zizmor 1.26.1

Static analysis for GitHub Actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

name: Ref Version Mismatch Test

on: [push]

permissions: {}

jobs:
  ref-version-mismatch:
    name: ref-version-mismatch
    runs-on: ubuntu-latest
    steps:
      # No finding, comment matches
      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3.8.2

      # Pedantic finding: missing version comment
      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7

      # Pedantic finding: non-version comment, no auto-fix
      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # some comment

      # No finding, symbolic ref
      - uses: actions/setup-node@v3.8.2 # v3.8.2

      # Finding: v3.8.1==5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d, v3.8.2==1a4442cacd436585916779262731d5b162bc6ec7
      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3.8.1

      # Finding, the comment does not resolve to a known tag
      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v300000.8.1

      # No finding, the tag points to another tag that points to 9d47c6ad4b02e050fd481d890b2ea34778fd09d6
      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8

      # No finding, comment matches (even without v prefix)
      - uses: canonical/charming-actions/check-libraries@1753e0803f70445132e92acd45c905aba6473225 # 2.7.0