Skip to content

Introduce zizmor#1832

Merged
Viicos merged 1 commit intomainfrom
vp/zizmor
Apr 3, 2026
Merged

Introduce zizmor#1832
Viicos merged 1 commit intomainfrom
vp/zizmor

Conversation

@Viicos
Copy link
Copy Markdown
Member

@Viicos Viicos commented Apr 3, 2026

No description provided.

@cloudflare-workers-and-pages
Copy link
Copy Markdown

Deploying logfire-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 3a7e597
Status: ✅  Deploy successful!
Preview URL: https://17e4a788.logfire-docs.pages.dev
Branch Preview URL: https://vp-zizmor.logfire-docs.pages.dev

View logs

Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 2 potential issues.

View 3 additional findings in Devin Review.

Open in Devin Review

Comment thread .github/workflows/weekly_deps_test.yml
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: "23"
package-manager-cache: true # zizmor: ignore[cache-poisoning] -- Job does not produce release artifacts and does not have sensitive permissions
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚩 New package-manager-cache input for setup-node added without root lockfile

The test-pyodide job adds package-manager-cache: true to actions/setup-node (.github/workflows/main.yml:192). This appears to be a renamed/new input in setup-node v6 (the old v4 used cache: 'npm'). The repo has a package-lock.json only in ./pyodide_test/, not at the root. If v6's auto-detection doesn't find the lockfile, caching may silently be skipped or produce a warning. This is non-critical since make test-pyodide runs cd pyodide_test && npm install which handles its own dependencies.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@Viicos Viicos merged commit 3efe5a2 into main Apr 3, 2026
20 checks passed
@Viicos Viicos deleted the vp/zizmor branch April 3, 2026 20:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant