From 65216a18cf5e0f10b5e27618de6a10089d962b1a Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Sat, 22 Aug 2026 07:09:33 +0200 Subject: [PATCH] Name the leg that reads the shell, in the audit that says nothing does The header of the workflow audit tells a reader what that audit does not reach. It counted the tracked shell scripts and said no analyser for their language is configured anywhere in this tree. A check that reads exactly that language landed on main and this header did not move with it, so somebody opening the workflow that audits the workflows read that the shell here is unanalysed and closed the file wrong about the gate they were checking. The count is gone rather than corrected, because the next script to land would break it again. The sentence about the absence names the workflow that ended it, and what of that issue is still open is stated so the pointer does not read as closed either. Closes #172 Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- .github/workflows/zizmor.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 0467ea8..4ed64e2 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -3,9 +3,16 @@ # audited like any other code. # # It is not everything this repository executes, and this audit does not reach the -# rest. Two tracked shell scripts carry the rules of the document check and the -# hygiene check, a workflow runs each of them on a pull request, and no analyser -# for their language is configured anywhere in this tree. #81 holds that gap. +# rest. Tracked shell scripts carry the rules of the document check and the hygiene +# check, and a workflow runs each of them on a pull request. Their language is read +# by .github/workflows/shell-analysis.yml, which landed under #81 and is a separate +# leg rather than a setting here: putting a second analyser over the workflow YAML +# this one already reads is an argument nobody has made. +# +# What #81 still holds is the analysis over the core's own language, which waits on +# #11 because no code is in this tree, and an upload of the shell findings to the +# code-scanning tab, which that leg does not do. How many shell scripts there are +# moves whenever one lands, so it is not counted here. # # The gate runs zizmor's regular persona at --min-severity=low: it fails the # build on any actionable (low/medium/high/critical) security finding -