From 6bd2be9d1b27e8a57c4fbb1fb27c7902e6c59e6b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 01:29:22 +0000 Subject: [PATCH 1/3] build(deps): bump zizmorcore/zizmor-action Bumps the actions-minor group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action). Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/v0.6.4...v0.7.1) --- updated-dependencies: - dependency-name: zizmorcore/zizmor-action dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/security.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index c6d6a1b1..3d20f004 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -33,7 +33,7 @@ jobs: persist-credentials: false - name: Run zizmor # 上游最高 tag 只有 v0.6.4,无 v1(写 v1 会 action 解析失败) - uses: zizmorcore/zizmor-action@v0.6.4 + uses: zizmorcore/zizmor-action@v0.7.1 env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From d504d89c2838fed2ce8ccbdaaa64599bb8a41b8e Mon Sep 17 00:00:00 2001 From: wangxu Date: Mon, 26 Oct 2026 13:35:10 +0800 Subject: [PATCH 2/3] =?UTF-8?q?fix(ci):=20zizmor-action=20=E7=89=88?= =?UTF-8?q?=E6=9C=AC=E6=B3=A8=E9=87=8A=E5=8B=98=E8=AF=AF=E2=80=94=E2=80=94?= =?UTF-8?q?bump=20v0.7.1=20=E5=90=8E=E4=B8=8A=E9=99=90=E6=96=AD=E8=A8=80?= =?UTF-8?q?=E5=A4=B1=E5=AE=9E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit dependabot 将 zizmorcore/zizmor-action 从 v0.6.4 bump 到 v0.7.1,但 security.yaml 旁的注释仍断言"上游最高 tag 只有 v0.6.4",已失实且 会误导后续维护者(上游现有 v0.7.0/v0.7.1/v0.8.0)。 处置:删除会随每次 dependabot bump 过时的具体版本断言,保留经实证 仍成立的注释本意——上游全程 0.x 系列无 v1 tag,写 v1 会 action 解析 失败,须 pin 具体版本。 依据(gh api repos/zizmorcore/zizmor-action/releases,2026-10-26): 全部 25 个 tag 为 v0.0.1..v0.8.0,无 v1;v0.7.1(2026-10-15 发布) 真实存在;v0.7.x action 输入接口无变化,本 workflow 不传 with: 仅 env GH_TOKEN,语义兼容,CI zizmor job 在 bump 后 head 上 success。 Signed-off-by: wangxu --- .github/workflows/security.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 3d20f004..59cef236 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -32,7 +32,7 @@ jobs: with: persist-credentials: false - name: Run zizmor - # 上游最高 tag 只有 v0.6.4,无 v1(写 v1 会 action 解析失败) + # 上游全程 0.x 系列无 v1 tag(写 v1 会 action 解析失败),须 pin 具体版本 uses: zizmorcore/zizmor-action@v0.7.1 env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 11ba4ce133af442ec79217a912537a30f70f5cd9 Mon Sep 17 00:00:00 2001 From: wangxu Date: Mon, 26 Oct 2026 14:28:05 +0800 Subject: [PATCH 3/3] =?UTF-8?q?fix(ci):=20=E5=88=A0=E9=99=A4=20zizmor-acti?= =?UTF-8?q?on=20=E6=B3=A8=E9=87=8A=E4=B8=AD=E7=9A=84=E4=B8=8A=E6=B8=B8=20t?= =?UTF-8?q?ag=20=E7=A9=BA=E9=97=B4=E6=97=B6=E5=8F=98=E6=96=AD=E8=A8=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 同行同失效模式已实际发生一次:6bd2be9d 旁注"上游最高 tag 只有 v0.6.4"在 dependabot bump v0.7.1 后失实,逼出勘误提交 d504d89c。 勘误后的新注释"上游全程 0.x 系列无 v1 tag(写 v1 会 action 解析 失败)"仍是对第三方 tag 空间的时变断言,仅比"最高是 X"更隐蔽: 上游发 v1.0.0 即失实,届时 dependabot 开 major PR(dependabot.yml actions-minor 组只含 minor/patch)且只改 uses 行不碰注释,"写 v1 会解析失败"同时反转为错误指引。 根治:只保留持久信息——须 pin 具体版本 tag;可用 tag 以上游 releases 页为准(升级入口持久,不写死任何 tag 空间状态)。注释 不再含版本号字样,亦消除 zizmor ref-version-mismatch 潜在误配源。 依据:gh api repos/zizmorcore/zizmor-action/releases(2026-10-26) 共 25 tag v0.0.1..v0.8.0,无 v1(当前为真但时变,v0.8.0 发布于 2026-10-23);YAML 解析 OK,uses/env/permissions 零触碰,diff +1/-1。 Signed-off-by: wangxu --- .github/workflows/security.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 59cef236..2479045f 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -32,7 +32,7 @@ jobs: with: persist-credentials: false - name: Run zizmor - # 上游全程 0.x 系列无 v1 tag(写 v1 会 action 解析失败),须 pin 具体版本 + # 须 pin 具体版本 tag(可用 tag 以上游 releases 页为准) uses: zizmorcore/zizmor-action@v0.7.1 env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}