zizmor 1.14.0__tar.gz → 1.14.1__tar.gz

{zizmor-1.14.0 → zizmor-1.14.1}/Cargo.lock

@@ -3801,7 +3801,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.14.0"
+version = "1.14.1"
 dependencies = [
  "annotate-snippets",
  "anstream",

{zizmor-1.14.0 → zizmor-1.14.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.14.0
+Version: 1.14.1
 License-File: LICENSE
 Home-Page: https://docs.zizmor.sh
 Requires-Python: >=3.9

{zizmor-1.14.0 → zizmor-1.14.1}/crates/zizmor/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "zizmor"
 description = "Static analysis for GitHub Actions"
-version = "1.14.0"
+version = "1.14.1"
 repository = "https://github.com/zizmorcore/zizmor"
 documentation = "https://docs.zizmor.sh"
 keywords = ["cli", "github-actions", "static-analysis", "security"]

{zizmor-1.14.0 → zizmor-1.14.1}/crates/zizmor/src/audit/ref_version_mismatch.rs

@@ -93,6 +93,8 @@ impl RefVersionMismatch {
         };
 
         if commit_for_ref != commit_sha {
+            tracing::warn!("{commit_for_ref} != {commit_sha}");
+
             let subfeature = Subfeature::new(
                 uses_location.concrete.location.offset_span.end,
                 version_from_comment,
@@ -107,7 +109,7 @@ impl RefVersionMismatch {
                     // that avoids collisions in Linux-sized repositories.
                     uses_location.symbolic.clone().primary().annotated(format!(
                         "points to commit {short_commit}",
-                        short_commit = &commit_sha[..12]
+                        short_commit = &commit_for_ref[..12]
                     )),
                     Feature::from_subfeature(&subfeature, step),
                 ));

{zizmor-1.14.0 → zizmor-1.14.1}/crates/zizmor/tests/integration/snapshots/integration__snapshot__ref_version_mismatch.snap

@@ -6,7 +6,7 @@ warning[ref-version-mismatch]: detects commit SHAs that don't match their versio
   --> @@INPUT@@:21:77
    |
 21 |       - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3.8.1
-   |         -----------------------------------------------------------------   ^^^^^^ points to commit 1a4442cacd43
+   |         -----------------------------------------------------------------   ^^^^^^ points to commit 5e21ff4d9bc1
    |         |
    |         is pointed to by tag v3.8.2
    |