ci: pin lint tools and drop unused deploy context input - #1
Merged
Merged
Conversation
The lint job couldn't start because zizmor-action was still referenced by a placeholder, and org policy only allows actions pinned to a full commit SHA. Pin zizmor-action to v0.6.4 and the actionlint image to 1.7.12 by digest.
zizmor flags passing a workflow input straight into build-push-action's context as template injection. Nothing sets the input, so build from the repo root instead. Callers see no change, since the default was already ".".
MarshallOfSound
changed the title
MarshallOfSound
enabled auto-merge (squash)
September 26, 2026 01:30
codebytere
approved these changes
Sep 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI on main can't start because
zizmorcore/zizmor-action@<pin-me>isn't a SHA and org policy rejects anything unpinned. This pins zizmor-action to v0.6.4 and the actionlint image to 1.7.12 by its multi-arch digest.Also drops the
contextinput from the deploy workflow. The org zizmor check flagscontext: ${{ inputs.context }}on build-push-action as template injection, and nothing sets it anyway, so it now just builds from the repo root (same as the old default).Clean locally with actionlint 1.7.12 and zizmor 1.23.1 (the org's config) and 1.24.1.