zizmor 1.13.0__tar.gz → 1.14.0__tar.gz

{zizmor-1.13.0 → zizmor-1.14.0}/Cargo.lock

@@ -52,9 +52,9 @@ dependencies = [
 
 [[package]]
 name = "annotate-snippets"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b0f1e2f8ec4bff67c7e1867001ec452595daf315cce10c393b7d4274024f878"
+checksum = "a8ee2f071d418442e50c643c4e7a4051ce3abd9dba11713cc6cdf4f4a3f3cca5"
 dependencies = [
  "anstyle",
  "unicode-width 0.2.0",
@@ -112,9 +112,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.99"
+version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "arrayvec"
@@ -302,11 +302,11 @@ dependencies = [
 
 [[package]]
 name = "camino"
-version = "1.1.12"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd0b03af37dad7a14518b7691d81acb0f8222604ad3d1b02f6b4bed5188c0cd5"
+checksum = "e1de8bc0aa9e9385ceb3bf0c152e3a9b9544f6c4a912c8ae504e80c1f0368603"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -332,9 +332,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "clap"
-version = "4.5.47"
+version = "4.5.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eac00902d9d136acd712710d71823fb8ac8004ca445a89e73a41d45aa712931"
+checksum = "e2134bb3ea021b78629caa971416385309e0131b351b25e01dc16fb54e1b5fae"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -352,9 +352,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.47"
+version = "4.5.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ad9bbf750e73b5884fb8a211a9424a1906c1e156724260fdae972f31d70e1d6"
+checksum = "c2ba64afa3c0a6df7fa517765e31314e983f51dda798ffba27b988194fb65dc9"
 dependencies = [
  "anstream",
  "anstyle",
@@ -364,9 +364,9 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.57"
+version = "4.5.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d9501bd3f5f09f7bbee01da9a511073ed30a80cd7a509f1214bb74eadea71ad"
+checksum = "75bf0b32ad2e152de789bb635ea4d3078f6b838ad7974143e99b99f45a04af4a"
 dependencies = [
  "clap",
 ]
@@ -1230,13 +1230,14 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.11.0"
+version = "2.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2481980430f9f78649238835720ddccc57e52df14ffce1c6f37391d61b563e9"
+checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
 dependencies = [
  "equivalent",
  "hashbrown 0.15.2",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1684,9 +1685,9 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pest"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1db05f56d34358a8b1066f67cbb203ee3e7ed2ba674a6263a1d5ec6db2204323"
+checksum = "21e0a3a33733faeaf8651dfee72dd0f388f0c8e5ad496a3478fa5a922f49cfa8"
 dependencies = [
  "memchr",
  "thiserror 2.0.16",
@@ -1695,9 +1696,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb056d9e8ea77922845ec74a1c4e8fb17e7c218cc4fc11a15c5d25e189aa40bc"
+checksum = "bc58706f770acb1dbd0973e6530a3cff4746fb721207feb3a8a6064cd0b6c663"
 dependencies = [
  "pest",
  "pest_generator",
@@ -1705,9 +1706,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87e404e638f781eb3202dc82db6760c8ae8a1eeef7fb3fa8264b2ef280504966"
+checksum = "6d4f36811dfe07f7b8573462465d5cb8965fffc2e71ae377a33aecf14c2c9a2f"
 dependencies = [
  "pest",
  "pest_meta",
@@ -1718,9 +1719,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.8.1"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edd1101f170f5903fde0914f899bb503d9ff5271d7ba76bbb70bea63690cc0d5"
+checksum = "42919b05089acbd0a5dcd5405fb304d17d1053847b81163d09c4ad18ce8e8420"
 dependencies = [
  "pest",
  "sha2",
@@ -2201,10 +2202,11 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
 dependencies = [
+ "serde_core",
  "serde_derive",
 ]
 
@@ -2228,11 +2230,20 @@ dependencies = [
  "typed-builder",
 ]
 
+[[package]]
+name = "serde_core"
+version = "1.0.226"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba2ba63999edb9dac981fb34b3e5c0d111a69b0924e253ed29d83f7c99e966a4"
+dependencies = [
+ "serde_derive",
+]
+
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.226"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "8db53ae22f34573731bafa1db20f04027b2d25e02d8205921b569171699cdb33"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2241,15 +2252,16 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.143"
+version = "1.0.145"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d401abef1d108fbd9cbaebc3e46611f4b1021f714a0597a71f41ee463f5f4a5a"
+checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
 dependencies = [
  "indexmap",
  "itoa",
  "memchr",
  "ryu",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2983,9 +2995,9 @@ checksum = "c4013970217383f67b18aef68f6fb2e8d409bc5755227092d32efb0422ba24b8"
 
 [[package]]
 name = "tree-sitter-powershell"
-version = "0.25.8"
+version = "0.25.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d76347b6c5300ae20622847aa53c88005d13b6999708ffbe4618b509ddb45178"
+checksum = "ae0e37101b110badaf99aa40460915a8797ceba15fc0ed22773280377a8dffb6"
 dependencies = [
  "cc",
  "tree-sitter-language",
@@ -3789,7 +3801,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.13.0"
+version = "1.14.0"
 dependencies = [
  "annotate-snippets",
  "anstream",

{zizmor-1.13.0 → zizmor-1.14.0}/Cargo.toml

@@ -11,20 +11,20 @@ license = "MIT"
 rust-version = "1.88.0"
 
 [workspace.dependencies]
-anyhow = "1.0.99"
+anyhow = "1.0.100"
 github-actions-expressions = { path = "crates/github-actions-expressions", version = "0.0.10" }
 github-actions-models = { path = "crates/github-actions-models", version = "0.32.0" }
 itertools = "0.14.0"
-pest = "2.8.1"
-pest_derive = "2.8.1"
+pest = "2.8.2"
+pest_derive = "2.8.2"
 pretty_assertions = "1.4.1"
-annotate-snippets = "0.12.3"
+annotate-snippets = "0.12.4"
 anstream = "0.6.20"
 assert_cmd = "2.0.17"
-camino = "1.1.12"
-clap = "4.5.47"
+camino = "1.2.0"
+clap = "4.5.48"
 clap-verbosity-flag = { version = "3.0.4", default-features = false }
-clap_complete = "4.5.57"
+clap_complete = "4.5.58"
 clap_complete_nushell = "4.5.8"
 csv = "1.3.1"
 etcetera = "0.10.0"
@@ -33,7 +33,7 @@ fst = "0.4.7"
 http-cache-reqwest = "0.16"
 human-panic = "2.0.3"
 ignore = "0.4.23"
-indexmap = { version = "2.11.0", features = ["serde"] }
+indexmap = { version = "2.11.4", features = ["serde"] }
 indicatif = "0.18"
 insta = "1.43.2"
 jsonschema = "0.30.0"
@@ -43,9 +43,9 @@ owo-colors = "4.2.2"
 regex = "1.11.2"
 reqwest = { version = "0.12.23", default-features = false }
 reqwest-middleware = "0.4.2"
-serde = { version = "1.0.219", features = ["derive"] }
+serde = { version = "1.0.226", features = ["derive"] }
 serde-sarif = "0.8.0"
-serde_json = "1.0.143"
+serde_json = "1.0.145"
 serde_json_path = "0.7.2"
 serde_yaml = "0.9.34"
 subfeature = { path = "crates/subfeature", version = "0.0.3" }
@@ -59,7 +59,7 @@ tracing-indicatif = "0.3.13"
 tracing-subscriber = "0.3.20"
 tree-sitter = "0.25.9"
 tree-sitter-bash = "0.23.3"
-tree-sitter-powershell = "0.25.8"
+tree-sitter-powershell = "0.25.9"
 yamlpath = { path = "crates/yamlpath", version = "0.25.0" }
 yamlpatch = { path = "crates/yamlpatch", version = "0.3.0" }
 tree-sitter-yaml = "0.7.1"

{zizmor-1.13.0 → zizmor-1.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.13.0
+Version: 1.14.0
 License-File: LICENSE
 Home-Page: https://docs.zizmor.sh
 Requires-Python: >=3.9
@@ -79,6 +79,13 @@ Grafana Labs
 Trail of Bits
 </a>
 </td>
+<td align="center" valign="top" width="15%">
+<a href="https://www.shipfox.io">
+<img src="https://avatars.githubusercontent.com/u/163036520?s=100&v=4" width="100px">
+<br>
+Shipfox
+</a>
+</td>
 </tr>
 </tbody>
 </table>

{zizmor-1.13.0 → zizmor-1.14.0}/crates/github-actions-expressions/src/lib.rs

@@ -304,7 +304,10 @@ impl<'src> Expr<'src> {
                     || func == "startsWith"
                     || func == "endsWith"
                     || func == "toJSON"
-                    || func == "fromJSON"
+                    // TODO(ww): `fromJSON` *is* frequently reducible, but
+                    // doing so soundly with subexpressions is annoying.
+                    // We overapproximate for now and consider it non-reducible.
+                    // || func == "fromJSON"
                     || func == "join"
                 {
                     args.iter().all(|e| e.constant_reducible())

{zizmor-1.13.0 → zizmor-1.14.0}/crates/zizmor/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "zizmor"
 description = "Static analysis for GitHub Actions"
-version = "1.13.0"
+version = "1.14.0"
 repository = "https://github.com/zizmorcore/zizmor"
 documentation = "https://docs.zizmor.sh"
 keywords = ["cli", "github-actions", "static-analysis", "security"]

{zizmor-1.13.0 → zizmor-1.14.0}/crates/zizmor/README.md

@@ -71,6 +71,13 @@ Grafana Labs
 Trail of Bits
 </a>
 </td>
+<td align="center" valign="top" width="15%">
+<a href="https://www.shipfox.io">
+<img src="https://avatars.githubusercontent.com/u/163036520?s=100&v=4" width="100px">
+<br>
+Shipfox
+</a>
+</td>
 </tr>
 </tbody>
 </table>

{zizmor-1.13.0 → zizmor-1.14.0}/crates/zizmor/src/audit/cache_poisoning.rs

@@ -50,12 +50,16 @@ static KNOWN_CACHE_AWARE_ACTIONS: LazyLock<Vec<ActionCoordinate>> = LazyLock::ne
         // https://github.com/actions/setup-node/blob/main/action.yml
         ActionCoordinate::Configurable {
             uses_pattern: "actions/setup-node".parse().unwrap(),
-            control: ControlExpr::single(
-                Toggle::OptIn,
-                "cache",
-                ControlFieldType::FreeString,
-                false,
-            ),
+            control: ControlExpr::any([
+                ControlExpr::single(Toggle::OptIn, "cache", ControlFieldType::FreeString, false),
+                // NOTE: Added with `setup-node@v5`.
+                ControlExpr::single(
+                    Toggle::OptIn,
+                    "package-manager-cache",
+                    ControlFieldType::Boolean,
+                    true,
+                ),
+            ]),
         },
         // https://github.com/actions/setup-python/blob/main/action.yml
         ActionCoordinate::Configurable {

{zizmor-1.13.0 → zizmor-1.14.0}/crates/zizmor/src/audit/excessive_permissions.rs

@@ -180,7 +180,7 @@ impl ExcessivePermissions {
                     let severity = KNOWN_PERMISSIONS.get(name.as_str()).unwrap_or_else(|| {
                         tracing::warn!("unknown permission: {name}");
 
-                        &Severity::Unknown
+                        &Severity::Medium
                     });
 
                     results.push((

{zizmor-1.13.0 → zizmor-1.14.0}/crates/zizmor/src/audit/known_vulnerable_actions.rs

@@ -99,11 +99,12 @@ impl KnownVulnerableActions {
 
         for vuln in vulns {
             let severity = match vuln.severity.as_str() {
-                "low" => Severity::Unknown,
+                "low" => Severity::Low,
                 "medium" => Severity::Medium,
                 "high" => Severity::High,
                 "critical" => Severity::High,
-                _ => Severity::Unknown,
+                // Seems like a safe fallback.
+                _ => Severity::High,
             };
 
             // Get the first patched version from the first vulnerability in the advisory
@@ -303,8 +304,8 @@ mod tests {
             false,
             Some(
                 github_api::Client::new(
-                    github_api::GitHubHost::default(),
-                    github_api::GitHubToken::new("fake").unwrap(),
+                    &github_api::GitHubHost::default(),
+                    &github_api::GitHubToken::new("fake").unwrap(),
                     "/tmp".into(),
                 )
                 .unwrap(),
@@ -748,8 +749,8 @@ jobs:
             false,
             Some(
                 github_api::Client::new(
-                    github_api::GitHubHost::default(),
-                    github_api::GitHubToken::new(&std::env::var("GH_TOKEN").unwrap()).unwrap(),
+                    &github_api::GitHubHost::default(),
+                    &github_api::GitHubToken::new(&std::env::var("GH_TOKEN").unwrap()).unwrap(),
                     "/tmp".into(),
                 )
                 .unwrap(),
@@ -803,8 +804,8 @@ jobs:
             false,
             Some(
                 github_api::Client::new(
-                    github_api::GitHubHost::default(),
-                    github_api::GitHubToken::new(&std::env::var("GH_TOKEN").unwrap()).unwrap(),
+                    &github_api::GitHubHost::default(),
+                    &github_api::GitHubToken::new(&std::env::var("GH_TOKEN").unwrap()).unwrap(),
                     "/tmp".into(),
                 )
                 .unwrap(),

{zizmor-1.13.0 → zizmor-1.14.0}/crates/zizmor/src/audit/mod.rs

@@ -1,6 +1,5 @@
 //! Core namespace for zizmor's audits.
 
-use line_index::LineIndex;
 use thiserror::Error;
 use tracing::instrument;
 use yamlpath::Document;
@@ -32,6 +31,7 @@ pub(crate) mod known_vulnerable_actions;
 pub(crate) mod obfuscation;
 pub(crate) mod overprovisioned_secrets;
 pub(crate) mod ref_confusion;
+pub(crate) mod ref_version_mismatch;
 pub(crate) mod secrets_inherit;
 pub(crate) mod self_hosted_runner;
 pub(crate) mod stale_action_refs;
@@ -58,13 +58,6 @@ impl AuditInput {
         }
     }
 
-    pub(crate) fn line_index(&self) -> &LineIndex {
-        match self {
-            AuditInput::Workflow(workflow) => workflow.as_document().line_index(),
-            AuditInput::Action(action) => action.as_document().line_index(),
-        }
-    }
-
     pub(crate) fn link(&self) -> Option<&str> {
         match self {
             AuditInput::Workflow(workflow) => workflow.link.as_deref(),

zizmor-1.14.0/crates/zizmor/src/audit/ref_version_mismatch.rs

@@ -0,0 +1,162 @@
+use std::sync::LazyLock;
+
+use anyhow::{Result, anyhow};
+use github_actions_models::common::Uses;
+use regex::Regex;
+use subfeature::Subfeature;
+
+use crate::{
+    audit::{Audit, AuditLoadError, AuditState, audit_meta},
+    config::Config,
+    finding::{
+        Confidence, Finding, Severity,
+        location::{Comment, Feature, Location},
+    },
+    github_api,
+    models::{StepCommon, action::CompositeStep, uses::RepositoryUsesExt, workflow::Step},
+};
+
+pub(crate) struct RefVersionMismatch {
+    client: github_api::Client,
+}
+
+audit_meta!(
+    RefVersionMismatch,
+    "ref-version-mismatch",
+    "detects commit SHAs that don't match their version comment tags"
+);
+
+static VERSION_COMMENT_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
+    vec![
+        // Matches "# tag=v2.8.0" or "# tag=v1.2.3"
+        Regex::new(r"#\s*tag\s*=\s*(v\d+(?:\.\d+)*(?:\.\d+)?)").unwrap(),
+        // Matches "# v2.8.0"
+        Regex::new(r"#\s*(v\d+(?:\.\d+)*(?:\.\d+)?)").unwrap(),
+        // Matches version without 'v' prefix: "# tag=2.8.0"
+        Regex::new(r"#\s*tag\s*=\s*(\d+(?:\.\d+)*(?:\.\d+)?)").unwrap(),
+        // More flexible: "# version: 2.8.0"
+        Regex::new(r"#\s*(?:version|ver)\s*[:=]\s*(v?\d+(?:\.\d+)*(?:\.\d+)?)").unwrap(),
+    ]
+});
+
+impl RefVersionMismatch {
+    fn extract_version_from_comments<'doc>(
+        &self,
+        comments: &'doc [Comment<'doc>],
+    ) -> Option<&'doc str> {
+        for comment in comments {
+            for pattern in VERSION_COMMENT_PATTERNS.iter() {
+                if let Some(captures) = pattern.captures(comment.as_ref())
+                    && let Some(version_match) = captures.get(1)
+                {
+                    return Some(version_match.as_str());
+                }
+            }
+        }
+        None
+    }
+
+    fn audit_step_common<'doc, S: StepCommon<'doc>>(
+        &self,
+        step: &S,
+    ) -> anyhow::Result<Vec<Finding<'doc>>> {
+        let mut findings = vec![];
+
+        let Some(Uses::Repository(uses)) = step.uses() else {
+            return Ok(findings);
+        };
+
+        // Only check steps that have commit refs (not symbolic refs like v1.0.0)
+        let Some(commit_sha) = uses.commit_ref() else {
+            return Ok(findings);
+        };
+
+        let step_location = step.location();
+        let uses_location = step_location
+            .with_keys(["uses".into()])
+            .concretize(step.document())?;
+
+        let Some(version_from_comment) =
+            self.extract_version_from_comments(&uses_location.concrete.comments)
+        else {
+            return Ok(findings);
+        };
+
+        let Some(commit_for_ref) =
+            self.client
+                .commit_for_ref(&uses.owner, &uses.repo, version_from_comment)?
+        else {
+            // TODO(ww): Does it make sense to flag this as well?
+            // This indicates a completely bogus version comment,
+            // rather than a mismatch.
+            return Ok(findings);
+        };
+
+        if commit_for_ref != commit_sha {
+            let subfeature = Subfeature::new(
+                uses_location.concrete.location.offset_span.end,
+                version_from_comment,
+            );
+
+            let mut builder = Self::finding()
+                .severity(Severity::Medium)
+                .confidence(Confidence::High)
+                .add_raw_location(Location::new(
+                    // NOTE(ww): We trim the commit SHA to 12 characters
+                    // for display purposes; 12 is a conservative length
+                    // that avoids collisions in Linux-sized repositories.
+                    uses_location.symbolic.clone().primary().annotated(format!(
+                        "points to commit {short_commit}",
+                        short_commit = &commit_sha[..12]
+                    )),
+                    Feature::from_subfeature(&subfeature, step),
+                ));
+
+            if let Some(suggestion) =
+                self.client
+                    .longest_tag_for_commit(&uses.owner, &uses.repo, commit_sha)?
+            {
+                builder = builder.add_location(
+                    uses_location
+                        .symbolic
+                        .annotated(format!("is pointed to by tag {tag}", tag = suggestion.name)),
+                );
+            }
+            findings.push(builder.build(step)?);
+        }
+
+        Ok(findings)
+    }
+}
+
+impl Audit for RefVersionMismatch {
+    fn new(state: &AuditState) -> Result<Self, AuditLoadError> {
+        if state.no_online_audits {
+            return Err(AuditLoadError::Skip(anyhow!(
+                "offline audits only requested"
+            )));
+        }
+
+        state
+            .gh_client
+            .clone()
+            .ok_or_else(|| AuditLoadError::Skip(anyhow!("can't run without a GitHub API token")))
+            .map(|client| Self { client })
+    }
+
+    fn audit_step<'doc>(
+        &self,
+        step: &Step<'doc>,
+        _config: &Config,
+    ) -> anyhow::Result<Vec<Finding<'doc>>> {
+        self.audit_step_common(step)
+    }
+
+    fn audit_composite_step<'doc>(
+        &self,
+        step: &CompositeStep<'doc>,
+        _config: &Config,
+    ) -> anyhow::Result<Vec<Finding<'doc>>> {
+        self.audit_step_common(step)
+    }
+}

{zizmor-1.13.0 → zizmor-1.14.0}/crates/zizmor/src/audit/self_hosted_runner.rs

@@ -59,7 +59,7 @@ impl Audit for SelfHostedRunner {
                             results.push(
                                 Self::finding()
                                     .confidence(Confidence::High)
-                                    .severity(Severity::Unknown)
+                                    .severity(Severity::Medium)
                                     .persona(Persona::Auditor)
                                     .add_location(
                                         job.location()
@@ -77,7 +77,7 @@ impl Audit for SelfHostedRunner {
                             results.push(
                                 Self::finding()
                                     .confidence(Confidence::Low)
-                                    .severity(Severity::Unknown)
+                                    .severity(Severity::Medium)
                                     .persona(Persona::Auditor)
                                     .add_location(
                                         job.location()
@@ -100,7 +100,7 @@ impl Audit for SelfHostedRunner {
                 LoE::Literal(RunsOn::Group { .. }) => results.push(
                     Self::finding()
                         .confidence(Confidence::Low)
-                        .severity(Severity::Unknown)
+                        .severity(Severity::Medium)
                         .persona(Persona::Auditor)
                         .add_location(
                             job.location()
@@ -127,7 +127,7 @@ impl Audit for SelfHostedRunner {
                         results.push(
                             Self::finding()
                                 .confidence(Confidence::High)
-                                .severity(Severity::Unknown)
+                                .severity(Severity::Medium)
                                 .persona(Persona::Auditor)
                                 .add_location(
                                     job.location()

{zizmor-1.13.0 → zizmor-1.14.0}/crates/zizmor/src/audit/template_injection.rs

@@ -378,8 +378,8 @@ impl TemplateInjection {
                 Subfeature::new(expr_span.start, &parsed),
                 // Intentionally not providing a fix here.
                 None,
-                Severity::Unknown,
-                Confidence::Unknown,
+                Severity::Low,
+                Confidence::High,
                 Persona::Pedantic,
             ));
 
@@ -440,7 +440,7 @@ impl TemplateInjection {
                                             (Severity::High, Confidence::High, Persona::default())
                                         }
                                         None => {
-                                            (Severity::Unknown, Confidence::Low, Persona::default())
+                                            (Severity::Low, Confidence::Low, Persona::default())
                                         }
                                     };
 
@@ -477,7 +477,7 @@ impl TemplateInjection {
                                                 origin.raw,
                                             ),
                                             self.attempt_fix(&expr, &parsed, step),
-                                            Severity::Unknown,
+                                            Severity::Low,
                                             Confidence::High,
                                             Persona::Pedantic,
                                         ));