From 902b4a8efdb073aea9acf11f21cc98ebca620175 Mon Sep 17 00:00:00 2001 From: Zoltan Kochan Date: Fri, 16 Oct 2026 20:56:00 +0200 Subject: [PATCH] fix(ci): update zizmor-action to v0.7.1 (#16995) zizmor 1.31.0 stopped applying ignore comments to the dangerous-triggers audit, so the three workflow_run workflows failed the zizmor check on every fork pull request. zizmor-action v0.7.1 defaults to zizmor 1.31.1, which fixes the regression. Co-authored-by: Claude Opus 5.5 --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 6a014daa2a..5cd958d90f 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -31,7 +31,7 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@f9597c869b2e67095f9b527070297a13a6efe928 # v0.7.0 + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 with: # Fork PRs run with a read-only GITHUB_TOKEN, so SARIF upload to # Code scanning would fail. In that case, run zizmor anyway and