[release-24.0] Add zizmor check to the static checks workflow (#19149) - #20811
Draft
vitess-bot[bot] wants to merge 1 commit into
Draft
[release-24.0] Add zizmor check to the static checks workflow (#19149)#20811vitess-bot[bot] wants to merge 1 commit into
zizmor check to the static checks workflow (#19149)#20811vitess-bot[bot] wants to merge 1 commit into
Conversation
vitess-bot
Bot
added
Component: Build/CI
Backport
Contributor
Author
|
Hello @arthurschreiber, there are conflicts in this backport. Please address them in order to merge this Pull Request. You can execute the snippet below to reset your branch and resolve the conflict manually. Make sure you replace |
vitess-bot
Bot
requested review from
arthurschreiber,
frouioui and
rohit-nayak-ps
August 5, 2026 18:32
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
This PR appears to integrate zizmor workflow scanning and add inline zizmor: ignore[...] annotations to reduce false positives, while updating GitHub Actions usage.
Changes:
- Adds a
zizmorcheck step to the static checks workflow. - Adds
zizmor: ignore[...]annotations to selected workflow triggers/steps. - Updates
actions/setup-node/actions/cacheusage in workflows (but currently with unresolved merge conflicts).
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/vtadmin_web_unit_tests.yml | Updates Node setup step; currently contains merge-conflict markers. |
| .github/workflows/vtadmin_web_lint.yml | Updates Node setup step; currently contains merge-conflict markers. |
| .github/workflows/vtadmin_web_build.yml | Updates Node setup step; currently contains merge-conflict markers. |
| .github/workflows/static_checks_etc.yml | Adds zizmor action step; Node setup update currently contains merge-conflict markers. |
| .github/workflows/pr_opened_tasks.yml | Adds zizmor ignore annotation for pull_request_target. |
| .github/workflows/cluster_endtoend.yml | Adds zizmor ignore annotation for cache step; currently contains merge-conflict markers. |
| .github/workflows/check_make_vtadmin_web_proto.yml | Updates Node setup step; currently contains merge-conflict markers. |
| .github/workflows/assign_milestone.yml | Adds zizmor ignore annotation for pull_request_target. |
| .github/workflows/arewefastyet_comment.yml | Adds zizmor ignore annotation for pull_request_target. |
Comment on lines
+40
to
+46
| <<<<<<< HEAD | ||
| - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | ||
| ||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| ======= | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts | ||
| >>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) |
Comment on lines
+45
to
+51
| <<<<<<< HEAD | ||
| - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | ||
| ||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| ======= | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts | ||
| >>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) |
Comment on lines
+45
to
+51
| <<<<<<< HEAD | ||
| - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | ||
| ||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| ======= | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts | ||
| >>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) |
Comment on lines
+225
to
+231
| <<<<<<< HEAD | ||
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | ||
| ||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| ======= | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts | ||
| >>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) |
Comment on lines
+185
to
+206
| <<<<<<< HEAD | ||
| ||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) | ||
| # 'consul' is the only need that triggers `make tools`, which installs both Consul and ZooKeeper. | ||
| # There is no separate 'zookeeper' need, so 'consul' is the correct proxy for "this shard needs ZooKeeper". | ||
| - name: Cache ZooKeeper | ||
| if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'consul') | ||
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | ||
| with: | ||
| path: dist/vt-zookeeper-* | ||
| key: zookeeper-${{ hashFiles('build.env', 'bootstrap.sh') }} | ||
|
|
||
| ======= | ||
| # 'consul' is the only need that triggers `make tools`, which installs both Consul and ZooKeeper. | ||
| # There is no separate 'zookeeper' need, so 'consul' is the correct proxy for "this shard needs ZooKeeper". | ||
| - name: Cache ZooKeeper | ||
| if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'consul') | ||
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts | ||
| with: | ||
| path: dist/vt-zookeeper-* | ||
| key: zookeeper-${{ hashFiles('build.env', 'bootstrap.sh') }} | ||
|
|
||
| >>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) |
Comment on lines
+67
to
+73
| <<<<<<< HEAD | ||
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | ||
| ||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| ======= | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts | ||
| >>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149)) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This is a backport of #19149