Development record
The scaffolded release workflows' in-repo audit covers injection and duplicate keys for every profile, but it is not a full zizmor stand-in for the bare profile: action pinning, permissions and credential classes are unchecked there, and only the abcd profile is zizmor-audited in CI. Follow-up: run zizmor over a rendered bare profile in CI.
issueresolvedminoriss-2609251939472371
The scaffolded release workflows' in-repo audit covers injection and duplicate keys for every profile, but it is not a full zizmor stand-in for the bare profile: action pinning, permissions and credential classes are unchecked there, and only the abcd profile is zizmor-audited in CI. Follow-up: run zizmor over a rendered bare profile in CI.
Grounds
- pursued: a pinning, permission or credential defect in a non-abcd profile now fails CI's zizmor job; shown wrong if a profile template regresses on one of those audits and the job stays green
Frontmatter
| id | iss-2609251939472371 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609251939472371-the-scaffolded-release-workflows-in-repo.md
open on GitHub ↗ · commit history ↗