ci: zizmor workflow#52362
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
| name: zizmor | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} |
There was a problem hiding this comment.
no it should be pr number only when workflows have a pull_request_target trigger
There was a problem hiding this comment.
Oh! For others it won't work to use it? (was wondering if we could/should use a uniform approach)
There was a problem hiding this comment.
Yes pull_request_target is a special trigger that always run on default branch
| name: Get base ref | ||
| id: base-ref | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 |
There was a problem hiding this comment.
Ah! I need this on docker/cli as well; I was hoping dependabot would update my comments to use the full version, but it .. doesn't; docker/cli#6923 (comment)
There was a problem hiding this comment.
Yes should always be the canonical ref otherwise it reports one of:
adf28d1 to
3c78508
Compare
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
9433bef to
5cdd48e
Compare
| # ┌───────────── minute (0 - 59) | ||
| # │ ┌───────────── hour (0 - 23) | ||
| # │ │ ┌───────────── day of the month (1 - 31) | ||
| # │ │ │ ┌───────────── month (1 - 12) | ||
| # │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday) | ||
| # │ │ │ │ │ | ||
| # │ │ │ │ │ | ||
| # │ │ │ │ │ | ||
| # * * * * * |
There was a problem hiding this comment.
Can we keep this one? Saves me a trip to <wherever> because I always forget the columns used 😂
There was a problem hiding this comment.
Usually your favorite IDE highlights it
There was a problem hiding this comment.
Heh, yeah, possibly; then again, I may look at these on GitHub to check what's in them, and not necessarily editing.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
|
Failures are unrelated |
similar to moby/buildkit#6623
see fixed alerts in https://github.com/moby/moby/security/code-scanning?query=pr%3A52362+is%3Aclosed