fix(release): the console job could never have claimed the name it exists to claim #47
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: zizmor | |
| # GitHub Actions static analysis (Trail of Bits), split out of security.yml so it runs only when the | |
| # surface it lints actually changes: zizmor reads .github/** (workflows + its config), so a Python / | |
| # docs / test PR cannot change its result and running it there was pure cost (~1 billed min on every | |
| # one of ~900 monthly PR/push scans). The daily cron re-runs it against the UNCHANGED tree so a | |
| # newly-added zizmor rule or newly-flagged action ref still surfaces within ~24h, and | |
| # workflow_dispatch covers on-demand runs. NOT a branch-protection required check (verified against | |
| # the live protection rules), so a paths-filtered skip can never wedge a PR or auto-merge. | |
| on: | |
| pull_request: | |
| paths: | |
| - ".github/**" | |
| schedule: | |
| - cron: "0 6 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| zizmor: | |
| name: zizmor (GitHub Actions static analysis) | |
| runs-on: ubuntu-latest | |
| # BLOCKING: static analysis of the workflow files THEMSELVES — template injection, over-broad | |
| # GITHUB_TOKEN permissions, dangerous triggers, artifact-credential persistence. The baseline is | |
| # clean — high-confidence findings are fixed in-tree (least-privilege per-job permissions, | |
| # env-passed refs, persist-credentials: false) and the few safe-by-design ones are recorded with | |
| # a justification in .github/zizmor.yml — so a NEW workflow-security regression fails the build. | |
| # Tune suppressions in .github/zizmor.yml (with a reason), not by relaxing this gate. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Lint-only job: no pushes, no uploaded artifacts — don't persist the token (artipacked). | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.14" | |
| - name: Install zizmor (pinned) | |
| run: | | |
| # Pin deliberately; verify the tag at https://github.com/zizmorcore/zizmor/releases if it 404s. | |
| python -m pip install --upgrade pip "zizmor==1.5.2" | |
| - name: Analyze the workflows | |
| env: | |
| # Lets zizmor run its online audits (e.g. unpinned / known-problematic action refs). | |
| GH_TOKEN: ${{ github.token }} | |
| run: zizmor .github/workflows |