Skip to content

Add zizmor CI #7463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 10 commits into from
Mar 20, 2026
Merged

Add zizmor CI #7463

Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
ee43719
Add zizmor CI
ShaharNaveh Mar 18, 2026
dd0f9d2
Update .github/workflows/ci.yaml
ShaharNaveh Mar 18, 2026
403175d
Fix dup
ShaharNaveh Mar 18, 2026
e3a74cb
Fix indent
ShaharNaveh Mar 18, 2026
bddae92
Merge remote-tracking branch 'upstream/main' into zizmor
ShaharNaveh Mar 19, 2026
700e0d4
Always run zizmor
ShaharNaveh Mar 19, 2026
baaf1d7
Merge remote-tracking branch 'upstream/main' into zizmor
ShaharNaveh Mar 19, 2026
7c86e58
Remove dynamic `with` for zizmor
ShaharNaveh Mar 19, 2026
6f544f3
Merge remote-tracking branch 'upstream/main' into zizmor
ShaharNaveh Mar 20, 2026
1dbf912
Bump action version
ShaharNaveh Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,12 @@

- name: Install dependencies
uses: ./.github/actions/install-linux-deps
with: ${{ matrix.dependencies || fromJSON('{}') }}
# zizmor has an issue with dynamic `with`
# with: ${{ matrix.dependencies || fromJSON('{}') }}
with:
gcc-multilib: ${{ matrix.dependencies.gcc-multilib || false }}
musl-tools: ${{ matrix.dependencies.musl-tools || false }}
gcc-aarch64-linux-gnu: ${{ matrix.dependencies.gcc-aarch64-linux-gnu || false }}

- uses: dtolnay/rust-toolchain@stable
with:
Expand Down Expand Up @@ -321,7 +326,7 @@

- name: run cpython tests to check if env polluters have stopped polluting
shell: bash
run: |

Check warning on line 329 in .github/workflows/ci.yaml

View workflow job for this annotation

GitHub Actions / format_check 

[actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:16:10: Double quote to prevent globbing and word splitting [shellcheck]

Raw Output:
i:.github/workflows/ci.yaml:329:9: shellcheck reported issue in this script: SC2086:info:16:10: Double quote to prevent globbing and word splitting [shellcheck]

Check warning on line 329 in .github/workflows/ci.yaml

View workflow job for this annotation

GitHub Actions / format_check 

[actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:12:8: Double quote to prevent globbing and word splitting [shellcheck]

Raw Output:
i:.github/workflows/ci.yaml:329:9: shellcheck reported issue in this script: SC2086:info:12:8: Double quote to prevent globbing and word splitting [shellcheck]
for thing in ${{ join(matrix.env_polluting_tests, ' ') }}; do
for i in $(seq 1 10); do
set +e
Expand Down Expand Up @@ -554,9 +559,9 @@
- name: build rustpython
run: cargo build --release --target wasm32-wasip1 --features freeze-stdlib,stdlib --verbose
- name: run snippets
run: wasmer run --dir $(pwd) target/wasm32-wasip1/release/rustpython.wasm -- "$(pwd)/extra_tests/snippets/stdlib_random.py"

Check warning on line 562 in .github/workflows/ci.yaml

View workflow job for this annotation

GitHub Actions / format_check 

[actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2046:warning:1:18: Quote this to prevent word splitting [shellcheck]

Raw Output:
w:.github/workflows/ci.yaml:562:9: shellcheck reported issue in this script: SC2046:warning:1:18: Quote this to prevent word splitting [shellcheck]
- name: run cpython unittest
run: wasmer run --dir $(pwd) target/wasm32-wasip1/release/rustpython.wasm -- "$(pwd)/Lib/test/test_int.py"

Check warning on line 564 in .github/workflows/ci.yaml

View workflow job for this annotation

GitHub Actions / format_check 

[actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2046:warning:1:18: Quote this to prevent word splitting [shellcheck]

Raw Output:
w:.github/workflows/ci.yaml:564:9: shellcheck reported issue in this script: SC2046:warning:1:18: Quote this to prevent word splitting [shellcheck]

cargo-shear:
name: cargo shear
Expand All @@ -571,3 +576,15 @@
- run: cargo binstall --no-confirm cargo-shear

- run: cargo shear

security-lint:
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false

- name: Run zizmor
uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
Loading