zizmor 1.15.0__tar.gz → 1.15.2__tar.gz

{zizmor-1.15.0 → zizmor-1.15.2}/Cargo.lock

@@ -840,7 +840,7 @@ dependencies = [
 
 [[package]]
 name = "github-actions-models"
-version = "0.33.0"
+version = "0.36.0"
 dependencies = [
  "indexmap",
  "serde",
@@ -3779,7 +3779,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.15.0"
+version = "1.15.2"
 dependencies = [
  "annotate-snippets",
  "anstream",

{zizmor-1.15.0 → zizmor-1.15.2}/Cargo.toml

@@ -13,7 +13,7 @@ rust-version = "1.88.0"
 [workspace.dependencies]
 anyhow = "1.0.100"
 github-actions-expressions = { path = "crates/github-actions-expressions", version = "0.0.10" }
-github-actions-models = { path = "crates/github-actions-models", version = "0.33.0" }
+github-actions-models = { path = "crates/github-actions-models", version = "0.36.0" }
 itertools = "0.14.0"
 pest = "2.8.3"
 pest_derive = "2.8.3"

{zizmor-1.15.0 → zizmor-1.15.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.15.0
+Version: 1.15.2
 License-File: LICENSE
 Home-Page: https://docs.zizmor.sh
 Requires-Python: >=3.9

{zizmor-1.15.0 → zizmor-1.15.2}/crates/github-actions-models/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "github-actions-models"
-version = "0.33.0"
+version = "0.36.0"
 description = "Unofficial, high-quality data models for GitHub Actions workflows, actions, and related components"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/github-actions-models"
 keywords = ["github", "ci"]

{zizmor-1.15.0 → zizmor-1.15.2}/crates/github-actions-models/src/dependabot/v2.rs

@@ -7,6 +7,8 @@
 use indexmap::{IndexMap, IndexSet};
 use serde::Deserialize;
 
+use crate::common::custom_error;
+
 /// A `dependabot.yml` configuration file.
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "kebab-case")]
@@ -245,23 +247,58 @@ pub enum AllowDeny {
 #[derive(Deserialize, Debug, PartialEq)]
 #[serde(rename_all = "kebab-case")]
 pub enum PackageEcosystem {
+    /// `bun`
+    Bun,
+    /// `bundler`
     Bundler,
+    /// `cargo`
     Cargo,
+    /// `composer`
     Composer,
+    /// `conda`
+    Conda,
+    /// `devcontainers`
+    Devcontainers,
+    /// `docker`
     Docker,
+    /// `docker-compose`
+    DockerCompose,
+    /// `dotnet-sdk`
+    DotnetSdk,
+    /// `helm`
+    Helm,
+    /// `elm`
     Elm,
+    /// `gitsubmodule`
     Gitsubmodule,
+    /// `github-actions`
     GithubActions,
+    /// `gomod`
     Gomod,
+    /// `gradle`
     Gradle,
+    /// `maven`
     Maven,
+    /// `mix`
     Mix,
+    /// `npm`
     Npm,
+    /// `nuget`
     Nuget,
+    /// `pip`
     Pip,
+    /// `pub`
     Pub,
+    /// `rust-toolchain`
+    RustToolchain,
+    /// `swift`
     Swift,
+    /// `terraform`
     Terraform,
+    /// `uv`
+    Uv,
+    /// `vcpkg`
+    Vcpkg,
 }
 
 /// Rebase strategies for Dependabot updates.
@@ -275,12 +312,48 @@ pub enum RebaseStrategy {
 
 /// Scheduling settings for Dependabot updates.
 #[derive(Deserialize, Debug)]
-#[serde(rename_all = "kebab-case")]
+#[serde(rename_all = "kebab-case", remote = "Self")]
 pub struct Schedule {
     pub interval: Interval,
     pub day: Option<Day>,
     pub time: Option<String>,
     pub timezone: Option<String>,
+    pub cronjob: Option<String>,
+}
+
+impl<'de> Deserialize<'de> for Schedule {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let schedule = Self::deserialize(deserializer)?;
+
+        if schedule.interval == Interval::Cron && schedule.cronjob.is_none() {
+            return Err(custom_error::<D>(
+                "`schedule.cronjob` must be set when `schedule.interval` is `cron`",
+            ));
+        }
+
+        if schedule.interval != Interval::Cron && schedule.cronjob.is_some() {
+            return Err(custom_error::<D>(
+                "`schedule.cronjob` may only be set when `schedule.interval` is `cron`",
+            ));
+        }
+
+        if schedule.interval != Interval::Weekly && schedule.day.is_some() {
+            return Err(custom_error::<D>(
+                "`schedule.day` is only valid when `schedule.interval` is `weekly`",
+            ));
+        }
+
+        Ok(Self {
+            interval: schedule.interval,
+            day: schedule.day,
+            time: schedule.time,
+            timezone: schedule.timezone,
+            cronjob: schedule.cronjob,
+        })
+    }
 }
 
 /// Schedule intervals.
@@ -290,6 +363,10 @@ pub enum Interval {
     Daily,
     Weekly,
     Monthly,
+    Quarterly,
+    Semiannually,
+    Yearly,
+    Cron,
 }
 
 /// Days of the week.

zizmor-1.15.2/crates/github-actions-models/tests/sample-dependabot/v2/cron-missing-cronjob.invalid.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: cron

zizmor-1.15.2/crates/github-actions-models/tests/sample-dependabot/v2/cronjob-on-daily.invalid.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: daily
+      cronjob: "0 3 * * *"

zizmor-1.15.2/crates/github-actions-models/tests/sample-dependabot/v2/day-on-daily.invalid.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: daily
+      day: monday

zizmor-1.15.2/crates/github-actions-models/tests/sample-dependabot/v2/devcontainers.yml

@@ -0,0 +1,8 @@
+# from: https://containers.dev/guide/dependabot
+
+version: 2
+updates:
+  - package-ecosystem: "devcontainers" # See documentation for possible values
+    directory: "/"
+    schedule:
+      interval: weekly

zizmor-1.15.2/crates/github-actions-models/tests/sample-dependabot/v2/weekly-with-day.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: friday

zizmor-1.15.2/crates/github-actions-models/tests/test_dependabot_v2.rs

@@ -0,0 +1,134 @@
+use std::path::{Path, PathBuf};
+
+use github_actions_models::dependabot::v2::{
+    Day, Dependabot, Directories, Interval, PackageEcosystem, RebaseStrategy,
+};
+use indexmap::IndexSet;
+
+fn sample_dir() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/sample-dependabot/v2")
+}
+
+fn load_dependabot_result(name: &str) -> Result<Dependabot, serde_yaml::Error> {
+    let workflow_path = sample_dir().join(name);
+    let dependabot_contents = std::fs::read_to_string(&workflow_path)
+        .unwrap_or_else(|err| panic!("failed to read {}: {err}", workflow_path.display()));
+    serde_yaml::from_str(&dependabot_contents)
+}
+
+fn load_dependabot(name: &str) -> Dependabot {
+    load_dependabot_result(name).unwrap()
+}
+
+#[test]
+fn test_load_all() {
+    for sample_config in std::fs::read_dir(sample_dir()).unwrap() {
+        let sample_path = sample_config.unwrap().path();
+
+        if sample_path.extension().and_then(|ext| ext.to_str()) != Some("yml") {
+            continue;
+        }
+
+        let sample_name = sample_path
+            .file_name()
+            .and_then(|name| name.to_str())
+            .expect("sample file name not valid UTF-8");
+
+        let result = load_dependabot_result(sample_name);
+
+        let is_invalid = sample_name.contains(".invalid.");
+
+        if is_invalid {
+            assert!(
+                result.is_err(),
+                "expected {sample_name} to fail deserialization"
+            );
+        } else {
+            result.unwrap();
+        }
+    }
+}
+
+#[test]
+fn test_contents() {
+    let dependabot = load_dependabot("sigstore-python.yml");
+
+    assert_eq!(dependabot.version, 2);
+    assert_eq!(dependabot.updates.len(), 3);
+
+    let pip = &dependabot.updates[0];
+    assert_eq!(pip.package_ecosystem, PackageEcosystem::Pip);
+    assert_eq!(pip.directories, Directories::Directory("/".into()));
+    assert_eq!(pip.schedule.interval, Interval::Daily);
+    assert_eq!(pip.open_pull_requests_limit, 5); // default
+
+    let github_actions = &dependabot.updates[1];
+    assert_eq!(
+        github_actions.package_ecosystem,
+        PackageEcosystem::GithubActions
+    );
+    assert_eq!(
+        github_actions.directories,
+        Directories::Directory("/".into())
+    );
+    assert_eq!(github_actions.open_pull_requests_limit, 99);
+    assert_eq!(github_actions.rebase_strategy, RebaseStrategy::Disabled);
+    assert_eq!(github_actions.groups.len(), 1);
+    assert_eq!(
+        github_actions.groups["actions"].patterns,
+        IndexSet::from(["*".to_string()])
+    );
+
+    let github_actions = &dependabot.updates[2];
+    assert_eq!(
+        github_actions.package_ecosystem,
+        PackageEcosystem::GithubActions
+    );
+    assert_eq!(
+        github_actions.directories,
+        Directories::Directory(".github/actions/upload-coverage/".into())
+    );
+    assert_eq!(github_actions.open_pull_requests_limit, 99);
+    assert_eq!(github_actions.rebase_strategy, RebaseStrategy::Disabled);
+    assert_eq!(github_actions.groups.len(), 1);
+    assert_eq!(
+        github_actions.groups["actions"].patterns,
+        IndexSet::from(["*".to_string()])
+    );
+}
+
+#[test]
+fn test_schedule_cron_requires_expression() {
+    let err = load_dependabot_result("cron-missing-cronjob.invalid.yml").unwrap_err();
+    assert!(
+        err.to_string()
+            .contains("`schedule.cronjob` must be set when `schedule.interval` is `cron`")
+    );
+}
+
+#[test]
+fn test_schedule_cronjob_rejected_for_non_cron() {
+    let err = load_dependabot_result("cronjob-on-daily.invalid.yml").unwrap_err();
+    assert!(
+        err.to_string()
+            .contains("`schedule.cronjob` may only be set when `schedule.interval` is `cron`")
+    );
+}
+
+#[test]
+fn test_schedule_day_only_for_weekly() {
+    let err = load_dependabot_result("day-on-daily.invalid.yml").unwrap_err();
+    assert!(
+        err.to_string()
+            .contains("`schedule.day` is only valid when `schedule.interval` is `weekly`")
+    );
+}
+
+#[test]
+fn test_schedule_weekly_accepts_day() {
+    let dependabot = load_dependabot("weekly-with-day.yml");
+    assert_eq!(dependabot.updates.len(), 1);
+    let schedule = &dependabot.updates[0].schedule;
+    assert_eq!(schedule.interval, Interval::Weekly);
+    assert_eq!(schedule.day, Some(Day::Friday));
+}

{zizmor-1.15.0 → zizmor-1.15.2}/crates/zizmor/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "zizmor"
 description = "Static analysis for GitHub Actions"
-version = "1.15.0"
+version = "1.15.2"
 repository = "https://github.com/zizmorcore/zizmor"
 documentation = "https://docs.zizmor.sh"
 keywords = ["cli", "github-actions", "static-analysis", "security"]

zizmor-1.15.0/crates/github-actions-models/tests/test_dependabot_v2.rs

@@ -1,73 +0,0 @@
-use std::path::Path;
-
-use github_actions_models::dependabot::v2::{
-    Dependabot, Directories, Interval, PackageEcosystem, RebaseStrategy,
-};
-use indexmap::IndexSet;
-
-fn load_dependabot(name: &str) -> Dependabot {
-    let workflow_path = Path::new(env!("CARGO_MANIFEST_DIR"))
-        .join("tests/sample-dependabot/v2")
-        .join(name);
-    let dependabot_contents = std::fs::read_to_string(workflow_path).unwrap();
-    serde_yaml::from_str(&dependabot_contents).unwrap()
-}
-
-#[test]
-fn test_load_all() {
-    let sample_configs = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/sample-dependabot/v2");
-
-    for sample_config in std::fs::read_dir(sample_configs).unwrap() {
-        let sample_workflow = sample_config.unwrap().path();
-        let contents = std::fs::read_to_string(sample_workflow).unwrap();
-        serde_yaml::from_str::<Dependabot>(&contents).unwrap();
-    }
-}
-
-#[test]
-fn test_contents() {
-    let dependabot = load_dependabot("sigstore-python.yml");
-
-    assert_eq!(dependabot.version, 2);
-    assert_eq!(dependabot.updates.len(), 3);
-
-    let pip = &dependabot.updates[0];
-    assert_eq!(pip.package_ecosystem, PackageEcosystem::Pip);
-    assert_eq!(pip.directories, Directories::Directory("/".into()));
-    assert_eq!(pip.schedule.interval, Interval::Daily);
-    assert_eq!(pip.open_pull_requests_limit, 5); // default
-
-    let github_actions = &dependabot.updates[1];
-    assert_eq!(
-        github_actions.package_ecosystem,
-        PackageEcosystem::GithubActions
-    );
-    assert_eq!(
-        github_actions.directories,
-        Directories::Directory("/".into())
-    );
-    assert_eq!(github_actions.open_pull_requests_limit, 99);
-    assert_eq!(github_actions.rebase_strategy, RebaseStrategy::Disabled);
-    assert_eq!(github_actions.groups.len(), 1);
-    assert_eq!(
-        github_actions.groups["actions"].patterns,
-        IndexSet::from(["*".to_string()])
-    );
-
-    let github_actions = &dependabot.updates[2];
-    assert_eq!(
-        github_actions.package_ecosystem,
-        PackageEcosystem::GithubActions
-    );
-    assert_eq!(
-        github_actions.directories,
-        Directories::Directory(".github/actions/upload-coverage/".into())
-    );
-    assert_eq!(github_actions.open_pull_requests_limit, 99);
-    assert_eq!(github_actions.rebase_strategy, RebaseStrategy::Disabled);
-    assert_eq!(github_actions.groups.len(), 1);
-    assert_eq!(
-        github_actions.groups["actions"].patterns,
-        IndexSet::from(["*".to_string()])
-    );
-}