[yocaba]

What

Adds audit-action-pins.yml, a reusable workflow (also run on dev-kit's PRs) that runs zizmor's online audits and fails on impostor commits and on version comments that don't match their SHA. On pull requests it only fails on pins the PR adds or changes; a workflow_dispatch run audits every pin.

Closes #47

Why

update-action-pins only checks that actions are pinned to a SHA, not whether that SHA can be trusted.

A pinned SHA's code never changes, so a finding on a pin the PR doesn't touch means upstream moved a tag. Auditing every pin would block every PR until it's fixed, e.g. on each release of cachix/cachix-action, which moves v17.

known-vulnerable-actions, which #47 asks for, is left out: Renovate bumps vulnerable pins, a bump that is still vulnerable would block the automerged patch & digest group, and an advisory without a fixed version would only block merges. Advisories on existing pins call for alerting, not a merge gate.

Testing

• scripts/test-audit-action-pins.sh runs the filter step and the step listing the lines a PR changes from the workflow file
• Full audit with zizmor 1.31.0: dev-kit's .github/ passes; the tree before chore(deps): update dependencies (patch & digest) #60 fails on three mismatched comments; a test workflow fails on an impostor actions/checkout commit
• On a PR that changes one mismatched pin in a test workflow with several findings, only that pin fails the check

Notes for reviewers

• Stacked on feat: fail when an action pin's SHA changes under the same version #64, whose comment rule makes sure zizmor checks every pin's comment against its SHA.
• Ignore comments and zizmor.yml are not honored.
• A repo adopting the workflow should run it once manually; its stub needs workflow_dispatch for that.
• zizmor comes from dev-kit's own locked nixpkgs at the commit the workflow runs from, so Renovate's lock refresh updates it.
• Without a token zizmor silently skips its online audits, so the job fails instead.

Checklist

• Tests added/updated, or confirmed that no tests are required
• No breaking changes, or upgrade path documented above
• Readable commit history (squashed and cleaned up as desired)
• AI code review considered and comments resolved

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: bcee4ba6-60ec-45a7-a796-7afceae0131f

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}