[rqbazan]

Summary

.github/workflows/pullfrog.yml is generated by the Pullfrog app and reached main without a pull request, so the workflow audit never ran on it. Every pull request to main now fails "Audit workflows" on that file, which none of them touch. The file is the app's to change, so zizmor ignores, for that file only, the two audits it fails today:

 rules:
   dependabot-cooldown:
     …
   unpinned-uses:
     config:
       policies:
         …
+    ignore:
+      # Generated by the Pullfrog app, not edited here.
+      - pullfrog.yml
+  artipacked:
+    ignore:
+      # Generated by the Pullfrog app, not edited here.
+      - pullfrog.yml

Every other audit still runs on pullfrog.yml, and these two still run on every other workflow. No workflow changes.

Evidence

The audit's own command, pipx run --spec zizmor==1.30.1 zizmor --format=github .github/, run in a clone:

• Before (main): exit 14. It reports three findings, all on pullfrog.yml, the ones that fail "Audit workflows" on every pull request to main today:

  warning  artipacked     pullfrog.yml:24  checkout without persist-credentials: false
  error    unpinned-uses  pullfrog.yml:25  actions/checkout@v6
  error    unpinned-uses  pullfrog.yml:29  pullfrog/pullfrog@v0
  

• After: exit 0, no findings (3 ignored).
• Still audited: with this config, a step run: echo "${{ inputs.prompt }}" appended to pullfrog.yml is still flagged (template-injection). A checkout like the app's in workflow-audit.yml (actions/checkout@v7, no persist-credentials: false) still fails both unpinned-uses and artipacked.

Merge Danger

Door: two-way. Reverting these lines puts the audit back as it is on main.

Blast Radius: CI. Only zizmor reads this file. If the app ever adds another unpinned action or checkout to pullfrog.yml, these two audits won't flag it there.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J22sD4rHr39R1HMKd8G7hn

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2490637

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the zizmor config change that stops unpinned-uses and artipacked from failing CI on the generated Pullfrog workflow.

• File-scoped ignores — .github/zizmor.yml ignores pullfrog.yml for those two rules only. Other audits still cover that file, and both rules still cover every other workflow. Re-ran zizmor==1.30.1 on .github/: exit 0, 3 ignored.

  ^{｜ View workflow run ｜ Using grok-4.7 ｜ 𝕏}