[dependabot]

Bumps the ci-tools group with 2 updates in the /ci/tools directory: actionlint-py and zizmor.

Updates actionlint-py from 1.7.12.24 to 1.7.12.25

Commits

• 805f85e Increment build system version
• 299f60d Increment build system version to 1.7.12.24
• fd726fd Retry download file (#40)
• See full diff in compare view

Updates zizmor from 1.26.1 to 1.30.1

Release notes

Sourced from zizmor's releases.

v1.30.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

• Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

v1.30.0

Sponsorship is appreciated!

New Features 🌈🔗

• New audit: self-repository detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271) Enhancements 🌱🔗

• The impostor-commit audit now supports pre-commit config inputs (#2256)

• The forbidden-uses audit now supports pre-commit config inputs (#2263)

• The adhoc-packages audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The archived-uses audit now supports pre-commit config inputs (#2272)

• The ref-confusion audit now supports pre-commit config inputs (#2274)

• The cache-poisoning audit now produces more detailed and more precise diagnostics (#2330)

• The cache-poisoning audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The unpinned-tools audit now produces more detailed and more precise diagnostics (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-just (#2339)

• The unpinned-tools audit now detects usages of extractions/setup-crate (#2340)

• The archived-uses audit now detects several more archived repositories (#2340)

• The ref-version-mismatch audit now supports uses: that reference reusable workflows (#2344)

• The stale-action-refs audit now supports uses: that reference reusable workflows (#2345)

Bug Fixes 🐛🔗

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.30.1

Bug Fixes 🐛

• Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

• Fixed a bug where [self-repository] auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

1.30.0

New Features 🌈

• New audit: [self-repository] detects usages of the old "workspace-relative" form for local reusable workflows and actions and recommends the new "self-repository" form instead (#2271)

Enhancements 🌱

• The [impostor-commit] audit now supports pre-commit config inputs (#2256)

• The [forbidden-uses] audit now supports pre-commit config inputs (#2263)

• The [adhoc-packages] audit now detects more ad-hoc package management patterns, including bundle add and yarn add

  Many thanks to @​connorshea for proposing and implementing this enhancement!

• The [archived-uses] audit now supports pre-commit config inputs (#2272)

• The [ref-confusion] audit now supports pre-commit config inputs (#2274)

• The [cache-poisoning] audit now produces more detailed and more precise diagnostics (#2330)

• The [cache-poisoning] audit now handles and exposes auto-fixes in a more general manner (#2332)

• zizmor now recognizes @​sethvargo/ratchet version comments when evaluating ref pinning (#2319)

  Many thanks to @​njgudman for proposing and implementing this enhancement!

• The [unpinned-tools] audit now produces more detailed and more precise diagnostics (#2339)

• The [unpinned-tools] audit now detects usages of @​extractions/setup-just (#2339)

• The [unpinned-tools] audit now detects usages of @​extractions/setup-crate (#2340)

• The [archived-uses] audit now detects several more archived repositories (#2340)

• The [ref-version-mismatch] audit now supports #!yaml uses: that reference

... (truncated)

Commits

• 99a054e zizmor 1.30.1 (#2375)
• f8be5a2 docs: bump GHA pins (#2374)
• efdff0a Mark self-repository fixes as unsafe (#2373)
• 4cdfcca chore(deps): bump the cargo group with 3 updates (#2355)
• df617de Handle .git URLs correctly (#2363)
• 0500d71 chore(deps): bump the github-actions group with 3 updates (#2356)
• aebd747 chore(deps-dev): bump zensical from 0.0.53 to 0.0.57 in the uv group (#2357)
• f6d7aa6 docs: Add instructions for Sublime Text (#2354)
• 5526208 Fix typo spelling error in audits docs (#2360)
• 8d529fe docs: bump version (#2352)
• Additional commits viewable in compare view