From 67a20de0ad604357078e149ee6743895cd773761 Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:35:03 +0530 Subject: [PATCH 1/4] ci(security): resolve all remaining Zizmor alerts and add automated CodeRabbit reviews --- .github/workflows/dependabot-auto-merge.yml | 1 + .github/workflows/issue-labeler.yml | 4 ++-- .github/workflows/pr-metadata.yml | 2 +- .github/workflows/pull_request_label.yml | 8 ++++---- .github/workflows/release.yml | 2 +- 5 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 70dcf28..ee8ae81 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -16,6 +16,7 @@ name: Dependabot Auto-Merge on: + # zizmor: ignore[dangerous-triggers] Safe here: workflow has zero checkout steps and only evaluates dependabot metadata pull_request_target: types: [opened, synchronize, reopened] diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml index bea2bb5..388a88e 100644 --- a/.github/workflows/issue-labeler.yml +++ b/.github/workflows/issue-labeler.yml @@ -17,7 +17,7 @@ permissions: issues: write concurrency: - group: issue-metadata-${{ github.event.issue.number }} + group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }} cancel-in-progress: true jobs: @@ -31,7 +31,7 @@ jobs: persist-credentials: false - name: Classify, label, and assign issue - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0 + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 env: GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }} with: diff --git a/.github/workflows/pr-metadata.yml b/.github/workflows/pr-metadata.yml index a34a5b7..6a2c4b5 100644 --- a/.github/workflows/pr-metadata.yml +++ b/.github/workflows/pr-metadata.yml @@ -55,7 +55,7 @@ jobs: (github.event.check_suite.pull_requests[0] != null && github.event.check_suite.head_branch != 'main') steps: - name: Classify and update PR - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0 + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: script: | const SIZE_LABELS = ['size:XS', 'size:S', 'size:M', 'size:L', 'size:XL']; diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml index fe94dc6..652519e 100644 --- a/.github/workflows/pull_request_label.yml +++ b/.github/workflows/pull_request_label.yml @@ -26,9 +26,9 @@ jobs: repo-token: "${{ secrets.GITHUB_TOKEN }}" sync-labels: true - - name: Auto-trigger Sourcery review on PR update - if: github.event.action == 'synchronize' - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0 + - name: Auto-trigger AI reviews on PR update + if: github.event.action == 'opened' || github.event.action == 'synchronize' + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: github-token: "${{ secrets.GITHUB_TOKEN }}" script: | @@ -36,6 +36,6 @@ jobs: owner: context.repo.owner, repo: context.repo.repo, issue_number: context.payload.pull_request.number, - body: '@sourcery-ai review', + body: '@sourcery-ai review\n@coderabbitai review', }); diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b7170e5..652e1a7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -44,7 +44,7 @@ jobs: # Wait for this SHA's 'validate' check to finish successfully before publishing - name: Wait for validate check - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0 + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: script: | const targetSha = '${{ github.sha }}'; From f503077663a02017df171352efc5cabacf2c3a93 Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:35:57 +0530 Subject: [PATCH 2/4] ci: scope issue concurrency to triage job to fix parser validation --- .github/workflows/issue-labeler.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml index 388a88e..748d886 100644 --- a/.github/workflows/issue-labeler.yml +++ b/.github/workflows/issue-labeler.yml @@ -16,14 +16,14 @@ permissions: contents: read issues: write -concurrency: - group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }} - cancel-in-progress: true - jobs: triage: name: triage runs-on: ubuntu-latest + if: github.event.issue != null + concurrency: + group: issue-metadata-${{ github.event.issue.number }} + cancel-in-progress: true steps: - name: Checkout repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 From 68c7556a77908f8e1ecee13a5211b1bc6678b9bd Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:38:11 +0530 Subject: [PATCH 3/4] docs: refine security rationale comment for dependabot auto-merge trigger --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index ee8ae81..3277a95 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -16,7 +16,7 @@ name: Dependabot Auto-Merge on: - # zizmor: ignore[dangerous-triggers] Safe here: workflow has zero checkout steps and only evaluates dependabot metadata + # zizmor: ignore[dangerous-triggers] Safe here: zero code checkout, author strictly verified as dependabot[bot], and metadata only gates auto-merge pull_request_target: types: [opened, synchronize, reopened] From e8b621fd055255fd0b15e1530e04862494542246 Mon Sep 17 00:00:00 2001 From: Digvijaysinh Chauhan Date: Tue, 25 Aug 2026 11:45:47 +0530 Subject: [PATCH 4/4] ci: grant contents: write permission to pr-metadata for automated autosubmit merging --- .github/workflows/pr-metadata.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-metadata.yml b/.github/workflows/pr-metadata.yml index 6a2c4b5..51d1252 100644 --- a/.github/workflows/pr-metadata.yml +++ b/.github/workflows/pr-metadata.yml @@ -35,7 +35,7 @@ on: types: [completed] permissions: - contents: read + contents: write pull-requests: write checks: read