ci: add path-aware job gating and zizmor security workflow - #12
Merged
Conversation
- build.yml / static-analysis.yml: add a 'changes' gate job; heavy jobs now carry needs/if on it so docs-only changes skip them while required checks still resolve (skipped, not pending). - zizmor.yml: new job, SHA-pinned zizmorcore/zizmor-action v0.6.2, persona auditor, advanced-security disabled, PR/push-triggered on .github/**/*.yml changes. - release.yml: move the contents:write permission comment inline so zizmor's undocumented-permissions audit recognizes it. - dependabot.yml: add a 7-day cooldown per ecosystem (zizmor's dependabot-cooldown auto-fix) so bumps aren't applied same-day.
A skipped matrix job posts one check run under its unexpanded name
template ("PHP ${{ matrix.php }}"), not per-version names, so the
required PHP 8.3/8.4/8.5 checks never resolve and the PR stays BLOCKED
forever. Confirmed live on bulkhead (same shape PR).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
changesgate job tobuild.yml/static-analysis.ymlso docs-only PRs skip heavy CI jobs without leaving required checks stuck inPending. Adds.github/workflows/zizmor.yml(zizmor --persona=auditor on every workflow change). Also fixes two pre-existing findings so the new zizmor job starts clean:release.yml's undocumented-permissions comment moved inline, and a 7-day cooldown added todependabot.yml.Rolled out from the shared
templates/in the rasuvaeff packages monorepo. Verified locally: YAML parses,zizmor --persona=auditor .github/reports no findings.