Previously we used
- name: Install the latest version of uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
- name: Check GitHub actions
run: uvx zizmor --min-severity medium .github/workflows/*.ymlAnd "all of a sudden" it brings up like 20 warnings (rightfully):
action's hash pin has mismatched or missing version comment: points to unknown ref
But I can not reproduce them locally with 1.25.0 either and according to the docs the message is from 1.14.0:
https://docs.zizmor.sh/audits/#ref-version-mismatch
What am I missing locally and in the old style that this action is defining?
I tried to check the source code, but couldn't find any logical explanation for this
(Sorry if this is the wrong place and it should go into the normal repo instead, I'm just confused atm)
Previously we used
ci(zizmor): Use zizmor action nextcloud/.github#724
And "all of a sudden" it brings up like 20 warnings (rightfully):
But I can not reproduce them locally with 1.25.0 either and according to the docs the message is from 1.14.0:
https://docs.zizmor.sh/audits/#ref-version-mismatch
What am I missing locally and in the old style that this action is defining?
I tried to check the source code, but couldn't find any logical explanation for this
(Sorry if this is the wrong place and it should go into the normal repo instead, I'm just confused atm)