the release