Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

• Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)
  Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#2256)

• The forbidden-uses audit now supports pre-commit config inputs (#2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#2272)

• The ref-confusion audit now supports pre-commit config inputs (#2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)

• The archived-uses audit now detects several more archived repositories (#2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a .pre-commit-config.yml input containing a prek-specific builtin section (#2259)

• Fixed a bug where the unpinned-uses audit would fail to honor ignore comments within the same step scope (#2289)

• Fixed a bug where zizmor would reject a dependabot.yml containing a goproxy-server registry definition (#2300)

• Fixed a bug where zizmor would reject pre-commit configurations containing prek-specific glob patterns in files or exclude (#2308)

• Fixed a handful of unsound patch bugs when performing YAML add and/or replace operations (#2295)

  Many thanks to @dmbuil for proposing and implementing this improvement!

• Fixed a bug where the cache-poisoning audit would incorrectly flag newer astral-sh/setup-uv versions that disable caching behavior automatically (#2330)

• Fixed a bug where the ref-version-mismatch audit would produce a misleading diagnostic when an action has overlapping branch and tag names (#2337)

• Fixed a bug where the artipacked audit would incorrectly flag the with: clauses of unrelated actions (#2339)

• Fixed a class of bugs where zizmor would incorrectly match an action's commit to a sibling action's tag (#2247)

  Many thanks to @potiuk for proposing and implementing this improvement!

• Fixed a bug where zizmor would crash on deeply nested GitHub Actions expressions (#2349)

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

New Features 🌈🔗

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153)
  Enhancements 🌱🔗

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛🔗

• Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#2157)

• Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#2177)

• Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#2185)

This is a small corrective release for 1.26.0.

New Features 🌈🔗

• New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#1985)

  Many thanks to @andrew for proposing and implementing this improvement!

• New audit: unsound-ternary detects pseudo-ternary expressions that don't evaluate as expected (#2085)

  Many thanks to @terror for proposing and implementing this improvement!

• New audit: adhoc-packages detects run: steps that install packages in an ad-hoc manner (#2061)

  Many thanks to @connorshea for proposing and implementing this improvement!

Enhancements 🌱🔗

• The cache-poisoning audit now detects additional cache disablement heuristics (#2053)

• The known-vulnerable-actions audit is now configurable. See the configuration documentation for details (#2084)

• The excessive-permissions audit is now aware of the code-quality permission (#2088)

• The unpinned-uses audit's auto-fix now uses the fully qualified version tag (e.g. # v6.0.2) when fixing a major-version ref (e.g. @v6) (#2127)

Performance Improvements 🚄🔗

• Most online audits are significantly faster, thanks to more precise retry handling (#2036)
  Bug Fixes 🐛🔗

• Fixed a bug where zizmor's LSP would not recognize dependabot.yaml files in its default configuration (#2026)

  Many thanks to @fionn for implementing this fix!

• Fixed a bug where ref-version-mismatch would fail to fully match some version comments (#2040)

• Fixed a bug where dependabot-cooldown would fail to honor the user's configured days when performing autofixes (#2055)

• Steps and jobs gated by statically-false if: conditions (e.g. if: false, if: ${{ false }}) are now skipped during auditing, since they cannot execute (#2059, #2069)

• Fixed a bug where ref-version-mismatch would fail to identify some valid version comments (#2073)

• Fixed a bug where unpinned-images would incorrectly flag empty matrix expansions as unpinned container image references (#2102)

• Fixed a bug where unpinned-images would incorrectly flag some matrix expansions as unpinned (#2098)

• The SARIF (--format=sarif) and GitHub Annotations (--format=github) output formats now provide more correct/useful paths, particularly when the user provides a relative path as input to zizmor rather than zizmor . (#1748, #2095)

Changes ⚠️🔗

• The impostor-commit audit no longer suggests auto-fixes, to avoid incorrectly minimizing the amount of manual remediation work needed (#2054)

• The JSON and SARIF outputs no longer contain a misleading prefix key (#2095)

Bug Fixes 🐛🔗

• Fixed a bug where the unpinned-tools audit would incorrectly flag the aquasecurity/trivy-action action as installing an unpinned tool version, rather than aquasecurity/setup-trivy (#2018)

Bug Fixes 🐛🔗

• Fixed a bug where the cache-poisoning audit would fail to consider release events as exempt from cache usage findings when filtered by a tag condition (#2004)

• Fixed a typo when suggesting --fix flags for findings (#2010)

  Many thanks to @0xdea for implementing this fix!

• Fixed a typo in unpinned-tools annotations (#2008)

  Many thanks to @martincostello for implementing this fix!

• Fixed a bug where the github-app audit would incorrectly flag some safe uses of actions/create-github-app-token as unsafe (#2011)