[dependabot]

Bumps zizmorcore/zizmor-action from 0.6.3 to 0.7.1.

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
• 8eacaa5 README: bump pins (#167)
• cc914d7 Sync zizmor versions (#166)
• bae72b7 chore(deps): bump the github-actions group with 2 updates (#165)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

LGTM. This is a routine Dependabot bump of a pinned action in an advisory-only workflow.

What was reviewed:

• The one-line change in .github/workflows/zizmor.yml. The action is still pinned to a full commit SHA with a version comment, and the new SHA matches the tip commit listed in the release notes.
• The advanced-security and annotations inputs are passed through unchanged. The step keeps continue-on-error: true, so new or stricter audits in zizmor 0.7.x can only add annotations and can't fail CI.
• Job permissions (contents: read, actions: read) and checkout settings (persist-credentials: false) are unchanged.

Extended reasoning...

The change touches a single uses: line in the zizmor GitHub Actions workflow, moving zizmor-action from v0.6.3 to v0.7.1. The action stays pinned to a full commit SHA. The workflow runs with deny-by-default permissions, read-only job scopes and no persisted credentials. It doesn't touch any application code, secrets or write permissions. I approved because this is a mechanical version bump that follows the repo's SHA-pinning pattern, the step runs in advisory mode, no CODEOWNERS file covers the path, and the PR has no open reviewer objections.