questrail / applyaf / 33505649647
100%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 2
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0%. Remained the same
33505649647

push

github

matthewrankin 
Audit the workflows with zizmor

Everything under src/ is linted on every push. The workflows, which are the
part of this repository that can mint a PyPI credential, were read by eye
alone. zizmor is what found the GITHUB_TOKEN the checkouts had been leaving
in .git/config for every later step to read; it runs here so that the next
finding of that kind does not depend on someone noticing it.

It is a dev dependency pinned in uv.lock and reached through uv run, like
ruff and pyright and for the same reason: the recipe and the CI job audit
with one version rather than whatever uvx resolves that morning. It is in
the grouped dev tools in dependabot.yml so it keeps moving.

It runs as a job of its own rather than as a step gated on one leg of the
matrix the way the Coveralls step is. That gate would mean dropping a
Python version silently stops the audit, and a security check that leaves
quietly is worse than one that was never added. just lint runs it too, so a
workflow problem is caught before the push rather than after it.

Adding it turned up one finding, fixed here: the release workflow called
this one as ./, and GitHub now recommends $/ for a workflow in the same
repository. ./ resolves against the runner's filesystem, so in the general
case a step that had already cloned something could stand in front of the
file being called, while $/ resolves against the repository at that commit
and counts as a pinned reference under GitHub's own policy. Nothing here
could exploit the difference, since a job level uses is read before any
step of that job runs. It is worth pinning anyway, for the reason the
actions are pinned: the release publishes on that call's verdict.

68 of 68 relevant lines covered (100.0%)

1.0 hits per line

Jobs
ID Job ID Ran Files Coverage
1 33505649647.1 2
100.0
 GitHub Action Run
Source Files on build 33505649647