zizmor 1.14.0__tar.gz → 1.14.2__tar.gz

{zizmor-1.14.0 → zizmor-1.14.2}/Cargo.lock

@@ -3801,7 +3801,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.14.0"
+version = "1.14.2"
 dependencies = [
  "annotate-snippets",
  "anstream",

{zizmor-1.14.0 → zizmor-1.14.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.14.0
+Version: 1.14.2
 License-File: LICENSE
 Home-Page: https://docs.zizmor.sh
 Requires-Python: >=3.9

{zizmor-1.14.0 → zizmor-1.14.2}/crates/zizmor/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "zizmor"
 description = "Static analysis for GitHub Actions"
-version = "1.14.0"
+version = "1.14.2"
 repository = "https://github.com/zizmorcore/zizmor"
 documentation = "https://docs.zizmor.sh"
 keywords = ["cli", "github-actions", "static-analysis", "security"]

{zizmor-1.14.0 → zizmor-1.14.2}/crates/zizmor/src/audit/ref_version_mismatch.rs

@@ -93,6 +93,8 @@ impl RefVersionMismatch {
         };
 
         if commit_for_ref != commit_sha {
+            tracing::warn!("{commit_for_ref} != {commit_sha}");
+
             let subfeature = Subfeature::new(
                 uses_location.concrete.location.offset_span.end,
                 version_from_comment,
@@ -107,7 +109,7 @@ impl RefVersionMismatch {
                     // that avoids collisions in Linux-sized repositories.
                     uses_location.symbolic.clone().primary().annotated(format!(
                         "points to commit {short_commit}",
-                        short_commit = &commit_sha[..12]
+                        short_commit = &commit_for_ref[..12]
                     )),
                     Feature::from_subfeature(&subfeature, step),
                 ));

{zizmor-1.14.0 → zizmor-1.14.2}/crates/zizmor/src/audit/use_trusted_publishing.rs

@@ -340,10 +340,19 @@ impl Audit for UseTrustedPublishing {
         // In addition to the shared action matching above, we can
         // also check for some `run:` patterns that indicate publishing
         // without Trusted Publishing.
-        // We check this regardless of id-token permission state because:
-        // 1. If no id-token: indicates missing trusted publishing setup
-        // 2. If has id-token but uses manual tokens: indicates hybrid/incomplete migration
-        if let StepBodyCommon::Run { run, .. } = step.body() {
+
+        // We can only check these reliably on workflows and not actions,
+        // since we need to be able to see the `id-token` permission's
+        // state to filter out any false positives.
+        //
+        // NOTE(ww): With #1161 we loosened this check and turned the
+        // "has ID token" check into a confidence modifier rather than
+        // a strict filter. This ended up being overly imprecise, since a lot
+        // of publishing commands use trusted publishing implicitly if
+        // the environment supports it. We reverted this with #1191.
+        if let StepBodyCommon::Run { run, .. } = step.body()
+            && !step.parent.has_id_token()
+        {
             let shell = step.shell().unwrap_or_else(|| {
                 tracing::debug!(
                     "use-trusted-publishing: couldn't determine shell type for {workflow}:{job} step {stepno}",
@@ -356,21 +365,10 @@ impl Audit for UseTrustedPublishing {
             });
 
             for subfeature in self.trusted_publishing_command_candidates(run, shell)? {
-                // Adjust confidence based on whether id-token permission is present
-                let confidence = if step.parent.has_id_token() {
-                    // Higher confidence when id-token is present but manual tokens are still used
-                    // This indicates a hybrid/incomplete migration that should be flagged
-                    Confidence::High
-                } else {
-                    // Low confidence when no id-token - could be intentional for non-TP registries
-                    // or legitimate reasons not to use trusted publishing
-                    Confidence::Low
-                };
-
                 findings.push(
                     Self::finding()
                         .severity(Severity::Informational)
-                        .confidence(confidence)
+                        .confidence(Confidence::High)
                         .add_location(step.location().hidden())
                         .add_location(
                             step.location()

{zizmor-1.14.0 → zizmor-1.14.2}/crates/zizmor/tests/integration/snapshot.rs

@@ -306,6 +306,15 @@ fn use_trusted_publishing() -> Result<()> {
             .run()?
     );
 
+    // No use-trusted-publishing findings expected here.
+    insta::assert_snapshot!(
+        zizmor()
+            .input(input_under_test(
+                "use-trusted-publishing/issue-1191-repro.yml"
+            ))
+            .run()?
+    );
+
     Ok(())
 }
 

{zizmor-1.14.0 → zizmor-1.14.2}/crates/zizmor/tests/integration/snapshots/integration__e2e__gha_hazmat.snap

@@ -265,7 +265,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> .github/workflows/cache-poisoning.yml:36:9

{zizmor-1.14.0 → zizmor-1.14.2}/crates/zizmor/tests/integration/snapshots/integration__snapshot__ref_version_mismatch.snap

@@ -6,7 +6,7 @@ warning[ref-version-mismatch]: detects commit SHAs that don't match their versio
   --> @@INPUT@@:21:77
    |
 21 |       - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3.8.1
-   |         -----------------------------------------------------------------   ^^^^^^ points to commit 1a4442cacd43
+   |         -----------------------------------------------------------------   ^^^^^^ points to commit 5e21ff4d9bc1
    |         |
    |         is pointed to by tag v3.8.2
    |

{zizmor-1.14.0 → zizmor-1.14.2}/crates/zizmor/tests/integration/snapshots/integration__snapshot__use_trusted_publishing-3.snap

@@ -10,7 +10,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:17:14
@@ -20,7 +20,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:24:11
@@ -33,7 +33,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
 27 | |             --no-verify
    | |_______________________^ this command
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:37:14
@@ -43,7 +43,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:42:14
@@ -53,7 +53,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:49:11
@@ -66,7 +66,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
 52 | |             --no-verify
    | |_______________________^ this command
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:56:14
@@ -76,7 +76,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:63:11
@@ -89,6 +89,6 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
 66 | |             publish
    | |___________________^ this command
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 9 findings (1 suppressed): 8 informational, 0 low, 0 medium, 0 high

{zizmor-1.14.0 → zizmor-1.14.2}/crates/zizmor/tests/integration/snapshots/integration__snapshot__use_trusted_publishing-4.snap

@@ -21,7 +21,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:26:9
@@ -42,7 +42,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:43:14
@@ -52,7 +52,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:49:14
@@ -62,7 +62,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:57:11
@@ -73,7 +73,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
 57 |           npm publish --access public
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^ this command
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:63:14
@@ -83,7 +83,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:69:14
@@ -93,7 +93,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:75:14
@@ -103,7 +103,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
   --> @@INPUT@@:81:14
@@ -113,47 +113,7 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
    |         |
    |         this step
    |
-   = note: audit confidence → Low
-
-info[use-trusted-publishing]: prefer trusted publishing for authentication
-   --> @@INPUT@@:100:14
-    |
-100 |         run: npm publish --provenance
-    |         ---  ^^^^^^^^^^^^^^^^^^^^^^^^ this command
-    |         |
-    |         this step
-    |
-    = note: audit confidence → High
-
-info[use-trusted-publishing]: prefer trusted publishing for authentication
-   --> @@INPUT@@:109:14
-    |
-109 |         run: npm publish --provenance
-    |         ---  ^^^^^^^^^^^^^^^^^^^^^^^^ this command
-    |         |
-    |         this step
-    |
-    = note: audit confidence → High
-
-info[use-trusted-publishing]: prefer trusted publishing for authentication
-   --> @@INPUT@@:113:14
-    |
-113 |         run: npm publish --provenance
-    |         ---  ^^^^^^^^^^^^^^^^^^^^^^^^ this command
-    |         |
-    |         this step
-    |
-    = note: audit confidence → High
-
-info[use-trusted-publishing]: prefer trusted publishing for authentication
-   --> @@INPUT@@:123:14
-    |
-123 |         run: npm publish
-    |         ---  ^^^^^^^^^^^ this command
-    |         |
-    |         this step
-    |
-    = note: audit confidence → High
+   = note: audit confidence → High
 
 info[use-trusted-publishing]: prefer trusted publishing for authentication
    --> @@INPUT@@:129:9
@@ -166,14 +126,4 @@ info[use-trusted-publishing]: prefer trusted publishing for authentication
     |
     = note: audit confidence → High
 
-info[use-trusted-publishing]: prefer trusted publishing for authentication
-   --> @@INPUT@@:134:14
-    |
-134 |         run: npm publish
-    |         ---  ^^^^^^^^^^^ this command
-    |         |
-    |         this step
-    |
-    = note: audit confidence → High
-
-18 findings (1 suppressed): 17 informational, 0 low, 0 medium, 0 high
+13 findings (1 suppressed): 12 informational, 0 low, 0 medium, 0 high

zizmor-1.14.2/crates/zizmor/tests/integration/snapshots/integration__snapshot__use_trusted_publishing-5.snap

@@ -0,0 +1,5 @@
+---
+source: crates/zizmor/tests/integration/snapshot.rs
+expression: "zizmor().input(input_under_test(\"use-trusted-publishing/issue-1191-repro.yml\")).run()?"
+---
+No findings to report. Good job! (2 suppressed)

zizmor-1.14.2/crates/zizmor/tests/integration/test-data/use-trusted-publishing/issue-1191-repro.yml

@@ -0,0 +1,24 @@
+# https://github.com/zizmorcore/zizmor/issues/1191
+name: "Publish to PyPI"
+
+on:
+  workflow_call:
+
+jobs:
+  pypi-publish:
+    name: Upload to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+    permissions:
+      # For PyPI's trusted publishing.
+      id-token: write
+    steps:
+      - name: "Install uv"
+        uses: astral-sh/setup-uv@b75a909f75acd358c2196fb9a5f1299a9a8868a4 # v6.7.0
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          pattern: wheels-*
+          path: wheels
+      - name: Publish to PyPi
+        run: uv publish -v wheels/*