From 24906377a4b37a74eb9cd4abfd0ccf5eb63605c1 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Sat, 24 Oct 2026 08:03:44 -0500 Subject: [PATCH] ci: ignore zizmor's unpinned-uses and artipacked findings on the Pullfrog workflow pullfrog.yml is generated by the Pullfrog app and reached main without a pull request, so the workflow audit never ran on it, and every pull request to main now fails "Audit workflows" on a file it did not touch. The file is the app's to change, so zizmor ignores, for that file only, the two audits it fails today: unpinned-uses (actions/checkout@v6 and pullfrog/pullfrog@v0) and artipacked (the checkout keeps its credentials). Every other audit still runs on it. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01J22sD4rHr39R1HMKd8G7hn --- .github/zizmor.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 74c5f2a..ef547e5 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -9,3 +9,10 @@ rules: # First-party actions are tracked at @main; their main is protected by rulesets. "withvariablelab/*": ref-pin "*": hash-pin + ignore: + # Generated by the Pullfrog app, not edited here. + - pullfrog.yml + artipacked: + ignore: + # Generated by the Pullfrog app, not edited here. + - pullfrog.yml