The pre-commit configuration template does not check the .github/.dependabot.yml file.
This became apparent when the zizmor hook did not pick up a missing cooldown period in the .dependabot.yml file for Iris, but it does flag a warning when zizmor is run independently via the command line.
It aught to be throwing this warning when run against the Iris repo:
warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
--> .github/dependabot.yml:8:5
|
8 | - package-ecosystem: "github-actions"
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
|
See https://docs.zizmor.sh/audits/#dependabot-cooldown
This is due to an overly restrictive set of file filters at the top of the .pre-commit-config.yml:
|
# Alphabetised, for lack of a better order. |
|
files: | |
|
(?x)( |
|
.github\/workflows\/.*| |
|
benchmarks\/.+\.py| |
|
docs\/.+\.py| |
|
lib\/.+\.py| |
|
noxfile\.py| |
|
pyproject\.toml| |
|
setup\.py| |
|
src\/.+\.py |
|
) |
We could either:
- relax the glob at line 16 to
.github/*
- explicitly add
.github/dependabot.yml
The pre-commit configuration template does not check the
.github/.dependabot.ymlfile.This became apparent when the
zizmorhook did not pick up a missingcooldownperiod in the.dependabot.ymlfile for Iris, but it does flag a warning whenzizmoris run independently via the command line.It aught to be throwing this warning when run against the Iris repo:
See https://docs.zizmor.sh/audits/#dependabot-cooldown
This is due to an overly restrictive set of file filters at the top of the
.pre-commit-config.yml:.github/templates/.pre-commit-config.yaml
Lines 13 to 24 in 575c890
We could either:
.github/*.github/dependabot.yml