From 2cbfb2b7e3af6a13ed913c354d902cff07cdea49 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Jul 2025 01:42:06 +0000 Subject: [PATCH 1/2] Bump github/codeql-action from 3.29.1 to 3.29.2 in the actions group Bumps the actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action). Updates `github/codeql-action` from 3.29.1 to 3.29.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/39edc492dbe16b1465b0cafca41432d857bdb31a...181d5eefc20863364f96762470ba6f862bdef56b) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.29.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql-actions.yml | 4 ++-- .github/workflows/codeql-python.yml | 4 ++-- .github/workflows/zizmor.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql-actions.yml b/.github/workflows/codeql-actions.yml index 3f8789b57..ca4f41a38 100644 --- a/.github/workflows/codeql-actions.yml +++ b/.github/workflows/codeql-actions.yml @@ -37,7 +37,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@39edc492dbe16b1465b0cafca41432d857bdb31a # v3 + uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3 with: languages: actions build-mode: none @@ -45,6 +45,6 @@ jobs: queries: security-extended - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@39edc492dbe16b1465b0cafca41432d857bdb31a # v3 + uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3 with: category: "/language:actions" diff --git a/.github/workflows/codeql-python.yml b/.github/workflows/codeql-python.yml index 1eba2ae0d..25f726190 100644 --- a/.github/workflows/codeql-python.yml +++ b/.github/workflows/codeql-python.yml @@ -42,7 +42,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@39edc492dbe16b1465b0cafca41432d857bdb31a # v3 + uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3 with: languages: python build-mode: none @@ -61,6 +61,6 @@ jobs: pip install dist/*.whl - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@39edc492dbe16b1465b0cafca41432d857bdb31a # v3 + uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3 with: category: "/language:python" diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 823fb4801..f9b210a5f 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -27,7 +27,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@39edc492dbe16b1465b0cafca41432d857bdb31a # v3 + uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3 with: sarif_file: results.sarif category: zizmor From ae64738f3efebb56a3456901b0c0e542f1284e02 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Mon, 7 Jul 2025 07:16:34 -0500 Subject: [PATCH 2/2] use github action for zizmor --- .github/workflows/zizmor.yml | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index f9b210a5f..92837fcc9 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -9,7 +9,6 @@ on: jobs: zizmor: name: zizmor latest via Cargo - if: github.repository_owner == 'mongodb' runs-on: ubuntu-latest permissions: security-events: write @@ -18,16 +17,5 @@ jobs: uses: actions/checkout@v4 with: persist-credentials: false - - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@fb51252c7ba57d633bc668f941da052e410add48 # v1 - - name: Get zizmor - run: cargo install zizmor - name: Run zizmor - run: zizmor --format sarif . > results.sarif - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3 - with: - sarif_file: results.sarif - category: zizmor + uses: zizmorcore/zizmor-action@1c7106082dbc1753372e3924b7da1b9417011a21 \ No newline at end of file