From b646ac21e4eee833d49d88ad5794d26441bcc00f Mon Sep 17 00:00:00 2001 From: Vijit Singh Date: Wed, 19 Aug 2026 11:29:50 -0500 Subject: [PATCH] chore(ci): bump zizmor 1.25.2 -> 1.29.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first bump surfaced by the new pin report (#378). zizmor audits these workflows and gates the merge, so four minors behind meant auditing our own supply chain with a scanner missing four releases of rules — the reason #373 called it the one that matters. Verified locally first: 1.29.0 against the current workflows reports no new findings (offline mode, so the online audits are not covered there). The Workflow audit check on this PR runs it ONLINE with a token, which is the real gate — and this PR's own zizmor job is exactly the verification the old bot-PR design promised and never once delivered (#376). --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d942b03..786cd1f 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -58,7 +58,7 @@ jobs: name: Workflow audit (zizmor) runs-on: ubuntu-24.04 env: - ZIZMOR_VERSION: "1.25.2" + ZIZMOR_VERSION: "1.29.0" steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: