[rqbazan]

Summary

.github/workflows/pullfrog.yml is generated by the Pullfrog app and reached main without a pull request, so the workflow audit never ran on it. Every pull request to main now fails "Audit workflows" on that file, which none of them touch. The file is the app's to change, so zizmor ignores, for that file only, the two audits it fails today:

 rules:
   unpinned-uses:
     config:
       policies:
         …
+    ignore:
+      # Generated by the Pullfrog app, not edited here.
+      - pullfrog.yml
+  artipacked:
+    ignore:
+      # Generated by the Pullfrog app, not edited here.
+      - pullfrog.yml
   dependabot-cooldown:

Every other audit still runs on pullfrog.yml, and these two still run on every other workflow. No workflow changes.

Evidence

The audit's own command, pipx run --spec zizmor==1.30.1 zizmor --format=github ., run in a clone:

• Before (main): exit 14. It reports three findings, all on pullfrog.yml, the ones that fail "Audit workflows" on every pull request to main today:

  warning  artipacked     pullfrog.yml:24  checkout without persist-credentials: false
  error    unpinned-uses  pullfrog.yml:25  actions/checkout@v6
  error    unpinned-uses  pullfrog.yml:29  pullfrog/pullfrog@v0
  

• After: exit 0, no findings (3 ignored).
• Still audited: with this config, a step run: echo "${{ inputs.prompt }}" appended to pullfrog.yml is still flagged (template-injection). A checkout like the app's in workflow-audit.yml (actions/checkout@v7, no persist-credentials: false) still fails both unpinned-uses and artipacked.

Merge Danger

Door: two-way. Reverting these lines puts the audit back as it is on main.

Blast Radius: CI. Only zizmor reads this file. If the app ever adds another unpinned action or checkout to pullfrog.yml, these two audits won't flag it there.

🤖 Generated with Claude Code

https://claude.ai/code/session_01J22sD4rHr39R1HMKd8G7hn

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0b94f25

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://ci-zizmor-ignore-pullfrog-variablelab-www.raquirozbazan.workers.dev (commit 0b94f25)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://939fbb4c-variablelab-www.raquirozbazan.workers.dev	0b94f25	2026-10-24T13:05:39.938Z	Visit the dashboard ↗

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the zizmor config that stops Audit workflows from failing on the generated Pullfrog workflow.

• Scoped ignores — unpinned-uses and artipacked ignore pullfrog.yml by base filename, which is the form zizmor documents. Other audits still cover that file, and both audits still cover the other workflows. Audit workflows on this PR passed with zizmor 1.30.1.

  ^{｜ View workflow run ｜ Using grok-4.7 ｜ 𝕏}