zizmor 1.26.1

Static analysis for GitHub Actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

use crate::common::{input_under_test, zizmor};

#[cfg_attr(not(feature = "gh-token-tests"), ignore)]
#[test]
fn test_regular_persona() -> anyhow::Result<()> {
    insta::assert_snapshot!(
        zizmor()
            .input(input_under_test("impostor-commit.yml"))
            .offline(false)
            .run()?,
        @"
    error[impostor-commit]: commit with no history in referenced repository
      --> @@INPUT@@:29:15
       |
    29 |         - uses: actions/checkout@c7d749a2d57b4b375d1ebcd17cfbfb60c676f18e
       |           -     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ uses a commit that doesn't belong to the specified org/repo
       |  _________|
       | |
    30 | |         with:
    31 | |           persist-credentials: false
       | |____________________________________- this step
       |
       = note: audit confidence → High

    4 findings (3 suppressed): 0 informational, 0 low, 0 medium, 1 high
    "
    );

    Ok(())
}

/// Test for #1997: if a user does something like `uses: foo/bar@sha`
/// where `sha` is a tag SHA, then we should correctly "peel" that tag
/// back to its original commit SHA rather than emitting a false positive.
#[cfg_attr(not(feature = "gh-token-tests"), ignore)]
#[test]
fn test_peels_tag_sha_to_commit_sha() -> anyhow::Result<()> {
    insta::assert_snapshot!(
    zizmor()
        .input(input_under_test("impostor-commit/sha-is-tag.yml"))
        .offline(false)
        .run()?,
    @"No findings to report. Good job! (3 suppressed)"
    );

    Ok(())
}