[dependabot]

Bumps the action-deps group with 1 update: zizmorcore/zizmor-action.

Updates zizmorcore/zizmor-action from 0.6.4 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
• 8eacaa5 README: bump pins (#167)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head 071c5207d3abd212dac3e942c13bb20f399311c9) · Confidence: Medium

Single-line pin bump of zizmorcore/zizmor-action (CI-only scanner) from 0.6.4 to 0.7.1; the action's inputs, defaults, and behavior at the call site are unchanged, and the round-trip probe confirms zizmor 1.31.1 runs clean on this repo's single workflow. Safe to merge.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
check-workflows emits SARIF to GitHub code scanning	Partially verified	Emission side line-traced in action.yml at the new pin; job holds security-events: write; probe: pass covers the run
CI check-workflows job enforces zizmor audit results on PRs	Verified	action.yml at both pins shows defaults unchanged; no with: inputs at call site

Compatibility analysis — 1 package

• zizmorcore/zizmor-action 0.6.4 → 0.7.1: Non-breaking: zizmor is now installed from hash-verified wheels instead of a digest-pinned Docker image; action inputs, defaults, and exit handling are unchanged. Internal SARIF uploader pin moved v4.37.9 → v4.38.2. Default zizmor engine is now 1.31.1; upstream changes are audit enhancements and false-positive fixes, none touching this repo's usage.

Usage of 1 dependency

• zizmorcore/zizmor-action: .github/workflows/ci.yml:53 — single uses: in the check-workflows job, no with: inputs, so all defaults apply (advanced-security, online-audits, persona: regular).

Test coverage

• Thin: planner-suite and auth-suite are application tests (Node/Better Auth) and cannot exercise this CI-only dependency.
• Strong: the round-trip probe exercises the workflow path with the new pin and passed, confirming zizmor 1.31.1 raises no failing findings on this repo's single workflow.
• Gap: no in-repo test harness exists for the check-workflows job; the probe is the only guard.

Calibration and confidence

Confidence: Medium — The pin bump itself is low-risk: defaults unchanged, one default-only call site, probe passed. Capped at Medium because the code-scanning ingestion side of the SARIF contract cannot be verified locally and rests on the probe pass.

1. Weakest claim: That the probe exercised the same default configuration CI will use, including the SARIF upload step; a probe run with SARIF upload skipped would soften that confirmation.
2. Relied on but unverified: That zizmor 1.31.1's stricter audits (dangerous-triggers precision, self-hosted-runner precision) produce no new findings on ci.yml — inferred from the probe pass and from ci.yml using only the pull_request trigger plus SHA-pinned actions, not from reading the audit code paths.
3. Falsifier: The check-workflows job failing or emitting new code-scanning alerts after merge would disprove this verdict.