Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package zizmor for openSUSE:Factory checked in at 2026-10-16 20:09:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/zizmor (Old) and /work/SRC/openSUSE:Factory/.zizmor.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "zizmor" Fri Oct 16 20:09:27 2026 rev:41 rq:1385099 version:1.31.1 Changes: -------- --- /work/SRC/openSUSE:Factory/zizmor/zizmor.changes 2026-10-15 13:05:19.762276201 +0200 +++ /work/SRC/openSUSE:Factory/.zizmor.new.3698736/zizmor.changes 2026-10-16 20:13:01.210569788 +0200 @@ -1,0 +2,9 @@ +Fri Oct 16 04:43:37 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.31.1: + * Bug Fixes + - Fixed a regression in 1.31.0 where some ignore + comments/configurations would no longer apply to the + dangerous-triggers audit (#2450) + +------------------------------------------------------------------- Old: ---- zizmor-1.31.0.obscpio New: ---- zizmor-1.31.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ zizmor.spec ++++++ --- /var/tmp/diff_new_pack.4OJHHx/_old 2026-10-16 20:13:03.122650220 +0200 +++ /var/tmp/diff_new_pack.4OJHHx/_new 2026-10-16 20:13:03.124650304 +0200 @@ -17,7 +17,7 @@ Name: zizmor -Version: 1.31.0 +Version: 1.31.1 Release: 0 Summary: A static analysis tool for GitHub Actions License: MIT ++++++ _service ++++++ --- /var/tmp/diff_new_pack.4OJHHx/_old 2026-10-16 20:13:03.179652618 +0200 +++ /var/tmp/diff_new_pack.4OJHHx/_new 2026-10-16 20:13:03.184652828 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> - <param name="revision">refs/tags/v1.31.0</param> + <param name="revision">refs/tags/v1.31.1</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> </service> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.4OJHHx/_old 2026-10-16 20:13:03.213654048 +0200 +++ /var/tmp/diff_new_pack.4OJHHx/_new 2026-10-16 20:13:03.217654216 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/woodruffw/zizmor</param> <param name="changesrevision">597db4d7dc5730bdc1370197bf5678a5ca028abb</param></service><service name="tar_scm"> <param name="url">https://github.com/zizmorcore/zizmor.git</param> - <param name="changesrevision">3b1f99d843832def9062cddb8a5d0b737e44dfe1</param></service></servicedata> + <param name="changesrevision">effdb35fa7868863f11655db256d9008922fa427</param></service></servicedata> (No newline at EOF) ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/zizmor/vendor.tar.zst /work/SRC/openSUSE:Factory/.zizmor.new.3698736/vendor.tar.zst differ: char 25611, line 119 ++++++ zizmor-1.31.0.obscpio -> zizmor-1.31.1.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/zizmor-1.31.0/Cargo.lock new/zizmor-1.31.1/Cargo.lock --- old/zizmor-1.31.0/Cargo.lock 2026-10-15 05:41:09.000000000 +0200 +++ new/zizmor-1.31.1/Cargo.lock 2026-10-16 00:59:33.000000000 +0200 @@ -1014,7 +1014,7 @@ [[package]] name = "github-actions-expressions" -version = "1.31.0" +version = "1.31.1" dependencies = [ "insta", "serde", @@ -1025,7 +1025,7 @@ [[package]] name = "github-actions-models" -version = "1.31.0" +version = "1.31.1" dependencies = [ "indexmap", "insta", @@ -2039,7 +2039,7 @@ [[package]] name = "pre-commit-models" -version = "1.31.0" +version = "1.31.1" dependencies = [ "indexmap", "serde", @@ -2772,7 +2772,7 @@ [[package]] name = "subfeature" -version = "1.31.0" +version = "1.31.1" dependencies = [ "memchr", "regex", @@ -3286,7 +3286,7 @@ [[package]] name = "tree-sitter-iter" -version = "1.31.0" +version = "1.31.1" dependencies = [ "tree-sitter", "tree-sitter-yaml", @@ -4194,7 +4194,7 @@ [[package]] name = "yamlpatch" -version = "1.31.0" +version = "1.31.1" dependencies = [ "indexmap", "insta", @@ -4208,7 +4208,7 @@ [[package]] name = "yamlpath" -version = "1.31.0" +version = "1.31.1" dependencies = [ "line-index", "self_cell", @@ -4326,7 +4326,7 @@ [[package]] name = "zizmor" -version = "1.31.0" +version = "1.31.1" dependencies = [ "annotate-snippets", "anstream", @@ -4387,7 +4387,7 @@ [[package]] name = "zizmor-dev" -version = "1.31.0" +version = "1.31.1" dependencies = [ "anyhow", "assert_cmd", @@ -4400,7 +4400,7 @@ [[package]] name = "zizmor-sarif" -version = "1.31.0" +version = "1.31.1" dependencies = [ "serde", "serde_json", diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/zizmor-1.31.0/Cargo.toml new/zizmor-1.31.1/Cargo.toml --- old/zizmor-1.31.0/Cargo.toml 2026-10-15 05:41:09.000000000 +0200 +++ new/zizmor-1.31.1/Cargo.toml 2026-10-16 00:59:33.000000000 +0200 @@ -14,7 +14,7 @@ ] [workspace.package] -version = "1.31.0" +version = "1.31.1" edition = "2024" rust-version = "1.97.0" readme = "README.md" @@ -22,15 +22,15 @@ license = "MIT" [workspace.dependencies] -github-actions-expressions = { path = "crates/github-actions-expressions", version = "1.31.0" } -github-actions-models = { path = "crates/github-actions-models", version = "1.31.0" } -pre-commit-models = { path = "crates/pre-commit-models", version = "1.31.0" } -subfeature = { path = "crates/subfeature", version = "1.31.0" } -tree-sitter-iter = { path = "crates/tree-sitter-iter", version = "1.31.0" } -yamlpatch = { path = "crates/yamlpatch", version = "1.31.0" } -yamlpath = { path = "crates/yamlpath", version = "1.31.0" } +github-actions-expressions = { path = "crates/github-actions-expressions", version = "1.31.1" } +github-actions-models = { path = "crates/github-actions-models", version = "1.31.1" } +pre-commit-models = { path = "crates/pre-commit-models", version = "1.31.1" } +subfeature = { path = "crates/subfeature", version = "1.31.1" } +tree-sitter-iter = { path = "crates/tree-sitter-iter", version = "1.31.1" } +yamlpatch = { path = "crates/yamlpatch", version = "1.31.1" } +yamlpath = { path = "crates/yamlpath", version = "1.31.1" } zizmor-dev = { path = "crates/zizmor-dev" } -zizmor-sarif = { path = "crates/zizmor-sarif", version = "1.31.0" } +zizmor-sarif = { path = "crates/zizmor-sarif", version = "1.31.1" } annotate-snippets = "0.12.16" anstream = "1.0.0" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/zizmor-1.31.0/crates/zizmor/src/audit/dangerous_triggers.rs new/zizmor-1.31.1/crates/zizmor/src/audit/dangerous_triggers.rs --- old/zizmor-1.31.0/crates/zizmor/src/audit/dangerous_triggers.rs 2026-10-15 05:41:09.000000000 +0200 +++ new/zizmor-1.31.1/crates/zizmor/src/audit/dangerous_triggers.rs 2026-10-16 00:59:33.000000000 +0200 @@ -52,6 +52,12 @@ _config: &Config, ) -> Result<Vec<Finding<'doc>>, AuditError> { let mut findings = vec![]; + + // Bug #2448: we dropped the entire `on:` span when we switched to more + // precise trigger spans, so users who had an ignore comment elsewhere in + // the `on:` block stopped getting suppressions. + let on_location = workflow.location().with_keys(["on".into()]); + if let Some(location) = workflow.pull_request_target() && !Self::is_labeler_exception(workflow) { @@ -59,6 +65,7 @@ Self::finding() .confidence(Confidence::Medium) .severity(Severity::High) + .add_location(on_location.clone().hidden()) .add_location( location .primary() @@ -73,6 +80,7 @@ Self::finding() .confidence(Confidence::Medium) .severity(Severity::High) + .add_location(on_location.clone().hidden()) .add_location( location .primary() @@ -87,6 +95,7 @@ Self::finding() .confidence(Confidence::Medium) .severity(Severity::High) + .add_location(on_location.clone().hidden()) .add_location( location .primary() diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/zizmor-1.31.0/crates/zizmor/tests/integration/audit/dangerous_triggers.rs new/zizmor-1.31.1/crates/zizmor/tests/integration/audit/dangerous_triggers.rs --- old/zizmor-1.31.0/crates/zizmor/tests/integration/audit/dangerous_triggers.rs 2026-10-15 05:41:09.000000000 +0200 +++ new/zizmor-1.31.1/crates/zizmor/tests/integration/audit/dangerous_triggers.rs 2026-10-16 00:59:33.000000000 +0200 @@ -109,3 +109,21 @@ Ok(()) } + +/// Repro for #2448: a `# zizmor: ignore` comment at the top of the `on:` block +/// should be honored for `dangerous-triggers`. +/// +/// See: <https://github.com/zizmorcore/zizmor/issues/2448> +#[test] +fn test_issue_2448() -> anyhow::Result<()> { + insta::assert_snapshot!( + Zizmor::cargo_bin() + .input(input_under_test( + "dangerous-triggers/issue-2448-repro.yml" + )) + .run()?, + @"No findings to report. Good job! (1 ignored, 3 suppressed)" + ); + + Ok(()) +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/zizmor-1.31.0/crates/zizmor/tests/integration/test-data/dangerous-triggers/issue-2448-repro.yml new/zizmor-1.31.1/crates/zizmor/tests/integration/test-data/dangerous-triggers/issue-2448-repro.yml --- old/zizmor-1.31.0/crates/zizmor/tests/integration/test-data/dangerous-triggers/issue-2448-repro.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/zizmor-1.31.1/crates/zizmor/tests/integration/test-data/dangerous-triggers/issue-2448-repro.yml 2026-10-16 00:59:33.000000000 +0200 @@ -0,0 +1,11 @@ +on: # zizmor: ignore[dangerous-triggers] + issue_comment: + +permissions: {} + +jobs: + vulnerable: + runs-on: ubuntu-latest + + steps: + - run: echo hello diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/zizmor-1.31.0/docs/integrations.md new/zizmor-1.31.1/docs/integrations.md --- old/zizmor-1.31.0/docs/integrations.md 2026-10-15 05:41:09.000000000 +0200 +++ new/zizmor-1.31.1/docs/integrations.md 2026-10-16 00:59:33.000000000 +0200 @@ -38,7 +38,7 @@ persist-credentials: false - name: Run zizmor 🌈 - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@f9597c869b2e67095f9b527070297a13a6efe928 # v0.7.0 ``` See the action's [`inputs` documentation][inputs-documentation] for @@ -83,7 +83,7 @@ branches: ["**"] env: - ZIZMOR_VERSION: 1.31.0 + ZIZMOR_VERSION: 1.31.1 permissions: {} @@ -102,7 +102,7 @@ persist-credentials: false - name: Install the latest version of uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Run zizmor 🌈 run: uvx "zizmor@${ZIZMOR_VERSION}" --format=sarif . > results.sarif # (2)! @@ -110,7 +110,7 @@ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # (1)! - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif category: zizmor @@ -159,7 +159,7 @@ branches: ["**"] env: - ZIZMOR_VERSION: 1.31.0 + ZIZMOR_VERSION: 1.31.1 jobs: zizmor: @@ -174,7 +174,7 @@ persist-credentials: false - name: Install the latest version of uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Run zizmor 🌈 run: uvx "zizmor@${ZIZMOR_VERSION}" --format=github . # (2)! diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/zizmor-1.31.0/docs/release-notes.md new/zizmor-1.31.1/docs/release-notes.md --- old/zizmor-1.31.0/docs/release-notes.md 2026-10-15 05:41:09.000000000 +0200 +++ new/zizmor-1.31.1/docs/release-notes.md 2026-10-16 00:59:33.000000000 +0200 @@ -9,6 +9,13 @@ ## Next (UNRELEASED) +## 1.31.1 + +### Bug Fixes 🐛 + +* Fixed a regression in [1.31.0](#1310) where some ignore comments/configurations + would no longer apply to the [dangerous-triggers] audit (#2450) + ## 1.31.0 ### Enhancements 🌱 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/zizmor-1.31.0/docs/troubleshooting.md new/zizmor-1.31.1/docs/troubleshooting.md --- old/zizmor-1.31.0/docs/troubleshooting.md 2026-10-15 05:41:09.000000000 +0200 +++ new/zizmor-1.31.1/docs/troubleshooting.md 2026-10-16 00:59:33.000000000 +0200 @@ -102,7 +102,7 @@ in your repository secrets, you could do: ```yaml title="example/repoA/.github/workflows/ci.yml" hl_lines="3" - - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + - uses: zizmorcore/zizmor-action@f9597c869b2e67095f9b527070297a13a6efe928 # v0.7.0 with: token: ${{ secrets.ZIZMOR_GH_TOKEN }} ``` ++++++ zizmor.obsinfo ++++++ --- /var/tmp/diff_new_pack.4OJHHx/_old 2026-10-16 20:13:03.672673356 +0200 +++ /var/tmp/diff_new_pack.4OJHHx/_new 2026-10-16 20:13:03.677673567 +0200 @@ -1,5 +1,5 @@ name: zizmor -version: 1.31.0 -mtime: 1792035669 -commit: 3b1f99d843832def9062cddb8a5d0b737e44dfe1 +version: 1.31.1 +mtime: 1792105173 +commit: effdb35fa7868863f11655db256d9008922fa427
