Skip to content

🔒️ Fix zizmor template-injection findings#6550

Merged
dubzzz merged 4 commits into
mainfrom
copilot/apply-zizmor-auto-fixes
Feb 5, 2026
Merged

🔒️ Fix zizmor template-injection findings#6550
dubzzz merged 4 commits into
mainfrom
copilot/apply-zizmor-auto-fixes

Conversation

Copilot AI commented Feb 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
  • Remove ignored rules from .github/zizmor.yml to see all failures
  • Fix template-injection findings in build-status.yml (7 publish jobs) - move ${{steps.attest.outputs.bundle-path}} and ${{env.TGZ_NAME}} from inline expressions to environment variables
  • Update .github/zizmor.yml with correct line numbers for cache-poisoning ignores (still legitimate false positives due to attestation workflow)
  • Keep use-trusted-publishing ignores (still needed for pkg-pr-new publish false positives)
  • Verify all changes with zizmor (0 findings with config, exit code 0)
  • Move env after run in all attestation bundle steps per review feedback
Original prompt

run and apply zizmor auto fixes of working, try to correct others. before running it drop our ignored rules so that you can actually see why they fail

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

@changeset-bot

changeset-bot Bot commented Feb 5, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 6efe6b0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@dubzzz
fix: resolve template-injection findings and update zizmor config
51c331f 
- Fix 14 template-injection findings across 7 publish jobs by moving
  ${{steps.attest.outputs.bundle-path}} to env var BUNDLE_PATH and
  replacing ${{env.TGZ_NAME}} with $TGZ_NAME in run commands
- Remove template-injection ignore section from zizmor config (fixed)
- Update cache-poisoning ignore line numbers to match current file

Co-authored-by: dubzzz <[email protected]>
Copilot AI changed the title [WIP] Run and apply Zizmor auto fixes and correct others 🔒️ Fix zizmor template-injection findings Feb 5, 2026
Copilot AI requested a review from dubzzz February 5, 2026 21:52
@dubzzz
dubzzz marked this pull request as ready for review February 5, 2026 21:52
dubzzz
dubzzz reviewed Feb 5, 2026
View reviewed changes
Comment thread .github/workflows/build-status.yml
subject-path: packages/ava/${{env.TGZ_NAME}}
- name: Rename attestation bundle
run: mv "${{steps.attest.outputs.bundle-path}}" "packages/ava/${{env.TGZ_NAME}}.sigstore.json"
env:

@dubzzz dubzzz Feb 5, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot move env after run in all changes you did

Copilot AI Feb 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in 6efe6b0 — moved env after run in all 7 attestation bundle steps.

@pkg-pr-new

pkg-pr-new Bot commented Feb 5, 2026 •
edited
Loading

Copy link
Copy Markdown
@fast-check/ava

npm i https://pkg.pr.new/@fast-check/ava@6550

fast-check

npm i https://pkg.pr.new/fast-check@6550

@fast-check/jest

npm i https://pkg.pr.new/@fast-check/jest@6550

@fast-check/packaged

npm i https://pkg.pr.new/@fast-check/packaged@6550

@fast-check/poisoning

npm i https://pkg.pr.new/@fast-check/poisoning@6550

@fast-check/vitest

npm i https://pkg.pr.new/@fast-check/vitest@6550

@fast-check/worker

npm i https://pkg.pr.new/@fast-check/worker@6550

commit: 6efe6b0

@github-actions

github-actions Bot commented Feb 5, 2026

Copy link
Copy Markdown
Contributor

👋 A preview of the new documentation is available at: http://69851204e546265478f5d71c--dubzzz-fast-check.netlify.app

Copilot AI requested a review from dubzzz February 5, 2026 21:58
@dubzzz
dubzzz enabled auto-merge (squash) February 5, 2026 21:59
@github-actions

github-actions Bot commented Feb 5, 2026

Copy link
Copy Markdown
Contributor

👋 A preview of the new documentation is available at: http://698513db3c328a5c0c2edfa8--dubzzz-fast-check.netlify.app

@dubzzz
dubzzz merged commit b5a712f into main Feb 5, 2026
84 of 95 checks passed
@dubzzz
dubzzz deleted the copilot/apply-zizmor-auto-fixes branch February 5, 2026 22:10
@codecov

codecov Bot commented Feb 5, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.85%. Comparing base (b0bedbc) to head (6efe6b0).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #6550   +/-   ##
=======================================
  Coverage   94.85%   94.85%           
=======================================
  Files         207      207           
  Lines        5581     5581           
  Branches     1467     1468    +1     
=======================================
  Hits         5294     5294           
  Misses        274      274           
  Partials       13       13
Flag Coverage Δ
tests 94.85% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ghost-of-high-heart ghost-of-high-heart Bot mentioned this pull request Apr 3, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@dubzzz dubzzz dubzzz approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@dubzzz dubzzz

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dubzzz