From 0045532780f40d6fbddeab37c70cd61baef6efaa Mon Sep 17 00:00:00 2001 From: Wouter Vanden Hove Date: Tue, 3 Nov 2026 17:30:36 +0100 Subject: [PATCH 1/2] CI: inline pinned just version to fix zizmor unpinned-tools alerts zizmor cannot resolve ${{ env.JUST_VERSION }} and reports setup-just as possibly installing an unpinned tool (code-scanning alerts #1, #3, #9). Inline the literal version and drop the now-unused JUST_VERSION env var. Claude-Session: https://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d --- .github/workflows/linting.yaml | 6 +----- .github/workflows/releasing.yaml | 6 +----- .github/workflows/testing.yaml | 6 +----- 3 files changed, 3 insertions(+), 15 deletions(-) diff --git a/.github/workflows/linting.yaml b/.github/workflows/linting.yaml index ee396a0..5b5e269 100644 --- a/.github/workflows/linting.yaml +++ b/.github/workflows/linting.yaml @@ -31,10 +31,6 @@ env: # https://github.com/actions/runner/issues/241 PY_COLORS: 1 - # Pin just version for reproducible builds - # https://github.com/casey/just/releases - JUST_VERSION: "1.58.0" - # Pin uv version for reproducible builds # https://github.com/astral-sh/uv/releases UV_VERSION: "0.12.5" @@ -80,7 +76,7 @@ jobs: - name: Install pinned version of just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 with: - just-version: ${{ env.JUST_VERSION }} + just-version: "1.58.0" # https://github.com/casey/just/releases # repo: https://github.com/astral-sh/setup-uv # releases: https://github.com/astral-sh/setup-uv/tags diff --git a/.github/workflows/releasing.yaml b/.github/workflows/releasing.yaml index 678221e..2058994 100644 --- a/.github/workflows/releasing.yaml +++ b/.github/workflows/releasing.yaml @@ -66,10 +66,6 @@ concurrency: cancel-in-progress: false env: - # Pin just version for reproducible builds - # https://github.com/casey/just/releases - JUST_VERSION: "1.58.0" - # Pin uv version for reproducible builds # https://github.com/astral-sh/uv/releases UV_VERSION: "0.12.5" @@ -93,7 +89,7 @@ jobs: - name: Install pinned version of just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 with: - just-version: ${{ env.JUST_VERSION }} + just-version: "1.58.0" # https://github.com/casey/just/releases - name: Install pinned version of uv uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml index f092840..c872047 100644 --- a/.github/workflows/testing.yaml +++ b/.github/workflows/testing.yaml @@ -31,10 +31,6 @@ env: # https://github.com/actions/runner/issues/241 PY_COLORS: 1 - # Pin just version for reproducible builds - # https://github.com/casey/just/releases - JUST_VERSION: "1.58.0" - # Pin uv version for reproducible builds # https://github.com/astral-sh/uv/releases UV_VERSION: "0.12.5" @@ -94,7 +90,7 @@ jobs: - name: Install pinned version of just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 with: - just-version: ${{ env.JUST_VERSION }} + just-version: "1.58.0" # https://github.com/casey/just/releases # repo: https://github.com/astral-sh/setup-uv # releases: https://github.com/astral-sh/setup-uv/tags From b82150825ab6504f4737783321b7f518b1ed52db Mon Sep 17 00:00:00 2001 From: Wouter Vanden Hove Date: Tue, 3 Nov 2026 17:58:28 +0100 Subject: [PATCH 2/2] CI: keep JUST_VERSION env var, ignore zizmor unpinned-tools inline instead Restore the JUST_VERSION env var next to UV_VERSION and mark the setup-just steps with an inline zizmor ignore: just is pinned via the env var, which zizmor cannot evaluate. Claude-Session: https://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d --- .github/workflows/linting.yaml | 6 +++++- .github/workflows/releasing.yaml | 6 +++++- .github/workflows/testing.yaml | 6 +++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/workflows/linting.yaml b/.github/workflows/linting.yaml index 5b5e269..a8c291d 100644 --- a/.github/workflows/linting.yaml +++ b/.github/workflows/linting.yaml @@ -31,6 +31,10 @@ env: # https://github.com/actions/runner/issues/241 PY_COLORS: 1 + # Pin just version for reproducible builds + # https://github.com/casey/just/releases + JUST_VERSION: "1.58.0" + # Pin uv version for reproducible builds # https://github.com/astral-sh/uv/releases UV_VERSION: "0.12.5" @@ -76,7 +80,7 @@ jobs: - name: Install pinned version of just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 with: - just-version: "1.58.0" # https://github.com/casey/just/releases + just-version: ${{ env.JUST_VERSION }} # zizmor: ignore[unpinned-tools] pinned via env.JUST_VERSION # repo: https://github.com/astral-sh/setup-uv # releases: https://github.com/astral-sh/setup-uv/tags diff --git a/.github/workflows/releasing.yaml b/.github/workflows/releasing.yaml index 2058994..4496d8f 100644 --- a/.github/workflows/releasing.yaml +++ b/.github/workflows/releasing.yaml @@ -66,6 +66,10 @@ concurrency: cancel-in-progress: false env: + # Pin just version for reproducible builds + # https://github.com/casey/just/releases + JUST_VERSION: "1.58.0" + # Pin uv version for reproducible builds # https://github.com/astral-sh/uv/releases UV_VERSION: "0.12.5" @@ -89,7 +93,7 @@ jobs: - name: Install pinned version of just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 with: - just-version: "1.58.0" # https://github.com/casey/just/releases + just-version: ${{ env.JUST_VERSION }} # zizmor: ignore[unpinned-tools] pinned via env.JUST_VERSION - name: Install pinned version of uv uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml index c872047..0b643d2 100644 --- a/.github/workflows/testing.yaml +++ b/.github/workflows/testing.yaml @@ -31,6 +31,10 @@ env: # https://github.com/actions/runner/issues/241 PY_COLORS: 1 + # Pin just version for reproducible builds + # https://github.com/casey/just/releases + JUST_VERSION: "1.58.0" + # Pin uv version for reproducible builds # https://github.com/astral-sh/uv/releases UV_VERSION: "0.12.5" @@ -90,7 +94,7 @@ jobs: - name: Install pinned version of just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 with: - just-version: "1.58.0" # https://github.com/casey/just/releases + just-version: ${{ env.JUST_VERSION }} # zizmor: ignore[unpinned-tools] pinned via env.JUST_VERSION # repo: https://github.com/astral-sh/setup-uv # releases: https://github.com/astral-sh/setup-uv/tags