🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

manifest="$(mktemp)"
trap 'rm -f "$manifest"' EXIT

curl -fsSL \
  'https://raw.githubusercontent.com/zizmorcore/zizmor-pre-commit/v1.29.0/.pre-commit-hooks.yaml' \
  > "$manifest"

grep -n '^files:' "$manifest"
if grep -Eq '\.pre-commit-config\.ya?ml' "$manifest"; then
  echo "The upstream hook now includes pre-commit configuration files."
  exit 1
fi

Repository: cpplint/cpplint

Length of output: 153

🏁 Script executed:

set -u

echo '--- local configuration ---'
sed -n '65,90p' .pre-commit-config.yaml

echo '--- upstream hook manifest ---'
curl -fsSL \
  'https://raw.githubusercontent.com/zizmorcore/zizmor-pre-commit/v1.29.0/.pre-commit-hooks.yaml' \
  | sed -n '1,120p'

Repository: cpplint/cpplint

Length of output: 884

🌐 Web query:

zizmor v1.29.0 supported file types .pre-commit-config.yaml

💡 Result:

In zizmor v1.29.0, experimental support was added for auditing pre-commit inputs, specifically including.pre-commit-config.yaml files and hook definitions [1][2]. When running zizmor, it can automatically infer the input type—such as a workflow, action, Dependabot configuration, or a pre-commit configuration—when reading from standard input [3]. For local directories or repositories, zizmor identifies and collects these auditable inputs automatically, and users can explicitly target or filter these inputs using the --collect=pre-commit option [3]. It is important to distinguish between using zizmor to audit a.pre-commit-config.yaml file and using zizmor itself as a hook within a.pre-commit-config.yaml file. The former refers to zizmor's new ability to analyze the security of pre-commit configurations [1][2], while the latter is a well-established integration where zizmor is installed as a hook in a repository's.pre-commit-config.yaml to run security audits on GitHub Actions workflows [4][5].

Citations:

• 1: https://newreleases.io/project/github/zizmorcore/zizmor/release/v1.29.0
• 2: https://docs.zizmor.sh/release-notes/
• 3: https://docs.zizmor.sh/usage/
• 4: https://docs.zizmor.sh/integrations/
• 5: https://github.com/zizmorcore/zizmor-pre-commit

🏁 Script executed:

set -u

echo '--- v1.29.0 release note ---'
curl -fsSL 'https://raw.githubusercontent.com/zizmorcore/zizmor/v1.29.0/CHANGELOG.md' \
  | grep -in -A8 -B4 'pre-commit' || true

echo '--- usage documentation references ---'
for url in \
  'https://raw.githubusercontent.com/zizmorcore/zizmor/v1.29.0/docs/usage.md' \
  'https://raw.githubusercontent.com/zizmorcore/zizmor/v1.29.0/docs/integrations.md'
do
  echo "URL: $url"
  curl -fsSL "$url" | grep -in -A5 -B5 'pre-commit' || true
done

echo '--- proposed file pattern behavior ---'
python3 - <<'PY'
import re
pattern = r'^(\.github/(workflows/.*|dependabot\.ya?ml)|(?:.*/)?action\.ya?ml|\.pre-commit-config\.ya?ml)$'
for path in [
    ".pre-commit-config.yaml",
    ".github/workflows/ci.yml",
    ".github/dependabot.yml",
    "sub/action.yaml",
    "action.yml",
    ".github/actions/action.yml",
    "README.md",
]:
    print(f"{path}: {bool(re.fullmatch(pattern, path))}")
PY

Repository: cpplint/cpplint

Length of output: 2941

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- zizmor.yml ---'
cat -n zizmor.yml

printf '%s\n' '--- zizmor hook ---'
sed -n '65,90p' .pre-commit-config.yaml

printf '%s\n' '--- local zizmor references ---'
rg -n -i 'excessive-permissions|zizmor' . --glob '!node_modules' --glob '!dist' --glob '!build' | head -200

Repository: cpplint/cpplint

Length of output: 687

🌐 Web query:

zizmor v1.29.0 configuration rules disable excessive-permissions audit documentation

💡 Result:

In zizmor v1.29.0, you can disable the excessive-permissions audit by modifying your zizmor configuration file (typically zizmor.yml) to set the disable property to true for that specific rule [1][2]. To disable the audit, add the following to your configuration file: rules: excessive-permissions: disable: true The zizmor documentation emphasizes that disabling audits should be used as a measure of last resort, as disabled rules will not appear in ignored or suppressed finding counts, which may lead to missing important future findings [1][2]. Before disabling the audit entirely, the developers recommend considering these alternatives [1][2]: 1. Ignoring specific findings using the rules..ignore configuration [1][2]. 2. Adjusting your persona (e.g., removing --persona=pedantic or --persona=auditor) if you are currently using a more sensitive persona [1][2]. Configuration files can be placed where zizmor discovers them automatically or passed explicitly using the --config flag or the ZIZMOR_CONFIG environment variable [3][4].

Citations:

• 1: https://docs.zizmor.sh/configuration/
• 2: https://github.com/zizmorcore/zizmor/blob/main/docs/configuration.md
• 3: https://docs.zizmor.sh/usage/
• 4: https://github.com/zizmorcore/zizmor/blob/main/docs/usage.md