From d63655512848b0737fb254c1cf22c70a4048af86 Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Sun, 16 Aug 2026 22:40:31 +0200 Subject: [PATCH] Name the exact version in a pin comment rather than the major The workflow audit was red on every pull request opened against this board and no change in the tree or in flight repaired it. Two steps in codeql.yml pinned a commit and commented it `# v4`, and a major version is a reference upstream moves. The tag moved on 2026-08-13, so the comment stopped being true without anybody here touching a file, and zizmor reported ref-version-mismatch at both sites at medium severity. The pinned commit does not change. `5595ccaf912efad79be6eef63a5619ff05969be3` is the commit tag `v4.37.6` points at, and the comment now says so, so no version arrives that has not already walked this board's gate. The failure it prevents is a check that is red on everything and blocks nothing. That is a column people learn to scroll past, and the next finding it reports arrives where nobody is reading. The audit is outside the required set, so a permanent red here refuses no merge and only costs attention. Every other pin in this tree already named an exact version, so this is the two outliers joining the thirty-three rather than a new convention. The spelling is written at both files a reader of those steps opens: the reason for it at the sites in codeql.yml, and the rule in the block in zizmor.yml that says what a future workflow change must keep. That block also listed a pin-comment mismatch among the pedantic hygiene findings this gate deliberately does not act on, and that was wrong. The regular persona reports it, the gate step fails the build on it, and it did. The sentence is corrected where it stood. Refs #137 Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- .github/workflows/codeql.yml | 20 ++++++++++++++++++-- .github/workflows/zizmor.yml | 17 ++++++++++++----- 2 files changed, 30 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 16526da..ea3a07e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,6 +23,22 @@ # top and granted per job, every action pinned to a commit with its version in a # comment, and checkout without persisted credentials. The one write scope here # is security-events, which is what uploading the results needs and nothing more. +# +# The version in that comment is the exact one the pinned commit is tagged as, +# never the major. Both spellings leave the same commit running, so the whole +# difference is in what the comment claims. A comment reading v4 is a claim about +# a reference upstream moves, and it stops being true on the day upstream tags a +# release without anybody here touching a file; an exact version is a claim about +# the commit written next to it, which cannot go stale on its own. The two steps +# below carried a major until this comment landed, and were the only two sites in +# this tree that did. The command that says so prints nothing now, and printing +# nothing is the state to keep it in: +# +# git grep -nE 'uses: .*@[0-9a-f]{40} # v[0-9]+$' -- .github/workflows/ +# +# The audit in zizmor.yml reads the comment against the tags the pinned commit +# carries and fails the build on a mismatch, so the spelling is held by a check +# rather than by memory. name: CodeQL on: @@ -68,7 +84,7 @@ jobs: cache: false - name: Initialise CodeQL - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: languages: go # Manual rather than autobuild, because autobuild builds the module @@ -86,6 +102,6 @@ jobs: run: go build ./cmd/... ./internal/... - name: Analyse - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: category: "/language:go" diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 8ab1a87..c909ee2 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -11,13 +11,20 @@ # regular persona is the one zizmor documents for CI ("high-signal, low-noise, # actionable"). The pedantic persona is deliberately NOT used to gate: it adds # low-severity hygiene findings (undocumented permissions, missing concurrency, -# pin-comment mismatches, unnamed jobs) that are stylistic, not security-blocking, -# and some are context-blind (it would demand run-cancelling concurrency on a -# publishing workflow, which must never be cancelled mid-publish). Those findings -# are not gated here, and no issue on this tracker collects them today. +# unnamed jobs) that are stylistic, not security-blocking, and some are +# context-blind (it would demand run-cancelling concurrency on a publishing +# workflow, which must never be cancelled mid-publish). Those findings are not +# gated here, and no issue on this tracker collects them today. +# +# A pin comment that disagrees with the commit beside it is NOT in that set. This +# line listed it as a pedantic hygiene finding and that was wrong: the regular +# persona reports ref-version-mismatch at medium, so the step below fails the +# build on one. Two of them did exactly that on every pull request against this +# board, which is what corrected this sentence. # # Rule for future workflow changes: every new or edited workflow must pass this -# gate before merge. Keep actions SHA-pinned, keep checkout on +# gate before merge. Keep actions SHA-pinned, comment each pin with the exact +# version its commit is tagged as rather than the major, keep checkout on # persist-credentials:false, grant write permissions per job (never # workflow-level), and never restore a cache in a job that publishes a release. name: Workflow Security Analysis