[cgfixit]

Proposed changes

#1709 item 7. The workflow-lint job in .github/workflows/ci.yml ran zizmor --min-severity=high. Its comment said 25 medium/low findings were deferred work, mostly checkouts without persist-credentials: false. That stopped being true: every checkout now sets it. Measured on main @ 14812bd with zizmor 1.28.0 (the CI pin) in --offline mode, the result is 0 findings at every severity down to informational.

The "41 suppressed" in that output is not a hidden backlog. It is two things:

• checks that only the pedantic persona shows: undocumented-permissions, anonymous-definition, template-injection help notes, concurrency-limits;
• the three inline dangerous-triggers ignores documented in [security] - Record why the three owner-gated issue_comment triggers are accepted #1704.

Changes:

• ci.yml: --min-severity=high becomes medium. The stale comment is replaced with what was measured and why low stays out (so a new low-only rule cannot block every PR).
• devskim.yml (second commit, 68d0cc27): the DevSkim-Action pin comment changes from # v1 to # v1.0.16.

About the devskim.yml change. As this PR's Risks section predicted, the first CI run failed on one finding from an online audit, which I could not run without a token. The finding was ref-version-mismatch (medium) at devskim.yml:50. git ls-remote confirms that the pinned SHA 4b504794… is refs/tags/v1.0.16, while v1 now points to 734c6ed8…. This is a comment-only fix: the pinned SHA, and so the code that runs, is unchanged.

Invariant / Governance Impact: none. CI gate and a workflow comment only.

Types of changes

• CI / infrastructure (workflows, hooks, templates, or checkers)

Scope: Infrastructure / CI only.

Benefits / why

• A new medium-severity workflow finding now fails workflow-lint instead of passing silently. The DevSkim mismatch is the first example: it had been passing unnoticed.
• The comment stops claiming debt that no longer exists.

Risks to monitor

• Latent mismatches. Several pins still carry major-only comments: # v4 (codeql-action ×6), # v1 (codex-action ×3), # v7 (upload-artifact in devskim.yml). They pass today because those tags still point at the pinned SHAs. Each one becomes this same medium failure the next time its major tag moves. The fix is the same comment-only change, or Dependabot's actions bump, which rewrites the comment with the SHA.
• Future medium findings. A later zizmor bump or a new workflow can add findings that now block. That is the purpose of this change, but expect either a fix or a reasoned inline ignore when it happens.

Checklist

• I have read docs/THREAT_MODEL.md, INVARIANTS.md and SECURITY.md (and any relevant Phase docs)
• This change preserves all 6 security invariants and I6 module isolation (no code touched)
• Full sandbox validation has been run (per CLAUDE.md §5, left to CI)
• No new external network dependencies or mandatory online LLM assumptions were introduced
• Commit messages follow the title prefix convention above

Further comments

Run directly:

• zizmor 1.28.0 --offline at high, medium, low and informational: 0 findings each.
• --persona=pedantic to see what is suppressed: 15 undocumented-permissions, 11 anonymous-definition, 9 template-injection help notes, 1 concurrency-limits.
• actionlint on ci.yml and devskim.yml: clean.
• git ls-remote on microsoft/DevSkim-Action for the tag mapping.

Only CI ran: the online audits. The first run caught the DevSkim mismatch. The re-run on 68d0cc27 is the confirmation.

Suggested merge order of open PRs

Trial merges verified (git merge --no-commit --no-ff + abort, separately and stacked) against main @ 14812bd on 2026-10-20. devskim.yml is touched by no other open PR.

#1734 · Blocked (draft)
Impact: codex-apply-fixes.yml publish-step deny list.
Action: Independent; either order. Clean.

#1735 (this PR) · Blocked (draft)
Impact: zizmor gate high → medium, plus the DevSkim comment fix.
Action: Merge once workflow-lint is green on 68d0cc27. Clean.

ELI5

zizmor is a scanner that checks the GitHub Actions workflow files for security mistakes. CI only failed on its "high" warnings, because months ago there were 25 smaller ones nobody had fixed yet, and the comment in .github/workflows/ci.yml still said so. Those are all fixed now. So the bar moves down to "medium", and new medium problems now fail CI.

The first CI run proved the point. One workflow, devskim.yml, pinned the DevSkim scanner to the right exact commit but labelled it "v1" when that commit is actually "v1.0.16". The scanner caught the mismatch. I fixed the label. The pinned commit, and so the code that runs, did not change.

• Enhances: more workflow mistakes get caught automatically.
• Obsoletes: a comment describing debt that no longer exists.
• Retrieves: the original intent, which was to tighten the bar once the backlog was cleared.
• Reverses when pushed to extremes: a future rule, or a moved major tag, could block PRs until someone makes a quick label fix.

I ran the scanner offline at every level. CI's online run found the one remaining problem, which is now fixed.

🤖 Generated with Claude Code

https://claude.ai/code/session_014FZ8JTF2v1eQd1L5CKQR8j

Last updated: 2026-10-20 14:50 ET