Add zizmor GitHub Actions static analysis - #176
Merged
Conversation
Matches the pattern rolled out across other mitodl app repos: a zizmor-action CI job scoped to workflow-file changes, plus a zizmor-pre-commit hook in prek.toml so findings surface locally too. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PgiVHUq2Mv2J7bBEAcpe6M
Contributor
There was a problem hiding this comment.
Pull request overview
Adds zizmor-based static analysis for GitHub Actions workflows, enforcing consistent linting both in CI (via a dedicated workflow) and locally (via prek) to catch higher-severity workflow issues early.
Changes:
- Adds a new GitHub Actions workflow that runs
zizmorcore/zizmor-actionagainst.github/workflows/on pushes/PRs touching workflow files. - Adds a new
zizmorhook toprek.tomlusingzizmorcore/zizmor-pre-commitwith severity/confidence thresholds aligned to CI.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
prek.toml |
Adds a zizmor prek hook to run GitHub Actions static analysis locally with configured thresholds. |
.github/workflows/actions-static-analysis.yml |
Introduces a CI workflow to run zizmor against .github/workflows/** on relevant pushes/PRs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Matches the sibling checkout step's with: indentation for consistency. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PgiVHUq2Mv2J7bBEAcpe6M
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are the relevant tickets?
N/A
Description (What does it do?)
Adds zizmor static analysis for GitHub Actions workflows, matching the pattern rolled out across other mitodl app repos this week:
.github/workflows/actions-static-analysis.ymlworkflow that runszizmorcore/zizmor-actionagainst.github/workflows/on any push/PR touching workflow files, gated atmin-severity: high/min-confidence: medium.zizmorhook inprek.toml(viazizmorcore/zizmor-pre-commit,v1.29.0) so the same checks run locally at commit time, with matching thresholds (--min-severity=high --min-confidence=medium).No existing workflow files needed changes — a local
zizmorrun against the current.github/workflows/tree at these thresholds reports no findings.Screenshots (if appropriate):
N/A
How can this be tested?
prek run --files .github/workflows/actions-static-analysis.yml prek.toml— all hooks pass, including the newzizmorhook.uvx zizmor@1.29.0 --no-progress --min-severity=high --min-confidence=medium .github/workflows/— reports "No findings to report."GitHub Actions Static Analysisworkflow will run on any future PR that touches.github/workflows/**.Additional Context
Same tooling/config as the zizmor PRs opened against other mitodl repos (e.g. mitodl/ol-keycloak#288, mitodl/ol-keycloakify#177) — this repo already used
prekin place ofpre-commit, so the hook was added toprek.tomlin the equivalent[[repos]]/[[repos.hooks]]form rather than.pre-commit-config.yaml.