From dfd2dd2bca5d354f4a0d44b193aa6288b61fb319 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 20 Aug 2026 03:08:26 -0700 Subject: [PATCH] Bump actionlint and zizmor-action to current releases (#250) Dependabot version updates are disabled for this repo, so the weekly github-actions group never proposed these. The pins had been frozen since March: zizmor-action v0.5.2 ships zizmor 1.23.1, which flags secrets-outside-env at the default persona -- that moved to the auditor persona in zizmor 1.24.0. v0.6.2 ships zizmor 1.29.0. Both linters pass locally at the new versions. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a3ed857..babda7d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -60,10 +60,10 @@ jobs: persist-credentials: false - name: Run actionlint - uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11 + uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 - name: Run zizmor - uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 with: advanced-security: false