Fix misplaced zizmor ignore comment in GHES host step generator by Copilot · Pull Request #39740 · github/gh-aw

Copilot · 2026-06-17T06:30:57Z

The # zizmor: ignore[github-env] annotation emitted by generateGHESHostConfigurationStep() was placed as a standalone YAML comment on the line above run:. Per zizmor's span-based matching, this comment is outside the block scalar span that owns the github-env finding, so suppression silently never took effect — causing the High to persist in every compiled workflow that includes the GHES host step.

Changes

pkg/workflow/ghes_host_step.go — Move annotation from a sibling comment line to inline on run: |, placing it within the span zizmor associates with the finding:

# Before (broken — outside the span):
        # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.
        run: |

# After (correct — on the run: line, inside the span):
        run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.

pkg/workflow/ghes_host_step_test.go — Tighten assertion from Contains(step, "zizmor: ignore[github-env]") to Contains(step, "run: | # zizmor: ignore[github-env]"), so placement is validated, not just presence.
249 .lock.yml files — Recompiled; all now emit the annotation on the correct line.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-06-17T06:40:01Z

Hey @copilot-swe-agent 👋 — nice work picking up the zizmor ignore-comment placement bug in pkg/workflow/ghes_host_step.go. Moving the suppression onto run: | itself is exactly the right fix. A couple of things to address before this is ready to merge:

Add / strengthen the test — the PR body already identifies the gap: the existing test in pkg/workflow/ghes_host_step_test.go only asserts the comment string is present, not that it lands on the run: line. Add an assertion that checks the comment appears on the same line as run:, not on a preceding sibling line. Bonus: actually run zizmor against the generated YAML in CI to catch this class of regression.
Sweep other generators — grep pkg/workflow/ for # zizmor: ignore[ hits that appear on a line above a run: key; if any are found, fix them in the same PR and add test coverage for each.

If you'd like a hand, you can assign this prompt to your coding agent:

In pkg/workflow/ghes_host_step.go, move the `# zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.` comment so it appears on the `run: |` line itself (i.e. `run: | # zizmor: ignore[github-env] - ...`) rather than on the preceding YAML key.

Then update pkg/workflow/ghes_host_step_test.go to assert that the comment appears on the same line as `run:` (not on a standalone line above it).

Finally, grep pkg/workflow/ for any other `# zizmor: ignore[` occurrences that are emitted on a YAML line that is a sibling of `run:` or `uses:` rather than inline with it. Fix each one found and add corresponding test assertions.

Generated by ✅ Contribution Check · ◷

…ock files Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-06-17T12:07:33Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #39740 does not have the 'implementation' label and has only 2 new lines of code in business logic directories (≤100 threshold).

github-actions · 2026-06-17T12:07:39Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-06-17T12:07:49Z

✅ PR Code Quality Reviewer completed the code quality review.

github-actions · 2026-06-17T12:07:50Z

✅ Test Quality Sentinel completed test quality analysis.

Copilot

⚠️ Not ready to approve

The lockfile regeneration includes additional semantic diffs (e.g., validation schema changes like optionalPositiveInteger → issueOrPRNumber) that aren’t explained by the stated zizmor-suppression fix and need confirmation or separation.

Pull request overview

This PR fixes the placement of the # zizmor: ignore[github-env] suppression associated with the GHES host configuration step so that zizmor’s span-based matching actually applies the suppression in compiled workflows.

Changes:

Updated generateGHESHostConfigurationStep() to emit the zizmor suppression inline on the run: | line (instead of as a sibling YAML comment line).
Tightened the unit test to assert the suppression is specifically on the run: line.
Regenerated workflow lock files to propagate the corrected emitted YAML across compiled workflows.

File summaries

File	Description
pkg/workflow/ghes_host_step.go	Moves the zizmor ignore annotation onto the `run:
pkg/workflow/ghes_host_step_test.go	Updates the assertion to validate suppression placement (on `run:
.github/workflows/*.lock.yml (249 files)	Regenerated compiled workflows to reflect the updated GHES host step YAML output (and includes some additional regenerated content that should be confirmed as intended).

Copilot's findings

Files reviewed: 251/251 changed files
Comments generated: 2

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

                  "pull_request_number": {
-                    "optionalPositiveInteger": true
+                    "issueOrPRNumber": true
                  },


                  "pull_request_number": {
-                    "optionalPositiveInteger": true
+                    "issueOrPRNumber": true
                  },


github-actions · 2026-06-17T12:14:21Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 100/100 — Excellent

Analyzed 1 test: 1 design, 0 implementation, 0 guideline violation(s).

📊 Metrics & Test Classification (1 test analyzed)

Metric	Value
New/modified tests analyzed	1
✅ Design tests (behavioral contracts)	1 (100%)
⚠️ Implementation tests (low value)	0 (0%)
Tests with error/edge cases	1 (100%)
Duplicate test clusters	0
Test inflation detected	No
🚨 Coding-guideline violations	0

Test	File	Classification	Issues Detected
`TestGenerateGHESHostConfigurationStep`	`pkg/workflow/ghes_host_step_test.go:19`	✅ Design	—

Go: 1 (*_test.go); JavaScript: 0.

Verdict

✅ Check passed. 0% implementation tests (threshold: 30%). The updated assertion precisely captures the behavioral contract — the zizmor suppression comment must appear on the run: line itself, matching how zizmor associates findings with YAML spans. All assertions carry descriptive messages, build tag is present, no mocks used.

🧪 Test quality analysis by Test Quality Sentinel · ◷

github-actions

✅ Test Quality Sentinel: 100/100. Test quality is acceptable — 0% of new tests are implementation tests (threshold: 30%).

github-actions

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-06-17T12:16:38Z

        shell: bash
-        # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.
-        run: |
+        run: | # zizmor: ignore[github-env] - GITHUB_SERVER_URL is set by GitHub Actions, not user input.


[/diagnose] Correct placement — the inline # zizmor: ignore[github-env] on run: | puts the suppression annotation within the block scalar span that zizmor associates with the github-env finding. This is the right fix.

One small observation: zizmor runs only in the daily static-analysis-report workflow (scheduled), not as a PR gate. This means similar silent suppression regressions would go undetected until the next scheduled scan. Consider whether adding gh aw compile --zizmor (or a targeted zizmor invocation against a sample lock file) to the standard PR CI pipeline would be worthwhile to catch these sooner.

github-actions

✅ LGTM — correct fix, no blocking issues

The zizmor suppression was genuinely broken: a YAML comment on a sibling line above run: | is a separate AST node and lies outside the block scalar span that zizmor associates with the github-env finding. Moving the annotation inline onto run: | is the right fix.

Review summary

pkg/workflow/ghes_host_step.go — surgically correct. Two lines (standalone comment + plain run: |) replaced by one (run: | # zizmor: ignore[github-env] - ...). Block scalar content is unchanged.

pkg/workflow/ghes_host_step_test.go — the assertion tightening from Contains(step, "zizmor: ignore[github-env]") to Contains(step, "run: | # zizmor: ignore[github-env]") is strictly stronger; it now verifies placement, not just presence.

249 .lock.yml files — consistently regenerated; no residual standalone # zizmor: ignore[github-env] lines remain in the tree.

Non-blocking note: pkg/workflow/frontmatter_extraction_yaml.go and pkg/workflow/jobs.go still emit standalone # zizmor: ignore[dangerous-triggers] comments, but those are above workflow_run: and if: mapping keys respectively (not run: block scalars), making them a separate concern outside this PR's scope.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

Initial plan

22a7953

Copilot AI assigned Copilot and pelikhan Jun 17, 2026

Copilot started work on behalf of pelikhan June 17, 2026 06:31 View session

Initial plan for zizmor comment placement fix

f1bdacd

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fix zizmor ignore comment placement in ghes_host_step and recompile l…

930e4dc

…ock files Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix placement of zizmor ignore comments for generators~~ Fix misplaced zizmor ignore comment in GHES host step generator Jun 17, 2026

Copilot finished work on behalf of pelikhan June 17, 2026 06:43

Copilot AI requested a review from pelikhan June 17, 2026 06:43

This was referenced Jun 17, 2026

[aw] No-Op Runs #38951

Closed

[Contribution Check Report] Contribution Check — 2026-06-17 #39716

Closed

pelikhan marked this pull request as ready for review June 17, 2026 12:06

Copilot AI review requested due to automatic review settings June 17, 2026 12:06

Copilot started reviewing on behalf of pelikhan June 17, 2026 12:07 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

github-actions Bot approved these changes Jun 17, 2026

View reviewed changes

github-actions Bot reviewed Jun 17, 2026

View reviewed changes

github-actions Bot approved these changes Jun 17, 2026

View reviewed changes

pelikhan merged commit 7ce5300 into main Jun 17, 2026
79 of 90 checks passed

pelikhan deleted the copilot/fix-zizmor-ignore-comments-placement branch June 17, 2026 12:23

This was referenced Jun 17, 2026

Smoke Test: Claude - 27688866641 #39780

Closed

[team-status] Daily Status — June 17, 2026 #39786

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix misplaced zizmor ignore comment in GHES host step generator#39740

Fix misplaced zizmor ignore comment in GHES host step generator#39740
pelikhan merged 3 commits into
mainfrom
copilot/fix-zizmor-ignore-comments-placement

Copilot AI commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

Uh oh!

github-actions Bot Jun 17, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

⚠️ Not ready to approve

Copilot's findings

Uh oh!

github-actions Bot commented Jun 17, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

✅ LGTM — correct fix, no blocking issues

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading